The Herald's David Fisher has an excellent piece this morning on the wider issues raised by the Police's warrantless demand for Nicky Hager's private information. As he points out, such demands are a routine investigative tool for police - so routine that they simply don't bother to count it. But they make over 1600 requests a year to TradeMe, and if they make a comparable amount to banks, that's over 30,000 warrantless invasions of privacy a year.
So what can we do about it? As Fisher points out, "[t]he simple act of transparency is likely to reduce the practice". Once TradeMe started publish statistics, customers started applying pressure, and they in turn responded by telling the police to get warrants or production orders. Which is what they should be doing anyway. There's already caselaw that intrusive information obtained in this way without use of a formal order is inadmissible in court (R v. Ellerington, CRI-2006-032-3536), and forcing the police to meet the reasonable grounds tests of the Search and Surveillance Act 2012 before going through people's private information will ensure they build robust cases and do not intrude without cause. As for how to get that transparency, beyond promoting it as good business practice, I suggest that we legislate. The sorts of bodies we want to cover (banks, ISPS, electricity companies) are largely already defined by statute, so they're easy to identify legislatively. Then its just a simple matter of requiring covered bodies to publish annually a report on their website or in their annual report saying how many times customer information was requested and how many times the requests were responded to.
We should also be requiring the police to be more transparent. They're already required to report on their use of search and interception warrants, and this should be extended to include both production orders and informal requests for customer or third-party information in reliance on Principle 11(e) of the Privacy Act. That way we can also see how large the problem is and whether we need further measures in place to limit police powers of intrusion.
The police are routinely invading people's privacy without any statutory authority to do so. We need to do something about it. Transparency around these intrusions is the beginning of any solution.