NEW ZEALAND Law and Practice Contributed by: Shelley Slade-Gully, Tina Liu, Phil Taylor and Veronica Hartley, Tompkins Wake
• restricting access through NDAs and data rooms; • anonymising data where feasible; and • delaying transfer of highly sensitive information until completion. Change of Control and Integration At completion, personal information transfers to the acquiring entity/agency. This is generally permissible as information continues to be used for purposes directly related to the original collection. However, agencies must update privacy notices to reflect the change in agency, align security measures across the combined entity, and review retention policies. Cross-Border Considerations Where an acquirer or merged entity is located off - shore, or information will be hosted overseas post- transaction, IPP 12 requires specific safeguards for cross-border disclosures, including obtaining indi - vidual authorisation, confirming comparable privacy protections or implementing contractual safeguards. Notification There is no general obligation to notify individuals or the Privacy Commissioner purely due to change of control, though good practice involves updating pri - vacy statements promptly.
In practical terms, before disclosing personal informa - tion overseas, the agency must take reasonable steps to confirm that the overseas recipient: • is carrying on business in New Zealand and there - fore subject to the Privacy Act; or • is subject to privacy laws that, overall, provide comparable safeguards to the New Zealand regime; or • is contractually required (for example, through appropriate data protection clauses) to protect the information in a way that provides comparable safeguards. If none of these safeguards apply, the information may only be disclosed if the individual expressly authorises the disclosure after being clearly informed that the overseas recipient may not be required to protect their information to the same standard as under the New Zealand Privacy Act. Onward Transfers Onward transfers of information, after the initial over- seas disclosure, are governed by the contractual arrangement between the NZ agency and the over - seas recipient relating to the initial data disclosure. While the Privacy Act does not prescribe any “model clauses” that must be included in a data transfer agreement, the New Zealand Privacy Commissioner provides a set of “off the shelf” clauses that can be voluntarily used to ensure that the data transfer agree - ment contains the necessary privacy safeguards com - parable with the Privacy Act. Exceptions The requirements relating to the overseas disclosure of personal information do not apply where the dis - closure by an agency is to a service provider and the information will be held by the service provider for storing or processing solely on behalf of that agency, and the service provider will not use the information for its own purposes. In such circumstance, the Privacy Act does not treat the disclosure of personal information to be an over - seas disclosure, and instead treats the information as being held by the agency (even where the information is actually stored outside New Zealand).
5. International Considerations 5.1 Restrictions on International Data Transfers Disclosure Outside New Zealand
IPP 12 of the Privacy Act governs “disclosure” of per - sonal information outside New Zealand. Disclosure is not defined in the Privacy Act but given its usual meaning will apply to an agency subject to the Act making the personal information available to a third party. This will include transfers of information unless an exception applies under the Act. Personal information may only be disclosed outside New Zealand where the disclosing agency has first ensured that appropriate safeguards apply.
353 CHAMBERS.COM
Powered by FlippingBook