NEW ZEALAND Law and Practice Contributed by: Shelley Slade-Gully, Tina Liu, Phil Taylor and Veronica Hartley, Tompkins Wake
1.7 Regulators Office of the Privacy Commissioner (OPC) The OPC is an Independent Crown Entity that regu - lates the Privacy Act. It supervises compliance with the information privacy principles (IPPs), receives mandatory breach notifications, and may issue bind - ing codes of practice, access directions and compli - ance notices. Complaints are typically raised by indi - viduals after first raising concerns with the relevant organisation, or via notifiable breach reports. The OPC emphasises early resolution but may formally inves - tigate and issue compliance notices where required. Codes of practice and statutory notices are binding; general guidance is influential but not legally bind - ing. See 1.8 Enforcement Proceedings and Fines for investigation procedure, sanctions and appeal rights. Human Rights Review Tribunal (HRRT) The HRRT adjudicates privacy claims, generally after the OPC process, and reviews certain OPC and Health and Disability Commissioner decisions. It may make declarations, restraining orders, performance orders and damages awards. See 1.8 Enforcement Proceed- ings and Fines for remedies and penalty bands. Director of Human Rights Proceedings The Director of Human Rights Proceedings receives referrals from the OPC where complaints remain unre - solved and decides whether to commence proceed - ings in the HRRT, providing publicly funded represen - tation in appropriate cases. Health and Disability Commissioner (HDC) The HDC investigates complaints under the Code of Rights, including confidentiality and health information issues. Matters may be resolved informally or formally investigated; decisions may be reviewed by the HRRT. Broadcasting Standards Authority (BSA) The BSA determines broadcast privacy complaints, usually after referral to the relevant broadcaster. It may issue binding determinations, orders and costs awards; appeals lie to the High Court. Statistics NZ/Government Chief Data Steward This regulator oversees statistical confidentiality and mandated data standards, which are binding across government. The Data and Statistics Act 2022
includes inspection, compliance notice and criminal offence provisions. Domestic and Cross-Border Co-Ordination New Zealand Cabinet Manual guidance requires pub - lic sector agencies to consult the OPC on proposals with significant privacy implications. Cross-border, the Privacy Act’s complaints framework allows refer - ral of a complaint to an overseas privacy enforcement authority – defined as an overseas body responsible for enforcing personal information protection legisla - tion with investigation and enforcement powers. The Act also contains specific rules governing overseas disclosures under IPP 12 (see 5. International Con- siderations ). 1.8 Enforcement Proceedings and Fines An investigation into a privacy breach is initiated when an individual or organisation lodges a complaint with the OPC. The OPC determines whether an investiga - tion is required. If one proceeds, the OPC’s primary focus is resolving the matter through settlement or conciliation, a dispute resolution process similar to mediation. The Privacy Commissioner may also act on their own initiative or following a mandatory breach notification. Outcomes include binding access direc - tions and compliance notices, which specify breaches, required steps and timeframes. Compliance notices and access directions are reviewable by the Human Rights Review Tribunal (HRRT). Unresolved matters may also be referred to the Director of Human Rights Proceedings for litigation in the HRRT. The Tribunal may grant the following: • declarations; • restraining orders; • performance orders; and • damages for pecuniary loss and humiliation. Damages awarded can range from NZD3,000 to NZD120,000 and typically fall into three indicative bands: • up to NZD10,000 for less serious breaches; • NZD10,000–NZD50,000 for more serious cases; and • over NZD50,000 for the most serious cases.
345 CHAMBERS.COM
Powered by FlippingBook