Protecting Māori data: Can a Privacy Code of Practice provide a partial solution?

Abstract

This paper explores whether a Māori Data Privacy Code, developed under the Privacy Act 2020, could provide additional protection for classes of information that are regarded by Māori as tapu. The Act already covers the personal information of Māori individuals in the same way it does any other individual. We argue that a MDP Code could offer additional protection for particular classes of sensitive personal information – specifically whakapapa data and data pertaining to deceased Māori. A MDP Code could restrict the purposes for which such information can be collected, used, disclosed, retained, stored and disposed of; put stronger requirements on agencies to demonstrate that their collection and use of this information is justified; require free, prior and informed consent for its use and disclosure; and provide for greater transparency and independent Māori oversight.