Please note, this is a script from Episode Four of our video series, the digital download: 2023 - Tech year in review, which you can access here.
In this episode, we'll be discussing key regulatory developments in the tech space in 2023, both in New Zealand and around the world.
Global regulation
There's been a media storm surrounding AI over the last 12 months, and we've seen a raft of regulatory action taken in response.
The EU's AI Act will be the world's first comprehensive AI law when it's passed, and it's expected to have a flow down impact on jurisdictions in the same way that the GDPR has. The AI Act classifies and regulates AI applications based on risk levels and will ban certain types of AI applications.
China, Canada, the USA, the UK and Australia have all made significant progress this year in terms of developing their approach to the regulation of AI.
Local developments
While New Zealand has taken a 'wait and see' approach in relation to AI regulation generally, the Office of the Privacy Commissioner (OPC) has released two sets of guidance for organisations using, or looking to use, AI tools in New Zealand.
There have been some other significant local regulatory developments in the tech space this year, which focus on the use of data.
The Digital Identity Services Trust Framework Act was passed earlier this year and will come into effect in July 2024 (more on this here). The core objective of the Act is to help develop digital identity services that are trusted and people-centric. While the Act will primarily regulate digital identity service providers on an opt-in basis, it will also have an impact on individuals and organisations in the digital identity ecosystem.
In June, the Government released the long-awaited exposure draft of the Customer and Product Data Bill - NZ's consumer data right (CDR). The government also confirmed that the banking sector will be the first sector to be bought in-scope of the regime (more on this here).
In September, the Government released the Privacy Amendment Bill to broaden the notification requirements under the Privacy Act in respect of collection of personal information. If passed, the notification requirements under the Privacy Act will also apply to collection of personal information indirectly through a third party (more on this here).
In September, Stats NZ announced the establishment of an Interim Centre for Data Ethics and Innovation to foster the ethical and trusted use of data by government. The Interim Centre is currently a small unit within the function of the Government Chief Data Steward, but will transition to a formalised centre with a wider mandate in 12 months' time. The Centre is to give effect to one of the workstreams of the Digital Strategy for Aotearoa, which was released by the Government in 2022 (more on this here).
Māori perspectives
In the last 12 months we've seen an increasing acknowledgement of the importance of Māori perspectives relating to digital identity, data, and AI.
The Digital Identity Services Trust Framework Act demonstrates a commitment to ensuring that digital identity systems in Aotearoa reflect Māori perspectives and tikanga. For example, the governing board must include people with knowledge of Te Ao Māori approaches to identity and have expertise in Te Tiriti.
Similarly, it is acknowledged in the exposure draft of the Customer and Product Data Bill that Te Tiriti creates rights and interests for Māori and that these must be taken into account when developing secondary legislation.
The need to consider Māori perspectives on AI and data is also highlighted in the OPC's recent guidance on AI tools. The OPC recommends that organisations consider Māori perspectives and engage proactively with Māori to address concerns in relation to AI tools.
That brings us to the end of our 2023 - Tech Year in Review series. We hope you found it interesting, and we look forward to seeing you again soon in 2024. Thanks for joining us.
This article is intended only to provide a summary of the subject covered. It does not purport to be comprehensive or to provide legal advice. No person should act in reliance on any statement contained in this publication without first obtaining specific professional advice. If you require any advice or further information on the subject matter of this newsletter, please contact the partner/solicitor in the firm who normally advises you, or alternatively contact one of the partners listed below.