Amend the Privacy Act to prohibit the selling of consumer smart appliance data

What is this about?

This petition asks the New Zealand Parliament to change the Privacy Act 2020. It seeks to stop companies from selling data collected by "smart" household items. Smart appliances are devices like fridges, washing machines, or lights that connect to the internet. Internet of Things (IoT) is the general term for these connected devices. Telemetry refers to the technical data these devices send back to manufacturers, such as usage patterns or location. Data brokers are companies that buy and sell this personal information to others, often for advertising or profiling.

Current Situation in New Zealand

Currently, the Privacy Act 2020 regulates how organisations collect and use personal information. However, it does not explicitly ban the sale of data from connected home devices to third parties. The petitioners argue that this gap allows consumer data to be commodified without clear consent. There is growing concern that this data can be used to create detailed profiles of individuals, potentially exposing them to targeted scams or identity theft. While the Office of the Privacy Commissioner oversees compliance, specific legislation targeting IoT data trading does not currently exist.

Arguments in Favour

• Enhanced Security: Prohibiting the sale of appliance data reduces the risk of malicious actors using leaked data for cybercrime or phishing.
• True Consent: An "opt-in" requirement ensures users actively choose to share data, rather than having it collected by default.
• Privacy Protection: Household data is highly sensitive, revealing habits, routines, and presence in the home. Keeping this data within the manufacturer’s control may better protect user privacy.

Arguments Against

• Existing Protections: Critics argue the Privacy Act 2020 already requires organisations to use personal information only for the purpose for which it was collected. Adding specific IoT clauses may be redundant.
• Innovation Impact: Strict bans on data sharing could limit the development of new smart home features that rely on aggregated, anonymised data to improve efficiency and user experience.
• Regulatory Burden: Defining exactly what constitutes "selling" versus "sharing" or "processing" data in a complex digital ecosystem could create legal ambiguity and compliance costs for businesses.

Relevant Context

The Privacy Act 2020 came into force in July 2020, replacing the 1993 Act. It introduced stricter rules on cross-border data transfers and gave individuals more control over their information. The Office of the Privacy Commissioner is the independent regulator responsible for enforcing these laws. Recently, there has been increased global attention on IoT security, with various international bodies warning that connected devices often lack robust security standards. In New Zealand, consumers are increasingly adopting smart home technology, making the regulation of this data a relevant civic issue. The petition specifically targets the commercialisation of this data, distinguishing it from internal use by the device manufacturer.

⚡ Cached from a previous visit