NEW ZEALAND Law and Practice Contributed by: Shelley Slade-Gully, Tina Liu, Phil Taylor and Veronica Hartley, Tompkins Wake
These bands are indicative only, as the HRRT ulti - mately assesses seriousness based on the impact of the breach and any ongoing consequences. Decisions of the HRRT are binding and appealable to the High Court on questions of law. Criminal offences under the Privacy Act include: • failure to notify a notifiable breach; • non-compliance with a compliance notice; • obstruction; and • misleading the Commissioner. Fines are generally up to NZD10,000. Penalties con - sider seriousness, harm, respondent conduct, mitiga - tion, and general sentencing principles. Regarding other regulators: the Broadcasting Stand - ards Authority determines broadcast privacy com - plaints (usually after referral to the broadcaster) and may order apologies, statements, compensation, costs, or fines up to NZD5,000; appeals lie to the High Court. The Health and Disability Commissioner investigates sectoral complaints and may recommend remedies, require action, or refer matters to the Direc - tor of Proceedings for proceedings before the HRRT or Health Practitioners Disciplinary Tribunal. Under the Data and Statistics Act 2022, enforcement includes inspections, compliance notices, and criminal offenc - es for unlawful disclosure of statistical information. 1.9 Enforcement Trends The Privacy Commissioner has reported a significant increase in notifiable privacy breach notifications to its office, with over half of such notifications falling within the classification as involving serious harm. This rep - resents a 47% rise (from previous years) of this type of activity. Although privacy complaints have increased, this likely reflects both the growing impact of cybersecu - rity incidents and the greater public awareness of an individual’s privacy rights. Private sector notifications to the OPC have more than tripled, indicating that organisations are engaging more actively with their reporting obligations.
While the 2025/26 Annual Report is yet to be released, recent trends show that New Zealanders are increas - ingly informed about their privacy rights and organi - sations are responding with greater transparency. The key message for organisations is that expecta - tions around privacy are rising both from the Privacy Commissioner and New Zealanders, and, with cyber threats becoming more sophisticated, strong privacy practices and robust security measures are essential.
2. Privacy Litigation 2.1 Privacy Litigation Overview
Main trends in privacy and data-related disputes specifically before courts can be observed from the High Court decisions of Neighbourly Ltd v Unknown Defendants [2026] NZHC 1, Manage My Health Ltd v Unknown Defendants [2026] NZHC 2 and Lang- ley Twigg Partnership v Unknown Defendants [2026] NZHC 104. In each case, the affected organisations commenced proceedings to urgently contain the con - sequences of the breach. The key causes of action have been a breach of confidence and breach of pri - vacy, both of which support urgent equitable relief where confidential or sensitive information is at risk. In each case, the Court was asked to grant injunctions preventing access, use or disclosure of stolen infor - mation, reflecting a strong judicial focus on preventing further harm rather than making a determination on liability or compensation. These cases demonstrate that High Court cyber-attack litigation is primarily pre - ventative and protective, rather than compensatory. As a result, non-material damages are not awarded in this particular context, and the courts instead concen - trate on securing, controlling and ultimately removing compromised data from being circulated and dis - closed. 2.2 Recent Case Law As described in 2.1 Privacy Litigation Overview , the three 2026 High Court decisions of Neighbourly Ltd v Unknown Defendants [2026] NZHC 1, Manage My Health Ltd v Unknown Defendants [2026] NZHC 2, and Langley Twigg Partnership v Unknown Defend- ants [2026] NZHC 104 collectively establish a con - sistent judicial framework for cyber-attack litigation in
346 CHAMBERS.COM
Powered by FlippingBook