New Zealand’s New Privacy Law 2020 is Now in Force

New Zealand has meaningfully updated its privacy law,  The Privacy Act 2020, which took force December 1. 

The new Privacy Act 2020 is a significant advancement of New Zealand’s privacy law, and encompasses numerous changes, including: 

  • Data Breach Reporting Obligations: There are new reporting obligations for data breaches. Companies are required to notify the Office of the Privacy Commissioner (OPC) directly of a breach. To manage data breach notifications, New Zealand launched a new tool, NotifyUs, which allows companies to determine whether or not they need to make a notification to the government, and then also facilitates an easy report directly to the government through the Data Protection Authority’s website. Older breaches can also be updated through the tool, which can be found here.
  • New Tools for Enforcing the Right of Access: The OPC has new authority to issue compliance notices to businesses, which will require the entity to disclose whether or not personal data about an individual is held. There are some exemptions in the law, but broadly, this will be an important enforcement and transparency mechanism.
  • Similar Safeguards Requirement: Principle 12 of the Privacy Act is newly added. This principle now requires a form of adequacy, or “similar safeguards” prior to sending information out of jurisdiction.
  • Extraterritorial Applicability: Another important update is a provision adding extraterritorial applicability of the law. Post-GDPR, this is not a surprising addition. Entities that are conducting business in New Zealand, even if just virtually / digitally from areas out of New Zealand, will be subject to the act.
  • New Criminal Provisions: The Privacy Act 2020 has also made certain actions a criminal offense, including:
    • Impersonating someone in order to gain unauthorized access to information;
    • Fines for businesses which destroy personal information knowing that a request has been made to access that information.

Here is a detailed OPC resource that outlines all of the changes to the law.