Privacy Act 2020 video training: Changes we need to know about (earn a CPD point too)

Sorry, not quite right on this one. IPP1(2) says that, if you don't need to collect identifying information for your lawful purpose, you can't require it from people.

There is actually a new IPP2 exception: “to prevent or lessen a serious threat to the life or health of the individual concerned or any other individual”.

Red buzzer 🙂 IPP4 now expressly draws agencies' attention, when considering the manner of collecting personal information, to the position of children or young persons.

The correct answer here is "True". IPP13 clarifies that an agency (A) does not assign a unique identifier to an individual by simply recording a unique identifier assigned to the individual by another agency (B) for the sole purpose of communicating with B about the individual.

The statement above is actually true. IPP12 does not apply to transfers of personal information to cloud service providers and others who, broadly speaking, act as agents for the agency in New Zealand and don’t use the information for their own purposes (in these cases, there is no “disclosure” and so IPPs 11 and 12 are not triggered - see section 11 of the Act).

Not correct sorry. An agency must notify the Privacy Commissioner as soon as practicable after becoming aware that a notifiable privacy breach has occurred. There are no exceptions to this requirement.

The Privacy Commissioner can, in fact, issue a compliance notice in the absence of harm.

Actually, an agency can do this. There is a new ground for refusing access where disclosure would “create a significant likelihood of serious harassment of an individual”.

Sorry, not quite right on this one! The Privacy Commissioner has a new power to require an agency to give individuals access to their personal information.

Absolutely not. There's a new offence provision under which an agency commits an offence and can be liable to a fine of up to $10,000 if it destroys any document containing personal information when it knows a person has made a request for it.

You're entitled to your opinion on this one, but I reckon it's potentially quite important to undertake the kind of review described above. For some agencies, this will be quick and easy. For others, it may require a bit of work.