Privacy (Cross-border Information) Amendment Bill

Prohibition on transfer of personal information outside New Zealand

New section 114B would authorise the Privacy Commissioner to prohibit the transfer of personal information from New Zealand to another State if the Commissioner was satisfied on reasonable grounds of three things:

• •the information would be received in New Zealand from another State and would be likely to be transferred to another State where the privacy protection is not comparable to that established by the Privacy Act

• •the transfer would circumvent the laws of the State where the information originated

• •the transfer would be likely to contravene the basic principles of national application set out in Part 2 of the OECD Guidelines.

We heard concern that the way the basic principles of national application in the OECD Guidelines have been incorporated in the bill might result in future changes in the Guidelines being incorporated into the statutory framework of the Privacy Act without examination by Parliament.

To address this we recommend inserting new Schedule 5A to set out the basic principles of national application. This would ensure that changes to the principles of national application in the OECD Guidelines would not be incorporated into the Privacy Act automatically. We recommend a consequential amendment to insert new clause 8A to allow the Governor-General to make regulations to amend new Schedule 5A. This would allow the principles set out in new Schedule 5A to be amended to reflect any changes made by the OECD. We note that amendments to new Schedule 5A would be subject to the Regulations (Disallowance) Act 1989.

To avoid unnecessary duplication, we recommend deleting new section 114B(1)(b), as the matters intended to be considered by the Commissioner within this subsection could be considered by the Commissioner under new section 114B(1)(a).

Commissioner’s power to obtain information

We recommend inserting new section 114BA to make it explicit that when determining whether to prohibit a transfer of personal information, the Privacy Commissioner could use the investigative powers in Part 9 of the principal Act, in the same way as if the Commissioner were conducting an inquiry under section 13(1)(m) of the Act. This would ensure that the Commissioner could hear or obtain information from any person he or she considered necessary.