NEW ZEALAND Law and Practice Contributed by: Shelley Slade-Gully, Tina Liu, Phil Taylor and Veronica Hartley, Tompkins Wake
vacy Act applies fully to AI-driven processing, mean - ing organisations must comply with the information privacy principles regardless of whether decisions are made by humans or automated systems. Core obliga - tions include: • collecting data for a lawful and necessary purpose; • ensuring accuracy; • maintaining security safeguards; and • being transparent about how personal data is used. Guidance on Automated Decision-Making While there are no binding AI-specific rules, the Office of the Privacy Commissioner has issued guidance on the use of algorithms and automated decision-making. This guidance focuses on fairness, explainability and accountability. Organisations are expected to under - stand how AI systems reach decisions, assess risks of bias or error, and ensure individuals can meaningfully challenge or seek review of automated outcomes. Risk-Based Regulation and International Influence New Zealand does not operate a formal risk-based AI regime. However, international developments – par - ticularly the EU AI Act – are influencing best practice. Overseas models classify AI systems by risk, pro - hibit certain uses such as social scoring, and impose heightened obligations on high-risk systems, includ - ing strong data governance, transparency and human oversight. Impact on Data Protection AI regulation reinforces, rather than replaces, data protection principles. Transparency, responsible data governance and human oversight are increasingly central expectations, especially where AI systems materially affect individuals’ rights or interests. 1.6 Data Breach Requirement Under the Privacy Act, a privacy breach includes unauthorised or accidental access, disclosure, altera - tion, loss, or destruction of personal information, or any action preventing access to it. A “notifiable” privacy breach means a privacy breach that it is reasonable to believe has caused serious harm to an affected individual or individuals or is likely
to do so. The assessment is an objective one, deter - mined from the viewpoint of a reasonable person in the organisation’s position who is properly informed based on the information available. Organisations must notify the Privacy Commissioner and individuals affected by the breach, if the breach is likely to cause serious harm. Organisations should immediately contain (where possible) and mitigate breaches, secure systems and document decisions. A serious harm assessment must be undertaken promptly. In assessing serious harm, organisations must con - sider factors such as: • the nature and sensitivity of the personal informa - tion; • security measures; • the nature of the potential harm (ranging from physical to financial harm); • the nature and number of recipients; • mitigation steps taken to reduce the risk of harm following the breach; and • other relevant matters. Notification must occur as soon as practicable after becoming aware a breach has occurred. Notification must cover the prescribed list of details specified in
the Act. This includes: • details of the breach; • mitigation steps; and • contact information.
Failure to notify the Privacy Commissioner of a notifiable breach is an offence with a fine of up to NZD10,000. The Privacy Commissioner has investigative and enforcement powers, including issuing compliance notices. Individuals may bring claims before the Human Rights Review Tribunal, which can award damages. Large breaches may lead to representative actions but are uncommon to date.
344 CHAMBERS.COM
Powered by FlippingBook