NEW ZEALAND Law and Practice Contributed by: Shelley Slade-Gully, Tina Liu, Phil Taylor and Veronica Hartley, Tompkins Wake
would generally wish to keep private) must take extra care and are held to a higher standard of account - ability. Health Information Health data is regulated by the Health Information Pri - vacy Code 2020, which replaces the IPPs for health agencies and sets more tailored rules for collection, use, disclosure, access and security in clinical and related contexts. This extends beyond traditional healthcare providers to various health-sector bodies and certain entities connected with health services. Credit, Telecommunications and Biometric Information Credit information handled by credit reporters is reg - ulated by the Credit Reporting Privacy Code 2020. Telecommunications agencies are subject to the Tel - ecommunications Information Privacy Code 2020, reflecting the sensitivity of communications-related information. The Biometric Processing Privacy Code 2025 regulates organisations using biometrics in auto - mated systems (eg, facial recognition) and phases in compliance for existing uses. Minors There is no single “age of consent” threshold in the Privacy Act. However, organisations should treat chil - dren’s information as higher risk and ensure collec - tion methods and notices are fair and appropriate. The Health Information Privacy Code expressly highlights fairness considerations where information is collected from children or young persons. Criminal Convictions Information about criminal convictions is personal information and subject to the Privacy Act. Addition - ally, the Criminal Records (Clean Slate) Act 2004 can restrict when conviction history must be disclosed by providing for automatic concealment where eligibility criteria are met (with important exceptions). 1.4 Processing of Personal Data for Research and Development Purposes Whether patient data may be anonymised for product development or scientific research turns on a thresh - old question: is the data still “personal information” (ie, about an identifiable individual)? If data is truly
anonymised, it generally falls outside the Privacy Act and Health Information Privacy Code. However, this requires robust controls, as “anonymisation” can fail where datasets can be linked or re-identified. Legal Gateways for Research Where information remains identifiable (including pseudonymised data), the relevant privacy rules con - tinue to apply. For companies supplying products or services used by healthcare providers, the key legal gateway is usually the health agency’s authority to dis - close information to the supplier and the contractual terms governing that disclosure. Under the Health Information Privacy Code 2020, health agencies must generally have patient authori - sation or rely on a permitted exception. The Code contains a specific pathway allowing disclosure where it is not desirable or practicable to obtain authorisation and the information is to be used: • in a form in which the individual is not identified; • for statistical purposes, not published in an identi - fying form; or • for research purposes (with ethics committee approval if required), not published in an identifying form. The Privacy Act IPPs also contain a research and statistics allowance for disclosure where information will not be published in an identifying form, though cross-border disclosures must still satisfy IPP 12 (see 5. International Considerations ). European Health Data Space The EU Health Data Space Regulation does not apply as New Zealand statute but may affect New Zealand life sciences and digital health companies operating in the EU, supplying health software into EU markets, or seeking to access EU health datasets for research and development. 1.5 Processing of Personal Data in the
Context of Artificial Intelligence Privacy Requirements for AI Systems
In New Zealand, the use of personal data in artificial intelligence systems is regulated through existing pri - vacy law rather than AI-specific legislation. The Pri -
343 CHAMBERS.COM
Powered by FlippingBook