Law: Privacy Act 2020 (the Act)

Regulator: The Office of the Privacy Commissioner of New Zealand (OPC)

Summary: On December 1, 2020, the Privacy Act 2020 (the Act) came into force. The Act repeals and replaces the Privacy Act 1993 and contains 13 Information Privacy Principles (IPP) that govern the use of personal information in New Zealand. The Act requires agencies to appoint at least one privacy officer, report data breaches that cause, or are likely to cause, serious harm, and provides data subjects with both the right to access and the right to request correction of their personal information. In addition, the new IPP 12 provides that an organization or business may only disclose personal information to an agency outside of New Zealand if the receiving agency is subject to similar safeguards to those in the Act. The Act introduces new criminal penalties, punishable with fines of up to NZD 10,000 (approx. €5,870) and allows the OPC to issue compliance notices and enforceable access directions. Furthermore, on September 5, 2023, Bill 292-1 the Privacy Amendment Bill was introduced to the New Zealand Parliament to amend the Act, but if passed the amendments will not enter into force until June 1, 2025. Key amendments proposed include the addition of the obligation to inform individuals of the collection of their personal information from a source other than from the individual to whom the information relates. Notably, New Zealand was the first APAC jurisdiction to be recognised as providing an adequate level of personal data protection by the European Commission.