NEW ZEALAND Law and Practice Contributed by: Shelley Slade-Gully, Tina Liu, Phil Taylor and Veronica Hartley, Tompkins Wake
the individual customer for the purposes of Parts 5 and 6 of the Privacy Act (Section 51 (3)), engaging the Privacy Commissioner’s complaint and enforcement jurisdiction. Action Items for Organisations Organisations designated as data holders (currently ANZ, ASB, BNZ and Westpac under the Banking Reg - ulations, with the electricity sector expected to follow) should review their obligations under the applicable designation regulations made under Section 104 of the CPDA. The designation framework under Sections 104–107 is sector-expandable: any organisation spec - ified in a future designation regulation will immediately become a data holder. Organisations in sectors likely to be designated should monitor the MBIE’s consulta - tion process under Section 106 (which requires con - sultation with substantially affected persons and the Privacy Commissioner before designation regulations are made) and begin assessing their readiness. All current and prospective data holders should: • establish the electronic system required by Section 27 to receive and respond to data requests; • ensure that system complies with the technical and performance requirements under Section 28; • implement identity verification processes required by Section 45; • maintain records under Section 46; and • audit existing data-sharing practices against both CPDA obligations and the IPPs under the Privacy Act. Organisations seeking accreditation as accredited requestors should assess their eligibility, the appli - cable accreditation class, and their obligations under the Privacy Act in respect of any personal information they receive. 3.4 Regulators and Enforcement Authorities and Enforcement Mechanisms for the Protection and Processing of Non-Personal Data The CPDA focuses on “product data”, defined in Section 9 as data about or relating to one or more of the data holder’s products, but excluding “customer data”. Enforcement primarily concerns the conduct of the “data holder” (defined in Section 6). Section 27
requires a data holder to operate an electronic sys - tem capable of receiving requests for regulated data services and providing those services in response. Section 28 prescribes the applicable technical and performance standards that the system must meet. Non-compliance with Section 28 standards is a civil liability matter under subpart 5 of Part 4 of the CPDA, not a criminal offence. The chief executive may apply to the High Court for a pecuniary penalty order where a data holder has contravened a civil liability provision; maximum Tier 2 penalties are NZD500,000 for an indi - vidual or NZD2.5 million in any other case. A separate criminal offence arises under Section 30 only where a data holder fails to comply with a written notice from the chief executive requiring it to test its electronic system under Section 29 (or gives a false or mislead - ing test report), carrying fines of up to NZD100,000 for an individual or NZD300,000 in any other case. Additional enforcement mechanisms are set out in Part 4. Section 53 empowers the chief executive (being the chief executive of the MBIE) to require any person, by written notice, to supply information or produce documents. The exercise of that power is subject to Section 56, which requires destruction of information obtained through any exercise of Section 53 powers that is subsequently declared unlawful by a court. Failure to comply with a Section 53 notice, or supplying false or misleading information in purported compliance, is a criminal offence under Section 57, carrying fines of up to NZD100,000 for an individual or NZD300,000 in any other case. Under Section 44, it is a criminal offence for a person to knowingly request a regulated data service that relates to a customer when not permitted to do so; an individual is liable to imprisonment for up to five years or a fine of up to NZD1 million (or both), and a body corporate to a fine of up to NZD5 million. Subpart 2 of Part 4 addresses remedial obligations. Section 58 requires a data holder or accredited requestor to take the steps prescribed by the regula - tions to avoid, mitigate or remedy loss or damage suf - fered by a customer or another data holder or accred - ited requestor as a result of a contravention. Section 59 provides that an amount required to be paid under
349 CHAMBERS.COM
Powered by FlippingBook