NEW ZEALAND Law and Practice Contributed by: Shelley Slade-Gully, Tina Liu, Phil Taylor and Veronica Hartley, Tompkins Wake
experience in the energy and telecommunications sectors. Prior to joining Tompkins Wake, Veronica worked in-house at Intellihub Limited, negotiating metering services agreements and acquisitions, and advising on data governance and regulatory compliance within a highly regulated environment. She also brings experience advising on GDPR compliance gained during her time practising in the United Kingdom. Veronica is admitted in New Zealand and England & Wales.
Tompkins Wake Westpac House, Level 8 430 Victoria Street Hamilton 3204 New Zealand
Tel: +64 7 839 4771 Fax: +64 7 839 4913 Email: tomwake@tompkinswake.co.nz Web: www.tompkinswake.com
1. Legal and Regulatory Framework 1.1 Overview of Data and Privacy-Related Laws Privacy Act 2020 and Information Privacy Principles New Zealand’s principal data protection law is the Privacy Act 2020 (the “Privacy Act”), which applies across both public and private sectors. It regulates the collection, use, storage, access and disclosure of “personal information” through 13 Information Pri - vacy Principles (IPPs) and provides an oversight and complaints framework administered by the Office of the Privacy Commissioner. Codes of Practice The Privacy Act is supplemented by codes of practice issued by the Privacy Commissioner. These codes have the force of law and modify the IPPs for particu - lar sectors or data types. They include the following:
• Telecommunications Information Privacy Code 2020; and • Biometric Processing Privacy Code 2025. See 5.3 Data Localisation Requirements for cross- border transfer requirements under these codes. Right to Privacy There is no single constitutional “right to privacy” in New Zealand, but privacy interests are protected through multiple instruments. Section 21 of the New Zealand Bill of Rights Act 1990 protects against unreasonable search or seizure, including in relation to correspondence and electronic intrusions. In the public sector, privacy interacts closely with access-to- information regimes governed primarily by the Official Information Act 1982: requests for official information may be refused where withholding is necessary to protect personal privacy. Extraterritorial Reach The Privacy Act has material extraterritorial reach. It applies to an overseas agency carrying on business in
• Health Information Privacy Code 2020; • Credit Reporting Privacy Code 2020;
341 CHAMBERS.COM
Powered by FlippingBook