NEW ZEALAND Law and Practice Contributed by: Shelley Slade-Gully, Tina Liu, Phil Taylor and Veronica Hartley, Tompkins Wake
In addition to the ASA Advertising Standards Code, discussed above, a separate code, the Children’s Advertising Code, applies to advertising targeted to children. Consent Requirements Consent to use personal information for personalised or targeted advertising is not required under the Pri - vacy Act, provided the information is collected for a lawful purpose and collection is necessary for that purpose, the individual has been informed of the col - lection and the purpose of collection, and certain other conditions are satisfied. Children may lack capacity to provide adequate con - sent for collection and use of their personal informa - tion, and consent from a parent or guardian will gen - erally be required. As discussed above, the UEMA requires consent to commercial electronic messages and is also applicable to targeted and personalised commercial electronic messages sent to children. Consent to commercial electronic messages may be express, inferred or deemed from circumstances. The person claiming that a recipient has consented to receiving a message has the onus of proving that consent was provided. There is no prescribed form for obtaining consent. Targeted online advertising that appears on social media platforms is not subject to the UEMA, unless it involves the sending of an electronic message to the viewer. 4.3 Employment Privacy Law In New Zealand, employment privacy is primarily gov - erned by the Privacy Act, alongside the Employment Relations Act 2000 (good faith obligations), the Human Rights Act 1993 (non-discrimination), and, where rel - evant, the Health and Safety at Work Act 2015. Employers may collect employee or applicant infor - mation only for a lawful and necessary purpose con - nected with their functions (IPP 1). Under IPP 3, indi - viduals must be informed of the following:
• consequences of non-provision; and • their rights of access and correction.
These principles apply equally to recruitment. Regard - ing prospective employees, background checks must be necessary, transparent and non-discriminatory. Employee monitoring is permitted but must be lawful, necessary, transparent and not unreasonably intru - sive. Employers should clearly inform staff of monitor - ing practices. Such practices must also comply with employment law good faith and procedural fairness requirements. For remote work, IT systems and BYOD, employers remain responsible for ensuring reasonable security safeguards of personal information, including secure access controls and protection against unauthorised disclosure. Where third-party or cloud providers are used, the employer remains accountable, and cross- border disclosures must comply with IPP 12. Serious employment-related data breaches trigger mandatory notification obligations and potential lia - bility, including damages for humiliation or injury to feelings. 4.4 Data Protection in M&A Mergers and acquisitions in New Zealand are likely to engage privacy obligations at every stage, as follows. Due Diligence During due diligence, the target is likely to disclose personal information about employees, customers and suppliers to the acquirer. IPP 11 (1)(i) provides a specific gateway, permitting disclosure where neces - sary to facilitate the sale or disposition of a business as a going concern. This exception operates without individual consent but applies only where the transac - tion genuinely involves disposing of a business as a going concern, not merely asset sales or partial dis - posals. Despite this statutory exception, organisations should implement robust controls: • limiting disclosure to information genuinely neces - sary;
• purpose of collection; • intended recipients;
352 CHAMBERS.COM
Powered by FlippingBook