Get prepared for the Privacy Act 2020 with P20BOT

You or your agency will be subject to the 2020 Act in relation to actions taken in respect of personal information that you or your agency collects or holds. It does not matter where the personal information is, or was, collected by your agency; where the personal information is held by your agency; or where the individuals concerned are or were located. If you're an individual ordinarily resident in New Zealand, the Act applies regardless of whether you are or were in New Zealand when taking such actions.

Your agency will be subject to the 2020 Act in relation to any action it takes in the course of carrying on business in New Zealand in respect of personal information it collects or holds. It does not matter where the personal information is, or was, collected by your agency; where the personal information is held by your agency; or where the individuals concerned are or were located.

In addition, the Act states that an agency may be treated as carrying on business in New Zealand without necessarily:

• being a commercial operation, or
• having a place of business in New Zealand, or
• receiving any monetary payment for the supply of goods or services, or
• intending to make a profit from its business in New Zealand.

The 2020 Act is intended to have broad application to, for example, international digital platforms that carry on business in New Zealand. The Office of the Privacy Commissioner has said:

"If an international digital platform is carrying on business in New Zealand, with ... New Zealanders’ personal information, there will be no question that they will be obliged to comply with New Zealand law regardless of where they, or their servers are based."

There may be practical enforcement-related questions here, just as there are with the extra-territorial reach of the EU's GDPR, but the 2020 Act embodies what international law calls "prescriptive jurisdiction" over the conduct of overseas agencies where that conduct affects the privacy of individuals in New Zealand. (For a helpful summary of the differences between "prescriptive jurisdiction" and "enforcement jurisdiction", see IAPP's "Privacy across borders: Enforcement and prescriptive jurisdiction".)

You are subject to the Act in relation to any action you take in respect of:

• personal information you collect while present in New Zealand, regardless of where you may subsequently hold the information and regardless of where the individuals to whom the information relates are or were located; and
• personal information you hold while present in New Zealand that you didn't collect while in New Zealand), regardless of where the individuals to whom the information relates are or were located.

The Privacy Act 2020 will not apply to you or your agency. As such, we won't waste your time by showing you our other questions. 🙂    If you're keen to see them despite not being subject to the Act, you can just select one of the other options above.

The Privacy Act 2020 will affect your agency - Overview of main changes it will make to our privacy law

The Privacy Act 2020 comes into force in December 2020. Every agency that is subject to the Act and that handles personal information needs to know about the significant changes it will make to the law. It affects all of us.

Among other things, the new Act:

• changes some of the information privacy principles (IPPs) and adds a new IPP
• introduces a requirement to notify the Privacy Commissioner and affected individuals when a notifiable privacy breach occurs
• introduces a new compliance notice regime, and
• makes some changes to provisions relating to individuals' right to access the personal information an agency holds about them.

We describe each of these points in more detail below.

Changes to IPPs

Some of the IPPs have been changed, beyond modernising their language.

IPP1

There is a new IPP1(2) which states:

“If the lawful purpose for which personal information about an individual is collected does not require the collection of an individual’s identifying information, the agency may not require the individual’s identifying information.”

One might argue that, strictly speaking, this doesn’t add anything of substance to the existing IPP1 but it is a helpful point of emphasis and it drives home the importance of agencies minimising the amount of identifying information they collect.

IPP2

Under IPP2, if an agency collects personal information, the information must be collected from the individual concerned, unless an exception applies. This is the same as under the 1993 Act but there is a new exception: “to prevent or lessen a serious threat to the life or health of the individual concerned or any other individual” (IPP2(2)(e)(v)).

This change flows from a Law Commission recommendation in its comprehensive review of the Privacy Act. The Law Commission said this:

“It is likely that there will be situations in which health or safety considerations mean that it is not possible to collect information from the individual concerned. An employer dealing with a workplace accident might, for example, need to get information about an injured worker from a family member; or a social worker might need to collect information from a third party in a case where a child appears to be at risk of harm. We acknowledge OPC’s point that existing exceptions can probably cover such situations, but we still think that agencies will find it helpful to have a specific exception (just as there is already a specific exception covering maintenance of the law).”

IPP3

In the 1993 Act, IPP3 says an agency collecting personal information from an individual “shall take such steps (if any) as are, in the circumstances, reasonable to ensure that the individual is aware of the matters listed in IPP3(1). In the 2020 Act, the words “if any” have been dropped. Whether the dropping of the words “if any” will have much of an impact in practice remains to be seen bit there is no longer a suggestion that, in some cases, it may be reasonable to take no steps to inform people of the matters in IPP3(1). A subtle point, perhaps.

IPP4

IPP4 now expressly draws agencies' attention, when considering the manner of collecting personal information, to the position of children or young persons. IPP4(b) states:

“An agency may collection personal information only… (b) by a means that, in the circumstances of the case (particularly in circumstances where personal information is being collected from children or young persons), is fair…”.

This is perhaps a little weaker than IPP4(2) in an earlier version of the Bill: "When collecting personal information from children and young persons, an agency must take into account their vulnerability". IPP4(2) has been deleted in favour of the wording above.

IPP8

In the 1993 Act, IPP8 says that the accuracy (etc) of personal information is to be checked before use. The 2020 Act’s IPP8 expressly refers to disclosure as well:

“An agency that holds personal information must not use or disclose that information without taking any steps that are, in the circumstances, reasonable to ensure that the information is accurate, up to date, complete, relevant, and not misleading.”

IPP12

There's a new IPP12 on disclosure of personal information outside New Zealand. We discuss this new IPP further below if you answer 'Yes' to the question about disclosing personal information outside New Zealand.

IPP13 (old IPP12)

The 2020 Act’s IPP13 (previously IPP12) on unique identifiers adds a new circumstance in which an agency can assign a unique identifier to an individual that has already been assigned to the individual by another agency. That situation is where the agency will use the unique identifier for statistical or research purposes and no other purpose.

IPP13 also provides helpful clarification that an agency (A) does not assign a unique identifier to an individual by simply recording a unique identifier assigned to the individual by another agency (B) for the sole purpose of communicating with B about the individual.

The new IPP13 also requires agencies to take any steps that are, in the circumstances, reasonable to ensure that the risk of misuse of a unique identifier by any person is minimised (for example, by showing truncated account numbers on receipts or in correspondence).

Notifiable privacy breaches

Under the Privacy Act 2020, an agency must notify the Privacy Commissioner as soon as practicable after becoming aware that a notifiable privacy breach has occurred (section 114). A "notifiable privacy breach" is a privacy breach that it is reasonable to believe has caused serious harm to an affected individual or individuals or is likely to do so (section 112(1)).

"Serious harm" is not defined. However, when an agency is assessing whether a privacy breach is likely to cause serious harm in order to decide whether the breach is a notifiable privacy breach, the agency must consider:

• any action taken by the agency to reduce the risk of harm following the breach
• whether the personal information is sensitive
• the nature of the harm that may be caused to affected individuals
• the person or body that has obtained or may obtain personal information as a result of the breach (if known)
• whether the personal information is protected by a security measure, and
• any other relevant matters (section 113).

An agency must notify affected individuals as soon as practicable after becoming aware that a notifiable privacy breach has occurred, unless:

• section 113(2) applies (which requires a public notice of the breach where it's not reasonably practicable to notify an affected individual or each member of a group of affected individuals, unless an exception in section 116 applies or a delay is permitted under section 116(4)), or
• an exception in section 116 applies or a delay is permitted under section 116(4).

Section 116 contains a number of important exceptions that agencies will need to be familiar with.

Section 117 specifies content requirements for notifications to the Privacy Commissioner and to affected individuals.

Under section 118, an agency that fails (without reasonable excuse) to notify the Commissioner of a notifiable privacy breach commits an offence and is liable on conviction to a fine not exceeding $10,000. In addition, under section 122, the Privacy Commissioner may publish the identity of an agency that has notified the Commissioner of a notifiable privacy breach if the agency consents to publication or the Commissioner is satisfied it's in the public interest to do so.

Compliance notices

Under the new compliance notice regime, the Privacy Commissioner may issue a compliance notice if the Commissioner believes that 1 or more of the following have occurred:

• a breach of the Act, including a breach of an IPP, breach of an approved information sharing agreement or information matching agreement, or not notifying individuals of a privacy breach when required to do so
• an action that is to be treated as a breach of an IPP or an interference with the privacy of an individual under another Act
• a breach of a code of practice issued under the Privacy Act or a code of conduct (or similar) issued under another Act (if a complaint about a breach of the code can be the subject of a complaint under Part 5 of the Privacy Act) (section 123(1)).

If the Privacy Commissioner issues a compliance notice, the notice must describe the breach and require the agency to remedy the breach (section 125(1)). A compliance notice can also:

• identify particular steps that the Commissioner considers need to be taken to remedy the breach
• include conditions that the Commissioner considers are appropriate
• state the date or dates by which the agency must remedy the breach and report to the Commissioner on the steps taken to do so, and
• include other information that the Commissioner considers would be useful (section 125(2)).

Before issuing a compliance notice, the Commissioner may, but is not required to:

• assess whether any person has suffered harm, or
• use other means under the Act or another Act for dealing with the breach (section 123(2)).

Note, here, that compliance notices may be issued in the absence of harm.

Compliance notices could cover the likes of, for example:

• agencies failing to comply with their transparency obligations under IPP3
• agencies collecting personal information in a misleading manner, contrary to IPP4, or
• agencies failing to secure personal information provided to them as required by IPP5.

Changes to provisions relating to individuals' right to access personal information

The 'access to information' provisions have been restructured and, in a handful of significant respects, amended. In particular:

• the 'prejudice to the maintenance of the law' ground for refusing access now refers to prejudice to the maintenance of the law "by any public sector agency" (section 53(c))
• the 1993 Act contains a ground for refusing access where disclosure would "endanger the safety of any individual"; this has been expanded to disclosures that "would be likely to pose a serious threat to the life, health, or safety of any individual, or to public health or public safety" (section 49(1)(a)(i))
• there is a new ground for refusing access where disclosure would “create a significant likelihood of serious harassment of an individual” (section 49(1)(a)(ii)), and
• there is another new ground for refusing access where disclosure would “include disclosure of information about another person who: (a) is the victim of an offence or alleged offence; and (b) would be caused significant distress, loss of dignity, or injury to feelings by the disclosure of the information” (section 49(1)(a)(iii)).

In addition, the responsibilities of agencies before giving access to personal information now state that an agency "must not give access to the information if the agency has reasonable grounds to believe that the request is made under the threat of physical or mental harm" (section 57(b)).

It is also important to note that:

• under the Privacy Act 2020, the Privacy Commissioner has a new power to require an agency to give individuals access to their personal information. Under section 92, the Commissioner may direct an agency to provide an individual access to the individual’s personal information in any manner that the Commissioner considers appropriate, and
• there is a new offence provision in the Act under which an agency commits an offence and is liable on conviction to a fine of up to $10,000 if the agency destroys any document containing personal information when it knows a person has made a request for the information.

Under the Privacy Act 1993, some organisations might have taken this stance, on the basis that the threshold for Privacy Commissioner investigation would not have been met and that no one would complain. Under the Privacy Act 2020, however, the fact that the Privacy Commissioner can issue a compliance notice in the absence of harm may cause organisations to rethink this approach.

Nothing to see here then 🙂

In all likelihood, you'll need to update that guidance or those policies, to ensure each document:

• refers to the Privacy Act 2020 instead of the Privacy Act 1993
• refers accurately to the new set of information privacy principles (while most of the principles are substantially the same, there are changes to IPP1, IPP2, IPP3, IPP4, IPP8 and IPP13 (the old IPP12), and there's a new IPP12 on disclosure of personal information outside New Zealand)
• contains accurate cross-references to sections in the Privacy Act 2020, as section numbers have changed (e.g., the IPPs, once in section 6, are now in section 22)
• deals with content relating to individuals’ access to their personal information accurately, because, as noted in our summary of changes above, the 'access to information' provisions have been restructured and amended, and
• covers off the completely new features of the Act, particularly privacy breach notification requirements and the implications of compliance notices.

In addition:

• the public register privacy principles have been removed, which is relevant for agencies responsible for maintaining public registers if their guidance or policies refer to those principles, and
• existing information matching agreements have been 'grandfathered', with all new information sharing agreements regulated by the Privacy Act needing to take the form of approved information sharing agreements (along the lines of the existing Part 9A of the Privacy Act 1993); as such, any content relating to putting information matching agreements in place will need to be removed.

No need to update any guidance or policies then 🙂   That said, if you do handle personal information, you may find it desirable to have guidance in place to deal with the more important kinds of issues that can arise, particularly privacy breach notification.

You may need to update your privacy statements. For example:

• references to the Privacy Act 1993 (if any) should be updated to the Privacy Act 2020
• if a privacy statement refers to particular sections of the Privacy Act 1993, those section references will need updating
• sometimes agencies that maintain public registers refer, in their privacy statements, to the public register privacy principles. With the Privacy Act 2020 having abandoned those public register privacy principles, ongoing reference to them in privacy statements would, from December 2020, be out of place
• if you're an overseas agency that is subject to New Zealand's Privacy Act for the first time, you may need to check that your privacy statements comply with the Act's IPP3 which specifies what you need to tell people when collecting personal information from them.

If you are subject to the Privacy Act 2020 and collect personal information from individuals, you'll need to ensure you comply with the transparency requirements of information privacy principle 3 when collecting information from them. This is often done through privacy statements. You may wish to reflect on whether you need one. If you do, you can build one with StopLookGo Privacy.

Now is the time to check whether your contracts contain clauses that, among other things:

• deal with the protection of personal information (use and disclosure only in accordance with your instructions, no other use or disclosure, safe storage, etc), and
• contain an obligation on service providers to notify you promptly if there is a privacy breach and to cooperate with any investigation or regulatory notifications that may be required (these clauses can deal with additional matters such as assembly of relevant personnel, communications with the Privacy Commissioner and the media, who is to deal with questions from concerned individuals, and the like).

Note, in particular, that where you use an outsourced service provider to store or process personal information on your behalf, your agency is still deemed to be the party that "holds" the personal information for Privacy Act purposes. If there is a privacy breach, it is your agency's responsibility to deal with it and, where required, to notify the Privacy Commissioner and affected individuals. It is important that your contracts with such service providers give you the rights and powers you need to comply with your obligations under the Act.

Nothing to see here then 🙂

Why this is important

The Privacy Act 2020 contains a new IPP12 that regulates the disclosure of personal information outside New Zealand. Agencies and organisations that disclose personal information outside of New Zealand will now need to check their offshoring practices and processes against this new IPP.

What IPP12 says

IPP12 says that an agency (A) may disclose personal information to a foreign person or entity (B) in reliance on IPP 11(1):

• (a) (disclosure was a purpose or directly related to a purpose of collection)
• (c) (individual authorisation)
• (e) (maintenance of the law etc)
• (f) (serious threat)
• (h) (information to be used in non-identifying form or for statistical or research purposes with no identifying publication), or
• (i) (sale of a business)

only if:

• the individual concerned authorises the disclosure to B after being expressly informed by A that B may not be required to protect the information in a way that, overall, provides comparable safeguards to those in the Act, or
• B is carrying on business in New Zealand and, in relation to the information, A believes on reasonable grounds that B is subject to the Act, or
• A believes on reasonable grounds that B is subject to privacy laws that, overall, provide comparable safeguards to those in the Act, or
• A believes on reasonable grounds that B is a participant in a prescribed binding scheme, or
• A believes on reasonable grounds that B is subject to privacy laws of a prescribed country, or
• A otherwise believes on reasonable grounds that B is required to protect the information in a way that, overall, provides comparable safeguards to those in the Act (for example, under an agreement entered into between A and B).

"Prescribed binding scheme" means a binding scheme specified in regulations and "prescribed country" means a country specified in regulations. These regulations have not been released yet.

Under IPP12(2), IPP12 does not apply if the personal information is to be disclosed to B in reliance on IPP 11(1)(e) (maintenance of the law etc) or (f) (serious threat) and it is not reasonably practicable in the circumstances for A to comply with the IPP's requirements.

IPP12 does not apply to use of offshore cloud service providers

It is clear from the Select Committee’s report on the Privacy Bill and section 11 of the Act (Personal information treated as being held by another agency in certain circumstances) that IPP12 does not apply to an agency’s use of offshore cloud service providers to store or process personal information on the agency’s behalf. As the Select Committee put it, “the transferring agency [is] treated as still holding the information and would be liable for any privacy breaches by the cloud service provider. Therefore, the transfer of data between the agency and the cloud service provider [will] not be a disclosure for the purposes of the IPPs.”

Practical implications

IPP12 has practical implications for any disclosure of personal information overseas where the recipient isn’t covered by section 11 (meaning there is a “disclosure” under the Act) and the disclosing agency cannot rely on the IPP12(2) carve-outs mentioned above.

For some agencies, this could mean there’s a need to:

• review all off-shore disclosure arrangements
• check, in each case, whether section 11 applies or not, and
• for each case where section 11 does not apply, assess whether an IPP12 exception applies to permit the disclosure, e.g., ‘overseas recipient is subject to privacy laws with comparable safeguards’, ‘participant in prescribed binding scheme’, recipient is in a ‘prescribed country’, or ‘contractual provisions fill the gap’.

As to the last of these (‘contractual provisions fill the gap’), agencies may wish to develop or adopt model contractual clauses for use in their offshoring contracts. So far as adoption is concerned, note that the Office of the Privacy Commissioner is developing a set of model clauses that agencies will be able to use for this purpose.

Nothing to see here then 🙂

In that case, you won't be interested in a few changes that have been in the Privacy Act 2020's IPP13 (previously IPP12) on the use of unique identifiers.