NEW ZEALAND Law and Practice Contributed by: Shelley Slade-Gully, Tina Liu, Phil Taylor and Veronica Hartley, Tompkins Wake
New Zealand: confidential and sensitive information remains legally protected even after unlawful access, and courts will act swiftly to grant broad injunctive relief to prevent disclosure or further use of stolen data, disrupting cyber-extortion attempts. Together, these decisions confirm that organisations and their clients retain their confidentiality and privacy rights despite a breach and that the courts provide a reliable mechanism for urgent protective relief. The recent decisions of the Human Rights Review Tribunal, on the other hand, demonstrate a pattern of organisations mishandling personal information in the following ways: • inadequate information management practices, as in Jones v Accident Compensation Corporation [2025] NZHRRT 25; • failure to respond to information privacy requests, as in Greensmith v Auckland Council [2025] NZHR - RT 24; and • disclosing personal information to unauthorised persons, as in Cummings v KAM Transport Ltd [2025] NZHRRT 8. In these cases, the Tribunal has awarded compen - satory damages generally between NZD3,500 and NZD30,000, reflective of the harm suffered by the individuals. 2.3 Collective Redress Mechanisms While privacy and data security issues are likely to form part of the landscape for collective redress, development of collective redress procedure in New Zealand has been in the hands of the courts, with no significant legislative initiatives. 3. Requirements for the Protection and Processing of Non-Personal Data 3.1 Objectives and Scope of Data Regulation New Zealand does not have a single overarching stat - utory framework for the protection and processing of non-personal data. Instead, New Zealand has taken the approach of regulating non-personal data on a sector-specific basis under the Customer and Product Data Act 2025 (CPDA). A key aspect of the CPDA is
the establishment of the Consumer Data Right (CDR) framework, which enables consumers to have greater control over the data they generate. Outside the CPDA, the protection and processing of non-personal data are generally governed by con - tracts and laws relating to the protection of intellectual property rights. How Does It Work? The CPDA is designation-based. Unless there is a designation regulation enacted under the CPDA for a particular sector, the CPDA would not apply. Currently, under the Customer and Product Data (Banking and Other Deposit-Taking) Regulations 2025 (the “Banking Regulations”), the banking sector is the only industry subject to CDR. The electricity industry is expected to be the next sector to be designated under the CPDA. The CPDA separates data into two categories: • “customer data” is data about an identifiable cus - tomer held by or on behalf of the data holder, and includes personal information; and • “product data” relates to the data holder’s product(s) and does not include customer data. Key actors within the scope of the CPDA include the following: • data holder – a person specified in a designation regulation who holds designated customer or prod - uct data. For example, the Banking Regulations will initially apply to New Zealand’s major banks (ANZ, ASB, BNZ and Westpac), making them the first data holders under the CPDA; • customer – a person who has acquired, acquires or seeks to acquire goods or services from a data holder; and • accredited requestor – a third party accredited under the CPDA, allowing them to receive desig - nated data. The CPDA allows customers or their authorised accredited requestor to request data from a data hold - er. Customers may then use this data for their own benefit, such as enabling third-party budgeting apps to access the customer’s banking transaction history.
347 CHAMBERS.COM
Powered by FlippingBook