NEW ZEALAND Law and Practice Contributed by: Shelley Slade-Gully, Tina Liu, Phil Taylor and Veronica Hartley, Tompkins Wake
5.4 Blocking Statutes Blocking Statutes
discovery requests where personal information is involved. Māori Data Sovereignty Where Māori data is involved, organisations should give practical consideration to Māori Data Sovereignty principles (Te Mana Raraunga) and may face ethical obligations to consult iwi or hapū before releasing information offshore, even where IPP 12 would other - wise permit the transfer. 5.5 Recent Developments New Zealand’s Adequacy Status Reaffirmed In 2024, the European Commission reaffirmed New Zealand’s adequacy status, confirming that New Zea - land’s level of personal data protection is comparable to Europe’s standards. This is significant because it allows the transfer of personal data about EU resi - dents, to New Zealand, without additional safeguards under EU law. The reaffirmation of New Zealand’s status signals to the world continued confidence that New Zealand’s privacy framework supports cross- border trade in an increasingly data-driven world. As part of the process for New Zealand to retain its adequacy status, the New Zealand government intro - duced, in the recent Privacy Amendment Act 2025, a new principle (IPP 3A) to the Privacy Act. IPP 3A con - cerns the indirect collection of personal information. It requires that if an agency collects personal informa - tion indirectly (eg, a lender obtains credit history infor - mation from a credit reporting agency or an employer obtains references about an applicant from a former employer), the agency must inform the individual con - cerned, unless an exception applies. Previously, there was no notification requirement for the indirect collection of personal information. This gap in New Zealand’s privacy framework was high - lighted during the EU’s assessment of New Zealand’s
New Zealand has not enacted a broad or compre - hensive blocking statute equivalent to those operat - ing in other jurisdictions, such as Council Regulation (EC) No 2271/96 (the “EU Blocking Statute”), which expressly prohibits EU persons from complying with specified extraterritorial US sanctions, or China’s Data Security Law and Personal Information Protec - tion Law, which prohibit provision of data to foreign judicial or law enforcement authorities without prior state approval. Instead, New Zealand’s framework addresses cross-border issues through controls on the transfer of personal information and domestic implementation of international sanctions obligations. Gathering Evidence for Foreign Proceedings For foreign civil proceedings, Sections 184–185 of the Evidence Act 2006 provide a mechanism by which the High Court may order the examination of witnesses, production of specified documents, inspection of property, or other evidence-gathering steps if request - ed by a foreign court. For foreign criminal matters, the Mutual Assistance in Criminal Matters Act 1992 (MACMA) enables foreign governments to request evidence-gathering assistance from New Zealand via the Attorney-General, subject to mandatory and dis - cretionary grounds for refusal. Both regimes preserve standard New Zealand witness privileges and compel - lability rules, and the MACMA expressly preserves the operation of the Evidence Act 2006. Sanctions Compliance The United Nations Act 1946 empowers the Gover - nor-General, by Order in Council, to give effect to UN Security Council measures; sanctions apply in New Zealand only once implementing regulations are made. New Zealand does not restrict entities from voluntarily complying with foreign sanctions regimes, provided such compliance does not contravene domestic law. Cross-Border Disclosures and Privacy The Privacy Act operates as New Zealand’s primary constraint on offshore disclosure of personal informa - tion through IPP 12 (see 5.1 Restrictions on Inter- national Data Transfers ). Even without a blocking statute, privacy law can limit compliance with foreign
“adequacy status”. Overseas Transfer
Principle 12 of the Privacy Act regulates the disclosure of personal information to organisations or people outside New Zealand. Among the different pathways in IPP 12 to permit the disclosure of data overseas,
355 CHAMBERS.COM
Powered by FlippingBook