NEW ZEALAND Law and Practice Contributed by: Shelley Slade-Gully, Tina Liu, Phil Taylor and Veronica Hartley, Tompkins Wake
those regulations may be recovered as a debt in any court of competent jurisdiction. Co-Ordination With the Privacy Commissioner The CPDA contains two express bridges to the Pri - vacy Act’s enforcement regime. Under Section 51 (3), if a data holder contravenes Section 14, 15 or 16 (2) – failing to provide designated customer data as required – that contravention is treated as an interfer - ence with the privacy of the individual customer for the purposes of Parts 5 and 6 of the Privacy Act, giving the Privacy Commissioner jurisdiction to receive and investigate complaints and the Human Rights Review Tribunal jurisdiction to award remedies. Under Section 52, if a data holder contravenes a CPD storage and security requirement in relation to personal informa - tion, it is treated as breaching IPP 5 of the Privacy Act, again engaging the Privacy Commissioner’s enforce - ment role. The Minister must also consult the Privacy Commissioner before recommending designation regulations under Section 106. These mechanisms mean that enforcement of the CPDA will, in practice, engage both the chief executive’s civil enforcement powers and the Privacy Commissioner’s jurisdiction in parallel. Given the recent enactment of the CPDA, no enforce - ment actions have yet been taken and no trends have emerged. As the Banking Regulations take effect and the first data requests are processed, enforcement patterns – and the practical interaction between the chief executive’s powers and the Privacy Commis - sioner’s jurisdiction – are expected to become clearer in the next 12 to 24 months.
The key applicable principles are as follows. IPP 1 requires that personal information be collected only for a lawful purpose connected to the agency’s functions, and only to the extent necessary; meaning speculative data harvesting or collection without a clear purpose is unlikely to be compliant. IPP 3 requires that, where personal information is collected from an individual, the agency takes reasonable steps to ensure the indi - vidual is aware of the fact of collection, the purpose, the intended recipients, and the identity of the col - lecting agency; this effectively requires websites and applications using tracking technologies to maintain an accurate and accessible privacy or cookie notice. IPP 4 requires collection by fair and lawful means without unreasonable intrusion on personal affairs, which applies directly to covert or opaque tracking. IPP 10 prohibits use of personal information collected for one purpose (such as analytics) for a materially dif - ferent purpose (such as targeted advertising or sale to data brokers) without a lawful basis, which, in prac - tice, generally requires individual consent. There is no “cookie consent” requirement equivalent to the General Data Protection Regulation or ePrivacy Directive framework. However, the Privacy Commis - sioner has indicated that organisations relying on tracking technologies for purposes beyond what indi - viduals would reasonably expect should review their compliance with IPPs 1, 3 and 10, and ensure their privacy notices are accurate and accessible. Where electronic messages are sent using data gathered through tracking, the Unsolicited Electronic Messages Act 2007 applies. The Fair Trading Act 1986 applies to the extent that tracking-based advertising involves misleading or deceptive conduct. 4.2 Personalised Advertising and Other Online Marketing Practices Personalised or targeted advertising is regulated in New Zealand primarily by the following: • Privacy Act 2020 and associated privacy codes; • Unsolicited Electronic Messages Act 2007 (UEMA); and • Fair Trading Act 1986 (FTA). Advertising codes of conduct may also apply. Certain content within personalised or targeted advertising
4. Sectoral Topics 4.1 Use of Cookies
New Zealand does not have specific legislation gov - erning cookies, software development kits or other online tracking technologies comparable to the EU’s ePrivacy Directive or the UK’s Privacy and Electronic Communications Regulations, and there is no statu - tory opt-in consent or opt-out model for tracking tech - nologies. However, the Privacy Act applies directly where tracking technologies collect or generate infor - mation about an identifiable individual.
350 CHAMBERS.COM
Powered by FlippingBook