Reprint as at 7 August 2020

Coat of Arms of New Zealand

Privacy Act 2020

Public Act
 
2020 No 31
Date of assent
 
30 June 2020
Commencement
 
see section 2
Note

Changes authorised by subpart 2 of Part 2 of the Legislation Act 2012 have been made in this official reprint.

Note 4 at the end of this reprint provides a list of the amendments incorporated.

This Act is administered by the Ministry of Justice.

Contents

1Title
2Commencement
3Purpose of this Act
4Application of this Act
5Transitional, savings, and related provisions
6Act binds the Crown
7Interpretation
8Meaning of New Zealand agency
9Meaning of overseas agency
10Personal information held by agency if held by officer, employee, or member of agency
11Personal information treated as being held by another agency in certain circumstances
12Actions of, and disclosure of information to, staff of agency, etc
13Privacy Commissioner
14Deputy Privacy Commissioner
15Holding of other offices
16Superannuation or retiring allowances
17Functions of Commissioner
18Other functions of Commissioner
19Responsible Minister must present copy of report on operation of Act to House of Representatives
20Duty to act independently
21Commissioner to have regard to certain matters
22Information privacy principles
23Application of IPPs in relation to information held overseas
24Relationships between IPPs and other New Zealand law
25IPPs 1 to 4 do not apply to personal information collected before 1 July 1993
26Restricted application of IPP 13 to unique identifiers assigned before 1 July 1993
27Restricted application of IPPs to personal information collected or held for personal or domestic affairs
28IPPs 2, 3, and 4(b) do not apply to personal information collected by intelligence and security agencies
29IPPs 6 and 7 do not apply to certain information
30Commissioner may authorise collection, use, storage, or disclosure of personal information otherwise in breach of IPP 2 or IPPs 9 to 12
31Enforceability of IPPs
32Codes of practice in relation to IPPs
33Issue of code of practice
34Urgent issue of code of practice
35Notification, availability, and commencement of codes of practice
36Application of Legislation Act 2012 to codes of practice
37Amendment and revocation of codes of practice
38Effect of codes of practice
39Interpretation
40Individuals may make IPP 6 request
41Urgency
42Assistance
43Transfer of IPP 6 request
44Responding to IPP 6 request
45Decision to grant access to personal information
46Decision to refuse access to personal information
47Decision to neither confirm nor deny personal information is held
48Extension of time limits
49Protection, etc, of individual as reason for refusing access to personal information
50Evaluative material as reason for refusing access to personal information
51Security, defence, international relations as reason for refusing access to personal information
52Trade secret as reason for refusing access to personal information
53Other reasons for refusing access to personal information
54Agency may impose conditions instead of refusing access to personal information
55Withholding personal information contained in document
56Ways personal information in document may be made available
57Responsibilities of agency before giving access to personal information
58Interpretation
59Individuals may make correction requests
60Urgency
61Assistance
62Transfer of correction request
63Decision on request to correct personal information
64Decision on request to attach statement of correction
65Extension of time limits
66Charges
67Commissioner may authorise public sector agency to impose charge
68Interpretation
69Interference with privacy of individual
70Complaints
71Who may make complaint
72Form of complaint
73Procedure on receipt of complaint
74Commissioner may decide not to investigate complaint
75Referral of complaint to another person
76Referral of complaint to overseas privacy enforcement authority
77Exploring possibility of settlement and assurance without investigating complaint
78Referral of complaint to Director without conducting investigation
79Application of this subpart
80Commencing investigation
81Conducting investigation
82Commissioner may regulate own procedure
83Exploring possibility of settlement and assurance during investigation
84Referral of complaint to Director without completing investigation
85Compulsory conferences of parties to complaint
86Power to summon persons
87Power to require information and documents
88Disclosure of information may be required despite obligation of secrecy
89Protection and privileges of persons required to provide information, etc
90Disclosed information privileged
91Procedure after completion of investigation relating to access to personal information
92Access direction
93Procedure after completion of investigation relating to charging
94Procedure after completion of other investigations
95Special procedure relating to intelligence and security agency
96Commissioner to report breach of duty or misconduct
97Director may commence proceedings in Tribunal
98Aggrieved individuals may commence proceedings in Tribunal
99Right of Director to appear in proceedings commenced under section 98
100Apology not admissible except for assessment of remedies
101Onus of proof
102Remedies in respect of interference with privacy
103Damages
104Enforcement of access direction
105Appeal to Tribunal against access direction
106Time for lodging appeal
107Interim order suspending Commissioner’s direction pending appeal
108Determination of appeal
109Proceedings involving access to personal information
110Costs
111Certain provisions of Human Rights Act 1993 to apply
112Interpretation
113Assessment of likelihood of serious harm being caused by privacy breach
114Agency to notify Commissioner of notifiable privacy breach
115Agency to notify affected individual or give public notice of notifiable privacy breach
116Exceptions to or delay in complying with requirement to notify affected individuals or give public notice of notifiable privacy breach
117Requirements for notification
118Offence to fail to notify Commissioner
119Section 211 does not apply to processes and proceedings relating to failure to notify notifiable privacy breach
120Liability for actions of employees, agents, and members of agencies
121Knowledge of employees, agents, and members of agencies to be treated as knowledge of employers, principal agencies, and agencies
122Publication of identity of agencies in certain circumstances
123Compliance notices
124Issuing compliance notice
125Form of compliance notice
126Agency response to compliance notice
127Commissioner may vary or cancel compliance notice
128Commissioner’s power to obtain information
129Publication of details of compliance notice
130Enforcement of compliance notice
131Appeal against compliance notice or Commissioner’s decision to vary or cancel notice
132Interim order suspending compliance notice pending appeal
133Remedies, costs, and enforcement
134Application of Human Rights Act 1993
135Commissioner may be represented in proceedings
136Purpose of this subpart
137Relationship between subpart 1 and other law relating to information disclosure
138Interpretation
139Information sharing between agencies
140Information sharing within agencies
141Parties to information sharing agreement
142Agreement may apply to classes of agencies
143Lead agency
144Form and content of information sharing agreement
145Governor-General may approve information sharing agreement by Order in Council
146Requirements for Order in Council
147Further provisions about Order in Council
148Status of Order in Council
149Matters to which relevant Minister must have regard before recommending Order in Council
150Consultation on proposed information sharing agreement
151Commissioner may prepare and publish report on approved information sharing agreement
152Requirement to give notice of adverse action
153When requirement to give notice of adverse action applies
154Responsibilities of lead agency
155Report of lead agency
156Commissioner may specify frequency of reporting by lead agency
157Amendment of approved information sharing agreement
158Review of operation of approved information sharing agreement
159Report on findings of review
160Relevant Minister must present copy of report under section 159(1) and report setting out Government’s response to House of Representatives
161Power to amend Schedule 2 by Order in Council
162Purpose of this subpart
163Relationship between this subpart and other law relating to information disclosure
164Interpretation
165Access by agencies to identity information
166Manner and form of access
167Annual reporting requirement
168Power to amend Schedule 3 by Order in Council
169Purpose of this subpart
170Relationship between this subpart and other law relating to information disclosure
171Interpretation
172Access by accessing agencies to law enforcement information
173Power to amend Schedule 4 by Order in Council
174Purpose of this subpart
175Application of this subpart
176Relationship between this subpart and other law relating to information disclosure
177Interpretation
178Information matching agreements
179Use of results of authorised information matching programme
180Extension of time limit
181Notice of adverse action proposed
182Reporting requirements
183Reports on authorised information matching programmes
184Reports on information matching provisions
185Responsible Minister must present copy of report under section 184 and report setting out Government’s response to House of Representatives
186Avoidance of controls on information matching through use of exceptions to information privacy principles
187Avoidance of controls on information matching through use of official information statutes
188Power to amend Schedule 5 by Order in Council
189Power to amend Schedule 6 by Order in Council
190Amendments to other enactments related to this subpart
191Repeal of section 190 and Schedule 7
192Interpretation
193Prohibition on transfer of personal information outside New Zealand
194Commissioner’s power to obtain information
195Transfer prohibition notice
196Commissioner may vary or cancel transfer prohibition notice
197Offence in relation to transfer prohibition notice
198Appeals against transfer prohibition notice
199Application of Human Rights Act 1993
200Power to amend Schedule 8 by Order in Council
201Privacy officers
201AResponsibility under Parts 4 to 6 for interdepartmental executive board
202Commissioner may require agency to supply information
203Inquiries
204Powers relating to declaratory judgments
205Protection against certain actions
206Commissioner and staff to maintain secrecy
207Commissioner may share information with overseas privacy enforcement authority
208Consultation
209Exclusion of public interest immunity
210Adverse comment
211Liability of employers, principals, and agencies
212Offences
213Regulations: prescribed binding schemes
214Regulations: prescribed countries
215Other regulations
216Repeal and revocation
217Consequential amendments
218Repeal of section 217 and Schedule 9
Reprint notes

The Parliament of New Zealand enacts as follows: