Ticking "accept" on terms and conditions might mean agreeing to have personal information sold to a third party. Photo / Getty Images
Ticking "accept" on terms and conditions might mean agreeing to have personal information sold to a third party. Photo / Getty Images
New Zealand's Privacy Act controls how agencies (including government departments, companies, religious groups, schools and clubs) collect, use, disclose, store and give access to personal information. Twelve principles are designed to protect that information.
The act applies to companies operating here, as well as New Zealand companies storing data overseas.
However, Privacy Commissioner spokesman Charles Mabbett says offshore companies are not expected to comply with New Zealand law.
"For example, any complaint about how a US company - without a New Zealand subsidiary - handles personal information would have to be directed at the Federal Trade Commission in the US," Mr Mabbett says.
"Consumers need to be aware of what they may be agreeing or consenting to when they download a mobile app or use a wearable device."
He says ticking "accept" on terms might mean agreeing to have personal information sold to a third party.
The International Association of Privacy Professionals (iappANZ), a not-for-profit interest group, educates members about practical, legal and technical issues.
IappANZ member Gareth Abdinor says very few people pay attention to what data is being collected about them.
For example, he says US-based Apple products require users to scroll through multiple pages of terms and conditions before being allowed to proceed.
"The average person isn't a lawyer and isn't going to wade through 15 pages of legalese.
"Even if they did, chances are, they wouldn't understand it. There are a lot of companies that say in their policies they can use any information about you in any way they want. I'm sure people using the product won't be aware of that."
Mr Abdinor cites a well-known quote referring to "free" online applications: "If you're not paying for it, you are the product."
Tauranga employment attorney Shima Grice, with Sharp Tudhope, encourages consumers to be thoughtful about information they disclose to companies and what they post publicly. "Everyone has learned the internet is not an anonymous place," she says.
Privacy experts say new questions are being posed by users uploading volumes of personal information from devices such as exercise watches.
A case in Canada filed last year has become the first known personal injury case that will use activity data from a Fitbit to help show the effects of an accident on a client. Mrs Grice's cases are more low-tech, but nonetheless pose consequences.
"Yes, there is data mining and huge amounts of aggregation of information, but still on a personal level, people aren't getting it right." She says the government would need a statutory or contractual agreement to get a company to deliver data a consumer had provided.
Still, she says the often-expressed view people who have nothing to hide needn't worry is naive.
"The reality is, once the information is out there, it can be used and manipulated. By all means, use your watch, it's a tool, it's helpful, but be thoughtful about how you share that information."
Ms Grice says consumers who want a product or service have no bargaining power: "You can't negotiate those terms. It's take or leave it." She suggests asking: "What information am I sharing?" "Who could see the information and how could it be used?"
In addition, Mrs Grice says consumers may choose to leave information fields blank or find another company to provide the service.
Garmin, which makes watches that use GPS to track location, says on its website users must consent for the company to sell personal information. Fitbit, a similar fitness tracking device, says the company does not sell information collected from the device that can identify individual users.
However, its website says Fitbit will: " ... only share data about you when it is necessary to provide our services, when the data is de-identified and aggregated, or when you direct us to share it." Facebook has a similar privacy policy.
Mr Abdinor says if people are giving away information, they should get something in return.
"These devices potentially collect a huge amount of information about an individual and it's not as clear as it should be what's going to be done and who it's gonna be shared with. A lot of these companies are based overseas and the overseas legal framework is often not as comprehensive as it is in New Zealand and information can be shared with third parties more easily than it can here."
Waikato University Acting Dean of Law Wayne Rumbles says the introduction of the Apple Watch, expected for sale in New Zealand this year, ups the ante in the privacy debate.
"The more of these devices are out there, the more we as a society have to decide what to do and how to control the information."
Mr Rumbles says there's no way to control data once it's offshore, so global standards are necessary. " ... but that's a big ask and that's gonna take a long time. People need to be aware of information they're giving to third parties.
"They could be anywhere - China, Russia - we need to be more mindful about what we're giving away and whether it's necessary, or not."
Witness fitness with new device
Mount Maunganui triathlete Graham Gove says he has been using Garmin products for the past four years to monitor his fitness. His newest watch is the Forerunner 920XT, which measures steps, sleep and calories burned all day.
Triathlete Graham Gove uses many devices when he is out training. Photo / John Borren
The watch uses GPS to map movement and distance, data Mr Gove says his home Wi-Fi system automatically uploads to Garmin Connect. "Then, I go a step further and connect to Strava - a website where you can connect with people on different devices ... it compares you to your connections."
Mr Gove says he has found support and encouragement online, so divulging information is worthwhile.
"Yes, there's a lot of information online but there's not a lot that people can do with it. People can see that I ran 5km in 22 minutes and had a heart-rate of 145. They can look at a map and see where I've run, so from a security point of view people need to be aware. On a bike-ride, people start from home, ride 50 kilometres and return. It tells everyone where they live, but it's only people you allow. There are options where they can hide that information, as well."
Mr Gove says private people may want to stay off social media and avoid uploading data online, " ... but for me, the benefits of my devices far outweigh the cons of who's watching where I'm going. If I do a good run, I want my connections to know. "
Mr Gove says people in his online fitness community like to analyse their data to get fitter, and he likes seeing his improvements over time. "These devices are so capable of giving you the information you require ... if you want to look deeper into how to get fitter, it's all there."
