New Zealand’s privacy debate has entered a new phase. It is no longer enough for agencies to apologise after a breach, review processes and promise lessons