Privacy and information
Overview of the privacy and information laws
The Privacy Act 2020
New privacy laws came into force on 1 December 2020 via the Privacy Act 2020 (the Act). The main changes to be aware of are:
- Agencies must report privacy breaches that cause, or are likely to cause, serious harm (like being hacked) to the Privacy Commissioner and have to tell the people affected by the breach.
- The Privacy Commissioner can now issue compliance notices to make an agency do or stop doing something. Failure to comply could result in a penalty of up to $10,000.
- New Zealand agencies have to take reasonable steps to make sure that personal information they send overseas is protected by privacy standards that are as high as New Zealand standards.
- The new law applies to businesses whether or not they have a legal or physical presence in New Zealand. This means that international companies carrying on business in New Zealand and holding New Zealanders’ personal information have to comply with New Zealand law no matter where they or their servers are based.
- The Act also applies to people who don’t normally live in New Zealand (aren’t “ordinarily resident”) but who get personal information from others while they’re in New Zealand.
What kinds of information does the Privacy Act apply to?
Privacy Act 2020, ss 7, 27, 30
The privacy and information rules in the Privacy Act protect what’s called “personal information”. This means information about an identifiable individual (but not an individual who is already dead). This doesn’t necessarily mean information that’s particularly private or sensitive – it means information that can be used to identify a specific individual (for example, a home address).
The Act doesn’t apply to information:
- about organisations (like companies, incorporated societies or charitable trusts)
- that you collect or keep about someone else for personal, family or household use. For example, if you give out a friend’s contact details to a third person, you’re not breaching the Act:
- This exemption doesn’t protect you when you collect, use or give out the information if this would be highly offensive to an ordinary reasonable person (see: “Criminal offences under the Harmful Digital Communications Act”); and
- that the Privacy Commissioner has authorised to be collected, used and/or disclosed.
Who has to follow the rules in the Privacy Act?
The Act covers government departments, companies of all sizes, religious groups, schools, clubs and individuals. The Act uses the word “agency” as a general term to refer to any person or group that have to follow the rules.
There are a few organisations and individuals that don’t have to follow the rules in the Privacy Act. Other rules govern how they manage personal information. Organisations and individuals that are exempt include, for example:
- the news media, when they’re involved in news activities (such as producing TV programmes, or publishing newspaper articles or letters to the editor). Complaints about the news media are made to the Broadcasting Standards Authority, the New Zealand Press Council or the courts.
- members of parliament acting in their official capacity. Complaints about members of parliament are dealt with by parliament or political parties.
- courts or tribunals when they’re carrying out their judicial functions.
- the Ombudsman.
Some individuals or organisations are allowed to give out information in a way that would usually breach the Privacy Act, if they have been authorised to do so by another law. For example, sections 15 and 16 of the Oranga Tamariki Act 1989 allows anyone to report suspected child abuse to the police or to Oranga Tamariki / Ministry for Children without breaching the rules in the Act about disclosing personal information.
You can find more helpful information at the Privacy Commissioner’s website: privacy.org.nz.
For example, navigate to the “Resources” tab, and then click on “Rental sector guidance” for in-depth guidelines about what information your landlord can ask you to provide.
