Changes to Privacy Act
On 26 June 2020, Parliament passed the Privacy Act 2020 and the changes take effect from 1 December 2020. The new Act has been long-awaited and will replace the 27 year-old Privacy Act 1993. Employers will be looking at what changes they may need to make to ensure their processes and policies comply with the new Act. Please contact us if you would like any assistance.
The key changes include:
Requirements to report privacy breaches: If an agency has a privacy breach that causes serious harm or is likely to do so, it must notify the people affected and the Commissioner.
Compliance notices: The Commissioner will be able to issue compliance notices to require an agency to do something, or stop doing something.
Decisions on access requests: The Commissioner will make binding decisions on complaints about access to information, rather than the Human Rights Review Tribunal. The Commissioner’s decisions can be appealed to the Tribunal.
Strengthening cross-border protections: New Zealand agencies will have to take reasonable steps to ensure that personal information sent overseas is protected by comparable privacy standards. The Act also clarifies that when a New Zealand agency engages an overseas service provider, it will have to comply with New Zealand privacy laws.
Class actions: The Act permits class actions in the Human Rights Review Tribunal by persons other than the Director of Human Rights Proceedings.
New criminal offences: It will be an offence to mislead an agency in a way that affects someone else’s information, and to destroy documents containing personal information if a request has been made for it. The penalty will be a fine of up to $10,000.
Strengthening the Privacy Commissioner’s information gathering power: The Commissioner will be able to shorten the time frame in which an agency must comply with investigations and the penalty for non-compliance will be increased from $2,000 to 10,000.
Disclaimer: The information contained in this article is current at the date of publishing and is of a general nature. It should be used as a guide only and not as a substitute for obtaining legal advice. Specific legal advice should be sought where required.