NEW ZEALAND Law and Practice Contributed by: Shelley Slade-Gully, Tina Liu, Phil Taylor and Veronica Hartley, Tompkins Wake
New Zealand, regardless of where the personal infor - mation was collected or held, or where the individual is located. Cross-border data flows are addressed through IPP 12 (see 5. International Considerations ). Interplay With Other Laws Where data is truly anonymised, it generally falls outside the Privacy Act, though re-identification risk must be carefully managed. Privacy also intersects with cybercrime offences and online harm legislation. Under Part 9A of the Crimes Act 1961, it is a criminal offence to intercept a private communication or to dis - close a communication known to have been unlaw - fully intercepted. The Crimes Act 1961 also creates offences relating to intimate visual recordings made or distributed without consent. Computer-crime offences (including unauthorised access and dishonest use of a computer system) intersect with privacy wherever personal data is involved. New offences targeting soft - ware designed for unauthorised access were inserted by the Budapest Convention and Related Matters Legislation Amendment Act 2025 with effect from 31 July 2025. The Harmful Digital Communications Act 2015 provides civil and criminal remedies for harmful online communications and intersects directly with privacy through communication principles prohibit - ing disclosure of sensitive personal facts or commu - nications made in breach of confidence. New Zealand organisations operating internationally may also need to consider foreign privacy laws with extraterritorial effect (notably the EU GDPR), although New Zealand Under the Privacy Act, organisations must process personal information in accordance with the IPPs. In practical terms, the IPPs require: • collecting only what is needed for a lawful purpose; • collecting fairly and generally from the individual; • providing clear notice at collection; • maintaining appropriate storage and security safe - guards; • ensuring accuracy before use or disclosure; • not retaining information longer than necessary; • limiting use and disclosure to the purpose of col - lection (subject to exceptions); maintains EU “adequacy” status. 1.2 Rights and Obligations Information Privacy Principles
• giving individuals access to and the ability to cor - rect their information; and • applying special controls for unique identifiers and cross-border disclosures. Data Subject Rights Individuals have rights to access and request correc - tion of their personal information, and to complain to the Privacy Commissioner regarding an “interfer - ence with privacy”. The mandatory breach notification regime requires agencies to notify the Privacy Com - missioner and affected individuals where a breach has caused, or is likely to cause, serious harm (see 1.6 Data Breach Requirement ). Main Compliance Requirements Organisations must: • appoint a privacy officer and maintain a privacy management framework; • map what personal information they hold, where it sits, and why it is needed; • use compliant collection notices specifying pur - pose, recipients, consequences of non-provision, and access/correction processes; • implement proportionate security safeguards (access control, encryption, logging) and put pri - vacy obligations into vendor agreements; • validate that secondary uses and disclosures are authorised, particularly for marketing; • implement processes for access and correction requests (identity verification, timeframes, exemp - tions); and • maintain and test a breach response plan covering serious harm assessment, containment, communi - cations and regulator notification. 1.3 Special Categories of Personal Data New Zealand privacy law does not use the GDPR- style concept of “special category data” with a sin - gle heightened processing test. Instead, protection is delivered through the broad definition of personal information, the core IPPs, and sector-specific codes that impose additional controls for inherently sensi - tive information. The Privacy Commissioner has also issued guidance emphasising that agencies handling sensitive data (broadly, information of real significance to the individual, which is revealing of them or they
342 CHAMBERS.COM
Powered by FlippingBook