Privacy Bill

Government Bill

34—2

As reported from the Justice Committee

Commentary

Recommendation

The Justice Committee has examined the Privacy Bill and recommends that it be passed with the amendments shown.

Introduction

The Privacy Bill seeks to repeal and replace the Privacy Act 1993. According to clause 3, the purpose of the bill is to promote and protect individual privacy.

Information privacy principles

The bill would keep the principles-based framework of the Act, while updating the law to reflect the needs of the digital age. Clause 19 seeks to reproduce (with changes) the 12 information privacy principles (IPPs) in the Act.

Here are some key changes sought by the bill:

Mandatory reporting of privacy breaches

Part 6, subpart 1, would require agencies1 to inform the Privacy Commissioner and affected individuals when a privacy breach causes harm or poses a risk of harm to people. Not notifying the Commissioner would be an offence.

Compliance notices

Part 6, subpart 2, would allow the Commissioner to issue a compliance notice to make an agency do something, or stop doing something, to comply with privacy law. Compliance notices could be enforced by the Human Rights Review Tribunal.

More protection for data moving overseas

Under clause 19, IPP 11(3), agencies would only be able to disclose personal information to an overseas person if the individual concerned authorised the disclosure, the overseas person was in a prescribed country, or the agency believed on reasonable grounds that the overseas person was required to protect the information in a way that, overall, provides comparable safeguards to those in the bill.

Commissioner’s decisions on access requests would be binding

Part 5 of the bill would enable the Commissioner, rather than the Human Rights Review Tribunal, to make directions on complaints about access to information. An appeal against a direction could be made to the Tribunal.

New offences and penalties

The bill would create new criminal offences, including:

  • misleading an agency to obtain access to someone else’s personal information (clause 212(2)(c))

  • destroying a document containing personal information, knowing that a request has been made for it (clause 212(2)(d)).

Currently, penalties for offences under the Act are fines of up to $2,000. Fines for offences under the bill would be up to $10,000.

Our proposed amendments

This commentary covers the main amendments we recommend to the bill. We do not discuss minor or technical amendments.

Overseas agencies

The bill should say whether and when it would apply to agencies that are outside New Zealand. We recommend inserting clause 3A to make this clear and to set out who the bill would apply to.

Under our proposed clause 3A(1)(a), the bill would apply to any actions by a New Zealand agency, whether inside or outside New Zealand. It would apply to all personal information collected or held by New Zealand agencies, regardless of where the information was collected or held and where the person to whom the information relates is located. A New Zealand agency is defined in our proposed clause 3A(4) as a public sector agency, a private sector agency established under New Zealand law or having its central management and control in New Zealand, an individual who is ordinarily resident in New Zealand, or a court or tribunal (except in relation to its judicial functions).

To make clear what is meant by “ordinarily resident in New Zealand”, we recommend providing a definition of the phrase in clause 6(2).

Under our proposed clause 3A(1)(b), the bill would apply to any actions taken by an overseas agency in the course of carrying on business in New Zealand. It would apply to all personal information collected or held by an overseas agency in the course of carrying on business in New Zealand. It would apply regardless of where the information was collected or held and where the person to whom the information relates is located.

Clause 3A(3) provides that an agency would be treated as carrying on business in New Zealand whether or not it has a physical place of business here, charges any monetary payment for goods or services, or makes a profit from its business here.

Under our proposed clause 3A(1)(c), the bill would also apply to an individual who does not ordinarily reside in New Zealand, but who is present. It would apply in relation to any action taken by the individual and all personal information collected by them while they were in New Zealand, regardless of where the information was held and where the person to whom the information relates is located.

Under our proposed clause 3A(2), the bill would also apply, for the purposes of subpart 3 of Part 7 (which is about accessing law enforcement information), to courts and tribunals in relation to their judicial functions. Also, the offence provisions in clause 212 would apply to all people, including those outside New Zealand, if any act or omission forming part of the offence, or any event necessary to the completion of the offence, occurred in New Zealand.

News media exemptions

The definition of “agency” in clause 6 excludes news media carrying out news activities. This means that the bill would not apply to the news media. The purpose of excluding the media is to enable them to perform their role of supporting the free flow of information to the public. We recommend several changes to the provisions about media.

Books and blogs

The definition of “news activity” in clause 6 refers to the gathering of news, and the preparation, compiling, or dissemination of “articles or programmes”. It does not refer to journalistic works that are neither articles nor programmes, such as books and blogs. To recognise the importance of media independence in a free and democratic society, we consider that people producing news in these formats should also be excluded from the bill. We recommend widening the definition of “news activity” in clause 6 to refer to “publishing” news, observations on news, and current affairs, and including a definition of “publish” to make clear that it includes publishing on the Internet.

Definition of news entity

We consider it appropriate to exempt only media entities that are subject to independent standards of conduct, including privacy standards, and a complaints procedure. Examples of organisations that set independent standards are the Broadcasting Standards Authority and the New Zealand Media Council. We recommend providing for this in our new definition of “news entity”: an entity whose business consists of a news activity and that is subject to either of the two regulatory bodies mentioned above or any other similar body prescribed in regulation. Criteria for prescribing such bodies are set out in proposed subclause (2) of clause 213. They include a requirement for the Minister to consult with the Privacy Commissioner before recommending that a body be prescribed.

RNZ and TVNZ

In the bill as introduced, Radio New Zealand Limited (RNZ) and Television New Zealand Limited (TVNZ) are treated differently from other news media. Unlike other news media, IPP 6 (access to personal information) and IPP 7 (correction of personal information) would apply to them in respect of their news activities. The rationale for this is that, as Crown entities, they should be subject to stronger requirements for transparency than other media organisations. Under clause 57, they would have grounds to refuse access requests under IPP 6 to protect confidential journalistic sources.

These provisions are based on those in the Privacy Act.

RNZ and TVNZ believe that they are disadvantaged because, when they conduct a news investigation, the subject of the investigation can request information about themselves, which can hinder the investigation.

We believe that RNZ and TVNZ should be brought within the media exemption. It is a matter of principle that they should be able to operate on the same footing as other news media when undertaking news activities. We recommend aligning the treatment of RNZ and TVNZ with other news media so that they have the full benefit of the media exemption.

Information that is stored or processed by one agency on behalf of another

Under clause 8, an agency would remain accountable for information held by another agency as its agent. This includes “cloud” providers and information sent overseas for storage or processing on behalf of an agency.

However, we believe a storing or processing agency that used or disclosed the information for its own purposes should also be accountable to the affected individual. We therefore recommend amending clause 8 to provide that, in such circumstances, both agencies would be treated as holding the information.

Cloud services should not be covered by the principles relating to overseas disclosure

We consider that the obligations in clause 19 of the bill as introduced, IPP 11(3) to (6) (which, for reasons to be discussed later, we recommend renaming to IPP 12), should not apply to an agency transferring information to a cloud storage provider or other overseas processor.

Under clause 8, the transferring agency would be treated as still holding the information and would be liable for any privacy breaches by the cloud service provider. Therefore, the transfer of data between the agency and the cloud service provider would not be a disclosure for the purposes of the IPPs.

For the avoidance of doubt, we recommend making this clear by inserting subclause (5) into clause 8.

Amendments to the information privacy principles

Agencies not to collect information unless it is required

Clause 19, IPP 1 would allow agencies to collect information only where it is necessary for a lawful purpose connected with the function of the agency, and collecting the information is necessary for that purpose.

We wish to discourage agencies collecting personal identifiers by default without considering whether it is necessary to do so. We recommend inserting new subclause (2) into clause 19, IPP 1, to emphasise that agencies may not require individuals’ identifying information unless it is necessary for the lawful purpose for which the information is collected.

Collecting information from children and young people

IPP 4 sets out how personal information should be collected. It is different from IPP 4 in the Act because it would require agencies to particularly have regard to an individual’s age when deciding how to collect information. The change seeks to protect young people, who may be more willing than adults to disclose their information online, and who may not be aware why an agency wants their information.

We consider that the vulnerability of children and young people should be emphasised in a stand-alone provision. We recommend moving the requirement in IPP 4 for agencies to have regard to the age of the individual into a new subclause (2). New subclause (2) would require agencies to take into account the vulnerability of children and young people when collecting personal information from them.

Correcting information about yourself

IPP 7 gives individuals the right to correct an agency’s information about them. The bill structures this principle a little differently than the Privacy Act: the bill moves some procedural aspects of the IPP to clauses 69 and 70. For clarity, we recommend restructuring IPP 7 to move some of these provisions back into IPP 7.

Limits on disclosure

Under IPP 11 as introduced, personal information must not be disclosed except in certain circumstances. IPP 11(3) to (6) deals with the disclosure of information to overseas agencies. For clarity, and to make the provisions easier to find, we recommend that they be moved to a separate IPP, new IPP 12. Consequentially, this would mean renumbering IPP 12 in the bill as introduced as new IPP 13.

Disclosing information to an agency overseas

Our proposed IPP 12 (which is based on IPP 11(3) to (6) in the bill as introduced) sets out the principles for disclosure of personal information outside New Zealand.

In most cases, an agency that wants to disclose personal information to a foreign person or entity would need to satisfy at least one of the criteria set out in our proposed IPP 12(1):

  • the individual concerned authorises the disclosure, after being expressly informed by the agency that the foreign person or entity may not be required to protect the information in a way that, overall, provides comparable safeguards to those in the bill

  • the foreign person or entity is carrying on business in New Zealand, and the agency believes, on reasonable grounds, that the foreign person or entity is subject to the bill

  • the agency believes on reasonable grounds that the foreign person or entity is subject to privacy laws that, overall, provide comparable safeguards to those in the bill

  • the agency believes on reasonable grounds that the foreign person or entity is a participant in a prescribed binding scheme

  • the agency believes on reasonable grounds that the foreign person or entity is subject to privacy laws of a prescribed country

  • the agency otherwise believes on reasonable grounds that the foreign person or entity must protect the information in a way that, overall, provides comparable safeguards to those in the bill.

We recommend including the fourth criterion because we believe new IPP 12 should also allow for possible future participation by New Zealand in binding cross-border privacy schemes. An example of such a binding scheme is the Asia Pacific Economic Cooperation (APEC) Cross-Border Privacy Rules system. Six out of the 21 APEC economies participate in the system.

We recommend inserting a definition of “country” into clause 6 which includes a state, territory, province, or any other part of a country.

Criteria for prescribing binding schemes and countries

We recommend inserting new clauses 212A and 212B to provide for the making of regulations prescribing countries and binding schemes for the purposes of IPP 12, and to set out the criteria that the Minister must consider before recommending that such regulations be made. The Minister would be able to recommend that countries or binding schemes be prescribed if satisfied that personal information would be subject to privacy safeguards that are, overall, comparable to those in the bill.

Clarify the principles about unique identifiers

Our proposed IPP 13 (IPP 12 in the bill as introduced) sets out agencies’ obligations regarding the use of unique identifiers such as customer numbers.

Subclause (5) of proposed IPP 13 would require an agency to take all reasonable steps to minimise the risk of misuse of a unique identifier before disclosing it to another agency. It seeks to reduce identity theft by helping to control the publication of unique identifiers. We recommend broadening this provision to require agencies to take reasonable steps to guard against identity theft at all times, not just when disclosing a unique identifier to another agency. For example, an agency should take any reasonable steps to minimise the risk of misuse when displaying unique identifiers on computer screens or on receipts.

We recommend including, as an example of good practice, the use of truncated account numbers in receipts or correspondence.

Commissioner’s functions should include support on cross-border issues

The Commissioner should have a role in the operation of new IPP 12. He or she could assist with assessing whether other jurisdictions have comparable safeguards to those in the bill and provide guidance for agencies. He or she could also have a role if New Zealand were to join a prescribed binding scheme.

We recommend inserting paragraph (ca) into clause 14(1) to include this role as a function of the Commissioner.

Information about domestic or personal affairs

Clause 24 seeks to exempt information collected for the purposes of, or in connection with, an individual’s personal or domestic affairs. However, under clause 24(3)(a), information collected by misleading or deceptive conduct would not be exempt.

We do not consider that clause 24(3)(a) is necessary. Clause 212(2) already contains offences relating to impersonation and misleading or deceptive conduct. Also, under clause 24(3)(a), misleading conduct without any malicious intent could lead to unnecessary complaints to the Commissioner. We recommend removing paragraph (a) from clause 24(3).

Public register privacy principles should be removed

A public register is a register, roll, list, or other document that is required by law to be publicly available for inspection. Part 3, subpart 2 of the bill would carry over the Act’s public register privacy principles.

We believe that the public register privacy principles are outdated and that legislation establishing public registers is able to provide more relevant safeguards around access to information and the circumstances under which information may be withheld. Also, the Law Commission and the Privacy Commissioner have recommended that the public register privacy principles be repealed. We recommend removing Part 3, subpart 2, and related provisions including Schedule 2.

Accessing and correcting personal information

Part 4, subpart 1 (clauses 44 to 63) sets out the process for making and responding to requests made under IPP 6. Part 4, subpart 2 (clauses 64 to 71) sets out the process for responding to requests under IPP 7.

Improving the bill’s structure

As introduced, the bill separates the processes for confirming that an agency holds personal information, and for accessing the information. In practice, we understand that people want access to their information, regardless of how their request is worded. We recommend referring to both types of request under IPP 6 as “IPP 6 requests”. We also recommend combining clauses 49 and 50 into new clause 50, and inserting new clauses 50A, 50B, and 50C to support our new clause 50.

Grounds for denying access to information

Clause 52 sets out some of the grounds on which an agency could refuse access to information. An agency could refuse access under clause 52(1)(a)(i) if the disclosure would be likely to endanger the safety of an individual.

We consider that these grounds should be expanded to include a serious threat to public health or safety, or to the life or health of any individual. We recommend amending clause 52(1)(a)(i) accordingly.

Information requested under duress

Under clause 57(h), an agency would not have to give out information if it believed it had been requested under duress. We recommend moving paragraph (h) from clause 57 to clause 63, which sets out the precautionary measures that an agency should take before allowing access to the information. We also recommend removing the agency’s discretion, so it would be prohibited from giving out the information. Under our proposed clause 63(ab), if the agency had reasonable grounds to believe that the request was made under duress, it would have to refuse access to the information.

Making documents available electronically

Clause 62 sets out how personal information should be provided. We recommend amending clause 62(1)(b) to make it clear that information could be provided electronically.

Charging for providing and correcting information

In clause 73(2)(a) as introduced, the Commissioner could authorise a public sector agency to charge requestors who live overseas and who are not New Zealand citizens or permanent residents. We propose some drafting changes to clauses 72 and 73 and, in doing so, we recommend discarding this provision.

Who can make a complaint?

Part 5, subpart 1 (clauses 76 to 84) deals with complaints. It is not clear that organisations such as advocacy groups could bring a complaint on behalf of two or more aggrieved individuals. We recommend defining “representative” in clause 74 to make this clear.

We consider that the mechanism for deferring complaints is unnecessary. We recommend removing clauses 79(1)(b) and 81.

Clause 80 sets out certain grounds on which the Commissioner could decide not to investigate a complaint. We recommend allowing the Commissioner a general discretion to not investigate a complaint. We recommend inserting new subclause (2) into clause 80 to enable the Commissioner to decide not to investigate a complaint if he or she considers an investigation unnecessary, having regard to all the circumstances of the case.

Human Rights Review Tribunal hearings

Part 5, subpart 3 (clauses 102 to 116) provides for proceedings before the Human Rights Review Tribunal.

Closed hearings at Human Rights Review Tribunal

We recommend inserting new clause 114A to provide the Tribunal with an express power to close proceedings when necessary to hear and determine an access complaint. We were advised that this recommendation is consistent with section 27 of the New Zealand Bill of Rights Act 1990, which is about the right to justice. Although closing proceedings could restrict the right to natural justice, doing so would be demonstrably justified in certain circumstances, for example, when disclosure of a document could endanger someone’s safety. Nevertheless, we recommend providing, in new subclause (3), that the Tribunal may only close proceedings when necessary to avoid compromising the matters that the agency considers justify refusing access to the information.

Administrative and interim decisions

The bill would allow certain decisions to be made by the Chair of the Tribunal alone, without convening the three-person tribunal; an example is an interim order under clauses 112 and 132. We recommend providing for other situations when the Chair could make decisions alone. We recommend amendments to allow the Chair alone to determine the enforcement of access directions (clause 109), the accepting of appeals lodged within 3 months after the appeal period (clause 111), leave to apply to the High Court to vary or rescind an interim order suspending an access direction (clause 112), and the enforcement of compliance notices (clause 130).

We recommend removing clause 113 because it is unnecessary. The Human Rights Act 1993 (as amended by the Tribunal Powers and Procedures Legislation Act 2018) would be applied under clause 116 of the bill. This already allows for the determination of certain matters “on the papers” (that is, without oral submissions).

Notifying the Commissioner about privacy breaches

We propose various changes to Part 6, subpart 1, which is about notifying the Commissioner and affected individuals when there have been privacy breaches.

Breaches should only be notifiable if they cause serious harm

Clause 118 would require agencies to notify the Commissioner as soon as practicable after becoming aware of a notifiable privacy breach. Clause 119 would require agencies to also notify the affected person. Under clause 117, a notifiable privacy breach means a breach that has harmed, or poses a risk of harm to, an individual.

We consider that the threshold for “harm” is too low. It could result in over-notification to the Privacy Commissioner and to individuals. It is also appropriate to provide more certainty to agencies and to better align the bill with overseas jurisdictions which have a higher threshold for when privacy breaches should be notified.

In clause 117, we recommend replacing the definition of “notifiable privacy breach”. Paragraph (a) of our proposed definition describes a breach that it is reasonable to believe has caused serious harm or is likely to do so. In deciding whether a breach could cause serious harm, agencies should consider certain factors. They include the actions they have taken to reduce harm, the sensitivity of the information, the nature of the harm, those to whom the information might be disclosed, and whether the information is protected by security measures. We recommend inserting new clause 117A to set out these factors, and referring to them in new paragraph (a) of the definition of “notifiable privacy breach”.

Domestic or personally-held information should be exempt

Individuals should not have to notify privacy breaches where the information is held solely for the purposes of, or in connection with, their household or personal affairs. We recommend clarifying this in new paragraph (b) of the definition of “notifiable privacy breach” in clause 117.

Notification should sometimes be delayed

Under clause 119, agencies would have to tell affected individuals about a notifiable privacy breach as soon as practicable after becoming aware of the breach. If telling individuals is not practicable, the agency would give public notice of the breach instead.

In certain circumstances, it may be sensible to delay notifying individuals about a breach. For example, if an agency’s security systems were revealed to be vulnerable as a result of a privacy breach, notification could risk wider exploitation of the vulnerability, and should be delayed to prevent the risk of more harm. However, protecting the agency’s reputation would not be a good reason to delay telling people about a breach.

We recommend inserting new subclause (3A) into clause 120 to allow individual notification or public notice to be delayed in cases where the information security risks of notification outweigh the benefits of informing affected individuals. The Commissioner would still be informed as soon as is practicable after the agency becomes aware of the breach.

When should agencies not have to notify?

Clause 120 sets out exceptions to the requirement to notify affected individuals or give public notice of a notifiable privacy breach. We consider it appropriate for these exceptions to be based on the agency’s belief on reasonable grounds that the relevant circumstances exist. This would be consistent with the IPPs. We recommend amending clause 120 to reflect this.

Agency could be identified by name or description

Under clause 121(1)(e), notifications to the Commissioner would have to name the agencies that have been contacted about the privacy breach and the reason for having contacted them. This requirement is too broad. Its purpose is to inform the Commissioner’s compliance activities and communications between the Commissioner and affected individuals. We recommend amending clause 121(1)(e) to make it clear that the agencies contacted could be either named or described.

Offence to fail to notify Commissioner

Clause 122 would create an offence of failing to notify the Commissioner of a notifiable privacy breach. The bill does not make it clear that it would be a defence to a charge of failing to notify the Commissioner that it was reasonable for the agency to have considered that the breach was not a notifiable breach. We recommend setting out this defence in new subclause (3).

It is also our view that individual employees should not be liable if their employer fails to notify a privacy breach. We recommend inserting subclause (4) into clause 122 to make this clear.

Telling affected individuals who has received their information

Under clause 121(2)(a) and (3), notifications to affected individuals could not include any particulars about those who may have received their personal information. This is to accommodate the privacy interests of people who received the information. However, in some circumstances—for example, where there is a risk of family violence—telling the affected individual the recipient’s identity could help to mitigate potential harm. We recommend inserting clause 121(2A) to allow the recipient’s identity to be revealed to the affected individual if the agency believed on reasonable grounds there was a serious threat to somebody’s life or health.

Who should tell individuals about a breach?

Agencies that outsource their data storage or processing to another agency should be responsible for informing individuals of any notifiable breach, no matter which agency caused the breach. This is because they have the relationship with the individual, and individuals should not be disadvantaged by an agency’s decision to use a data service provider.

It is appropriate for an outsourcing agency to have an agreement with its service provider about the handling of information. The agreement should set out when the service provider will notify the principal agency about a privacy breach. We recommend inserting new clause 122A to encourage such terms in agreements between agencies. The new clause sets out that, if a service provider or agency knows about a privacy breach, then, for the purposes of civil (not criminal) liability, the outsourcing or principal agency is also treated as knowing about it.

Allow Commissioner to publicise compliance notices

Under Part 6, subpart 2, the Commissioner could issue compliance notices to make an agency do something, or stop doing something, to comply with privacy law. It is our view that the Commissioner should publish the fact that he or she has issued such a notice as well as the identity of the agency to which the notice was issued, other details about the notice or breach, and a statement or comment about the breach. We recommend inserting new clause 129A to provide for this. Under our new clause 129A(2), such information would not be published if it would cause the agency undue harm that outweighed the public interest.

Appointment of privacy officers

Clause 201 would require every agency to appoint a privacy officer. We recommend making it clear that privacy officers could be appointed externally to the agency. We also note that individuals should not should have to appoint a privacy officer in connection with their personal or domestic affairs, and we recommend making this clear in clause 201, new subclause (2).

Information matching programmes

Subpart 4 of Part 7 relates to information matching programmes that are authorised by an information matching provision. Clause 177 defines an information matching programme as the comparison of documents containing personal information for the purpose of producing or verifying information that could be used to take adverse action against an individual. Adverse actions include cancelling payments, imposing fines, or investigating offences.

The bill would enable existing information matching programmes to continue. Schedule 6 carries over the relevant information matching provisions and Schedule 8 would amend relevant provisions to allow existing programmes to continue but no new programmes to be entered into.

We recommend updating Schedule 8 to amend the various information matching provisions so that only existing information matching programmes may continue, and to clarify that any new sharing may be undertaken under an approved information sharing agreement (AISA). However, two information matching provisions, sections 226A and 235F of the Education Act 1989, would allow new information matching programmes.

AISAs are another information sharing mechanism. AISAs were introduced to the Privacy Act in 2013 and allow agencies to share personal information to facilitate the provision of public services. AISAs must be approved by Order in Council.

New Zealand National Party view

The National Party supports updating the Privacy Act and modernising it for the digital age. We support the bill as amended. However, we hold residual concerns over two areas. First, the threshold for agencies to notify the Commissioner as soon as practicable after becoming aware of a notifiable privacy breach. The amended bill would raise the threshold for agencies to report, but we consider there is a still a risk of over-notification. If this occurs it would trivialise genuine privacy breaches and also raise compliance costs.

Second, we are aware that the Privacy Commissioner recommended quite substantial changes to the bill that went well beyond the scope of the bill as introduced. For example, a “right to erasure”, also known as the “right to be forgotten”. We are pleased the amended bill does not pick up this suggestion and are deeply sceptical that such a measure is required in New Zealand. We are uneasy that the Commissioner recommended that the select committee make these substantial changes to the bill. A better approach would be for the Government to consult widely in advance of preparing a bill and then submitting it to the House for consideration.

Appendix

Committee process

The Privacy Bill was referred to the committee on 11 April 2018. The closing date for submissions was 24 May 2018. We received and considered 162 submissions from interested groups and individuals. We heard oral evidence from 48 submitters at hearings in Auckland and Wellington.

We received advice from the Ministry of Justice and the Office of the Clerk of the House of Representatives.

Committee membership

Raymond Huo (Chairperson)

Ginny Andersen

Hon Maggie Barry

Chris Bishop

Hon Mark Mitchell

Greg O’Connor

Hon Dr Nick Smith

Dr Duncan Webb

Key to symbols used

text inserted

text deleted

Hover your cursor over an amendment for information about that amendment. Download the PDF version to see this information in a form that can be printed out.

Hon Andrew Little

Privacy Bill

Government Bill

34—2

Contents

Commentary
Key
1Title
2Commencement
3Purpose of this Act
3AApplication of this Act
4Transitional, savings, and related provisions
5Act binds the Crown
6Interpretation
7Personal information held by agency if held by officer, employee, or member of agency
8Personal information treated as being held by another agency in certain circumstances
9Actions of, and disclosure of information to, staff of agency, etc
10Privacy Commissioner
11Deputy Privacy Commissioner
12Holding of other offices
13Superannuation or retiring allowances
14Functions of Commissioner
15Commissioner to monitor operation of Act
16Responsible Minister must present to House of Representatives copy of report under section 15 on operation of Act to House of Representatives
17Duty to act independently
18Commissioner to have regard to certain matters
19Information privacy principles
20Application of IPPs to personal information held overseas
20Application of IPPs subject to overseas laws
21Application of IPPs to public registers
22Relationships between IPPs and other law
23Exemptions relating to IPPs 1 to 4 and 12 13
24Exemption for personal information relating to personal or domestic affairs
25Exemption for intelligence and security agencies
26Certain personal information exempt from IPPs 6 and 7
27Commissioner may authorise collection, use, storage, or disclosure of personal information otherwise in breach of IPP 2, 9, 10, or 11 2 or IPPs 9 to 12
28Enforceability of IPPs
29Interpretation
30Public register privacy principles
31Compliance with PRPPs
32Relationship between PRPPs and other laws
33Enforceability of PRPPs
34Power to amend Schedule 2 by Order in Council
35Codes of practice in relation to IPPs
36Codes of practice in relation to public registers
37Relationship between codes and other law
38Issue of code of practice
39Urgent issue of code of practice
40Notification, availability, and commencement of codes of practice
41Application of Legislation Act 2012 to codes of practice
42Amendment and revocation of codes of practice
43Effect of codes of practice
44Interpretation
45Individuals may make access IPP 6 request
46Urgency
47Assistance
48Transfer of access IPP 6 request
49Decision on access request under IPP 6(1)(a)
50Decision on access request under IPP 6(1)(b)
50Responding to IPP 6 request
50ADecision to grant access to personal information
50BDecision to refuse access to personal information
50CDecision to neither confirm nor deny personal information is held
51Extension of time limits
52Protection, etc, of individual as reason for refusing request under IPP 6(1)(b) access to personal information
53Evaluative material as reason for refusing request under IPP 6(1)(b) access to personal information
54Security, defence, international relations as reason for refusing request under IPP 6(1)(b) access to personal information
55Trade secret as reason for refusing request under IPP 6(1)(b) access to personal information
56Administrative reasons for refusing request under IPP 6(1)(b)
57Other reasons for refusing request under IPP 6(1)(b) access to personal information
58Agency may impose conditions instead of refusing access to information under section 57 to personal information
59Requestor to be informed of certain matters if response given under section 49(2)(c) or 50(2)(c)
60Requestor to be informed of certain matters if request under IPP 6(1)(b) refused
61Withholding personal information requested under IPP 6(1)(b) contained in document
62Ways personal information in document may be made available
63Responsibilities of agency before giving access to personal information
64Interpretation
65Individuals may make correction requests
66Urgency
67Assistance
68Transfer of correction request
69Decision on request under IPP 7(1)(a)
69Decision on request to correct personal information
70Decision on request under IPP 7(2)(b)
70Decision on request to attach statement of correction
71Extension of time limits
72Charges
72Charges
73Commissioner may authorise public sector agency to impose charge
74Interpretation
75Interference with privacy of individual
76Types of cComplaints
77Who may make complaint
78Form of complaint
79Procedure on receipt of complaint
80Commissioner may decide not to investigate complaint
81Commissioner may decide to defer taking action on complaint
82Referral of complaint to another person
83Referral of complaint to overseas privacy enforcement authority
84Exploring possibility of settlement and assurance before investigating complaint
84AReferral of complaint to Director without conducting investigation
85Application of this subpart
86Commencing investigation
87Exploring possibility of settlement and assurance during investigation
88Conducting investigation
89Commissioner may regulate own procedure
89AExploring possibility of settlement and assurance during investigation
89BReferral of complaint to Director without completing investigation
90Compulsory conferences of parties to complaint
91Power to summon persons
92Power to require information and documents
93Disclosure of information may be required despite obligation of secrecy
94Protection and privileges of persons required to provide information, etc
95Disclosed information privileged
96Procedure after completion of investigation relating to breach of IPP 6 access to personal information
96AAccess direction
97Procedure after completion of investigation relating to charging
98Procedure after completion of investigation relating to public register
99Procedure after completion of other investigations
100Special procedure relating to intelligence and security agency
101Commissioner to report breach of duty or misconduct
102Director may commence proceedings in Tribunal
103Aggrieved individual may commence proceedings in Tribunal
104Right of Director to appear in proceedings commenced under section 103
105Apology not admissible except for assessment of remedies
106Onus of proof
107Remedies in respect of interference with privacy
108Damages
109Enforcement of access direction made by Commissioner under section 96(5)(a) after investigation of IPP 6 breach
110Appeal to Tribunal against access direction of Commissioner under section 96(5)(a)
111Time for lodging appeal
112Interim order suspending Commissioner’s direction pending appeal
113Appeal may be determined on papers
114Determination of appeal
114AProceedings involving access to personal information
115Costs
116Certain provisions of Human Rights Act 1993 to apply
117Interpretation
117AAssessment of likelihood of serious harm being caused by privacy breach
118Agency to notify Commissioner of notifiable privacy breach
119Agency to notify affected individual or give public notice of notifiable privacy breach
120Exceptions to obligations to notify affected individual or give public notice of notifiable privacy breachExceptions to or delay in complying with requirement to notify affected individuals or give public notice of notifiable privacy breach
121Requirements for notification
122Offence to fail to notify Commissioner
122ALiability of principals
123Publication of identity of agencies in certain circumstances
124Compliance notices
125Issuing compliance notice
126Form and service of compliance notice
127Agency response to compliance notice
128Commissioner may vary or cancel compliance notice
129Commissioner’s power to obtain information
129APublication of details of compliance notice
130Enforcement of compliance notice
131Appeal against compliance notice or Commissioner’s decision under section 128 to vary or cancel notice
132Interim order suspending compliance notice pending appeal
133Remedies, costs, and enforcement
134Application of Human Rights Act 1993
135Commissioner may be represented in proceedings
136Purpose of this subpart
137Relationship between subpart 1 and other law relating to information disclosure
138Interpretation
139Information sharing between agencies
140Information sharing within agencies
141Parties to information sharing agreement
142Agreement may apply to classes of agencies
143Lead agency
144Form and content of information sharing agreement
145Governor-General may approve information sharing agreement by Order in Council
146Requirements for Order in Council
147Further provisions about Order in Council
148Status of Order in Council
149Matters to which relevant Minister must have regard before recommending Order in Council
150Consultation on proposed information sharing agreement
151Commissioner may prepare and publish report on approved information sharing agreement
152Requirement to give notice of adverse action
153When requirement to give notice of adverse action applies
154Responsibilities of lead agency
155Report of lead agency
156Commissioner may specify frequency of reporting by lead agency
157Amendment of approved information sharing agreement
158Review of operation of approved information sharing agreement
159Report on findings of review
160Relevant Minister must present to House of Representatives copy of report under section 159(1) and report setting out Government’s response to House of Representatives
161Power to amend Schedule 3 by Order in Council
162Purpose of this subpart
163Relationship between this subpart and other law relating to information disclosure
164Interpretation
165Access by agencies to identity information
166Manner and form of access
167Annual reporting requirement
168Power to amend Schedule 4 by Order in Council
169Purpose of this subpart
170Relationship between this subpart and other law relating to information disclosure
171Interpretation
172Access by accessing agencies to law enforcement information
173Power to amend Schedule 5 by Order in Council
174Purpose of this subpart
175Application of this subpart
176Relationship between this subpart and other law relating to information disclosure
177Interpretation
178Information matching agreements
179Use of results of authorised information matching programme
180Extension of time limit
181Notice of adverse action proposed
182Reporting requirements
183Reports on authorised information matching programmes
184Reports on information matching provisions
185Responsible Minister must present to House of Representatives copy of report under section 184 and report setting out Government’s response to House of Representatives
186Avoidance of controls on information matching through use of exceptions to information privacy principles
187Avoidance of controls on information matching through use of official information statutes
188Power to amend Schedule 6 by Order in Council
189Power to amend Schedule 7 by Order in Council
190Amendments to other enactments related to this subpart
191Expiry of section 190 and Schedule 8
192Interpretation
193Prohibition on transfer of personal information outside New Zealand
194Commissioner’s power to obtain information
195Transfer prohibition notice
196Commissioner may vary or cancel transfer prohibition notice
197Offence in relation to transfer prohibition notice
198Appeals against transfer prohibition notice
199Application of Human Rights Act 1993
200Power to amend Schedule 9 by Order in Council
201Privacy officers
202Commissioner may require agency to supply information
203Inquiries
204Powers relating to declaratory judgments
205Protection against certain actions
206Commissioner and staff to maintain secrecy
207Commissioner may share information with overseas privacy enforcement authority
208Consultation
209Exclusion of public interest immunity
210Adverse comment
211Liability of employers and principals
212Offences
212ARegulations: prescribed binding schemes
212BRegulations: prescribed countries
213RegulationsOther regulations
214Repeal and revocation
215Consequential amendments
216Expiry of section 215 and Schedule 10
Legislative history

The Parliament of New Zealand enacts as follows:

1 Title

This Act is the Privacy Act 2018.

2 Commencement

(1)

This Act, except sections 212A to 213, comes into force on 1 July 20191 March 2020.

(2)

Sections 212A to 213 come into force on the day after the date on which this Act receives the Royal assent.

Part 1 Preliminary provisions

Subpart 1—Preliminary matters

3 Purpose of this Act

The purpose of this Act is to promote and protect individual privacy by—

(a)

providing a framework for protecting an individual’s right to privacy of personal information, while recognising that other rights and interests may at times also need to be taken into account; and

(b)

to give giving effect to internationally recognised privacy obligations and standards in relation to the privacy of personal information, including the OECD Guidelines and the International Covenant on Civil and Political Rights.

3A Application of this Act

(1)

This Act applies to

(a)

a New Zealand agency (A), in relation to

(i)

any action taken by A (whether inside or outside New Zealand); and

(ii)

all personal information collected or held by A, in relation to an individual concerned, regardless of where the information is collected or held and where the individual concerned is located:

(b)

an overseas agency (B), in relation to

(i)

any action taken by B in the course of carrying on business in New Zealand; and

(ii)

all personal information collected or held by B, in relation to an individual concerned, in the course of carrying on business in New Zealand, regardless of where the information is collected or held and where the individual concerned is located:

(c)

an individual (C) who is not ordinarily resident in New Zealand, but who is present in New Zealand, in relation to

(i)

any action taken by C while present in New Zealand; and

(ii)

all personal information collected by C while present in New Zealand, in relation to an individual concerned, regardless of where the information is held and where the individual concerned is located.

(2)

Despite subsection (1),

(a)

subpart 3 of Part 7 applies to a court in relation to its judicial functions; and

(b)

section 212 applies to any person, including a person not described in subsection (1) and who is outside New Zealand, if

(i)

any act or omission forming part of any offence under section 212 occurs in New Zealand; or

(ii)

any event necessary to the completion of any offence under section 212 occurs in New Zealand.

(3)

For the purposes of subsection (1), an agency is treated as carrying on business in New Zealand whether or not

(a)

the agency has a place of business in New Zealand; or

(b)

any monetary payment is made to the agency for the supply of goods or services (or both); or

(c)

the agency intends to make a profit from its business in New Zealand.

(4)

In this section,

New Zealand agency means an agency that is

(a)

an individual who is ordinarily resident in New Zealand; or

(b)

a public sector agency; or

(c)

a New Zealand private sector agency; or

(d)

a court or tribunal, except in relation to its judicial functions

New Zealand private sector agency means a private sector agency that is an incorporated or unincorporated body and that

(a)

is established under New Zealand law; or

(b)

has its central management and control in New Zealand

overseas agency means an overseas person, body corporate, or unincorporated body that is carrying on business in New Zealand, but is not

(a)

a New Zealand agency; or

(b)

the Government of an overseas country.

4 Transitional, savings, and related provisions

The transitional, savings, and related provisions set out in Schedule 1 have effect according to their terms.

5 Act binds the Crown

This Act binds the Crown.

Compare: 1993 No 28 s 5

Subpart 2—Interpretation and related matters

6 Interpretation

(1)

In this Act, unless the context otherwise requires,—

action includes failure to act, and also includes any policy or practice

agency

(a)

means any person or body of persons, whether corporate or unincorporate, and whether in the public sector or the private sector and, to avoid doubt, includes a department; but

(b)

does not include—

(i)

the Sovereign; or

(ii)

the Governor-General or the Administrator of the Government; or

(iii)

the House of Representatives; or

(iv)

a member of Parliament in his or her their official capacity; or

(v)

the Parliamentary Service Commission; or

(vi)

the Parliamentary Service, except in relation to personal information about any employee or former employee of that agency in his or her their capacity as such an employee; or

(vii)

in relation to its judicial functions, a court; or

(viii)

in relation to its judicial functions, a tribunal; or

(ix)

an Ombudsman; or

(x)

an inquiry; or

(xi)

a board of inquiry or court of inquiry appointed under any Act to inquire into a specified matter; or

(xii)

in relation to its news activities, any news medium entity

Chairperson means the Chairperson of the Human Rights Review Tribunal, and includes a Deputy Chairperson of the Tribunal

code of practice means a code of practice issued by the Commissioner under section 35

collect, in relation to personal information, means to take any step to seek or obtain the personal information, but does not include receipt of unsolicited information

Commissioner means the Privacy Commissioner holding office under section 10 and appointed in accordance with section 28(1)(b) of the Crown Entities Act 2004

correct, in relation to personal information, means to alter that information by way of correction, deletion, or addition, and correction has a corresponding meaning

country includes a State, territory, or province or any other part of a country

court, in relation to subpart 3 of Part 7, means a court carrying out its administrative and judicial functions

department means a government department named in Part 1 of Schedule 1 of the Ombudsmen Act 1975

Deputy Commissioner means the Deputy Privacy Commissioner appointed under section 11

Director of Human Rights Proceedings or Director means the Director of Human Rights Proceedings or alternate Director of Human Rights Proceedings appointed under section 20A of the Human Rights Act 1993

document means a document in any form, and includes—

(a)

any writing on any material:

(b)

any information recorded or stored by means of any computer or other device, and any material subsequently derived from information so recorded or stored:

(c)

any label, marking, or other writing that identifies or describes any thing of which it forms part, or to which it is attached by any means:

(d)

any book, map, plan, graph, or drawing:

(e)

any photograph, film, negative, tape, or any device in which 1 or more visual images are embodied so as to be capable (with or without the aid of some other equipment) of being reproduced

General Data Protection Regulation means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC

Human Rights Review Tribunal or Tribunal means the Human Rights Review Tribunal continued by section 93 of the Human Rights Act 1993

individual means a natural person, other than a deceased natural person

individual concerned, in relation to personal information, means the individual to whom the information relates

information privacy principle or IPP means an information privacy principle set out in section 19

inquiry means an inquiry to which section 6 of the Inquiries Act 2013 applies

intelligence and security agency means—

(a)

the New Zealand Security Intelligence Service; and

(b)

the Government Communications Security Bureau

international organisation means any organisation of States or Governments of States or any organ or agency of any such organisation, and includes the Commonwealth Secretariat

local authority

(a)

means a local authority or public body named or specified in Schedule 1 of the Local Government Official Information and Meetings Act 1987; and

(b)

includes—

(i)

any committee, subcommittee, standing committee, special committee, joint standing committee, or joint special committee that the local authority is empowered to appoint under its standing orders or rules of procedure or under any enactment or Order in Council constituting the local authority or regulating its proceedings; and

(ii)

a committee of the whole local authority

Minister means a Minister of the Crown in his or her official the Minister’s capacity as a Minister

news activity means—

(a)

the gathering of news, or the preparation or compiling of articles or programmes of or concerning news, observations on news, or current affairs, for the purposes of dissemination to the public or any section of the public:

(b)

the dissemination, to the public or any section of the public, of any article or programme of or concerning

(i)

news:

(ii)

observations on news:

(iii)

current affairs

(a)

gathering, preparing, or compiling, for the purposes of publication, any

(i)

news:

(ii)

observations on news:

(iii)

current affairs:

(b)

publishing any

(i)

news:

(ii)

observations on news:

(iii)

current affairs

news medium means any agency whose business, or part of whose business, consists of a news activity but, in relation to IPPs 6 and 7, does not include Radio New Zealand Limited or Television New Zealand Limited

news entity means an entity (including an individual)

(a)

whose business, in whole or part, consists of a news activity; and

(b)

that is, or is employed by an employer that is, subject to the oversight of

(i)

the Broadcasting Standards Authority; or

(ii)

the New Zealand Media Council; or

(iii)

any other body prescribed as a regulatory body by regulations made under section 213(1)(ab) for the purposes of this definition

OECD Guidelines means the Organisation for Economic Co-operation and Development Guidelines Governing the Protection of Privacy and Transborder Flows of Personal Data

Ombudsman means an Ombudsman appointed under the Ombudsmen Act 1975

organisation

(a)

means—

(i)

an organisation named in Part 2 of Schedule 1 of the Ombudsmen Act 1975; and

(ii)

an organisation named in Schedule 1 of the Official Information Act 1982; and

(b)

includes the Office of the Clerk of the House of Representatives

overseas privacy enforcement authority means an overseas body that is responsible for enforcing legislation to protect personal information, and that has the power to conduct investigations and pursue enforcement proceedings

Parliamentary Under-Secretary means a Parliamentary Under-Secretary in their capacity as a Parliamentary Under-Secretary

permanent resident of New Zealand means a person who

(a)

resides in New Zealand; and

(b)

is not

(i)

a person to whom section 15 or 16 of the Immigration Act 2009 applies (except if the person has been granted a visa or entry permission in accordance with section 17 of that Act); or

(ii)

a person obliged by or under that Act to leave New Zealand immediately or within a specified time; or

(iii)

treated for the purposes of that Act as being unlawfully in New Zealand

personal information means information about an identifiable individual, and includes information relating to a death that is maintained by the Registrar-General under the Births, Deaths, Marriages, and Relationships Registration Act 1995 or any former Act (as defined by the Births, Deaths, Marriages, and Relationships Registration Act 1995)

personal information

(a)

means information about an identifiable individual; and

(b)

includes information relating to a death that is maintained by the Registrar-General under the Births, Deaths, Marriages, and Relationships Registration Act 1995 or any former Act (as defined in section 2 of the Births, Deaths, Marriages, and Relationships Registration Act 1995)

private sector agency means an agency that is not a public sector agency

public register has the meaning given to it in section 29

public register privacy principle or PRPP means a public register privacy principle set out in section 30

public sector agency

(a)

means an agency that is a Minister, a Parliamentary Under-Secretary, a department, an organisation, or a local authority; and

(b)

includes any agency that is an unincorporated body (being a board, council, committee, or other body)—

(i)

that is established for the purpose of assisting or advising, or performing functions connected with, any public sector agency within the meaning of paragraph (a); and

(ii)

that is established in accordance with the provisions of any enactment or by any such public sector agency

publication has a corresponding meaning to publish

publicly available information means personal information that is contained in a publicly available publication

publicly available publication

(a)

means a publication in printed or electronic form that is, or will be, generally available to members of the public free of charge or on payment of a fee; and

(b)

includes a statutory register to the extent that the statutory register may be accessed by members of the public

publicly available publication means a publication (including a register, list, or roll of data) in printed or electronic form that is, or will be, generally available to members of the public free of charge or on payment of a fee

publish means to make publicly available in any manner, including by

(a)

displaying on any medium:

(b)

printing in a newspaper or other periodical:

(c)

broadcasting by any means:

(d)

disseminating by means of the Internet or any other electronic medium:

(e)

storing electronically in a way that is accessible to the public

responsible Minister means the Minister of Justice

serious threat, for the purposes of IPP 10(1)(f), or 11(1)(f), means a threat that an agency reasonably believes to be a serious threat having regard to all of the following:

(a)

the likelihood of the threat being realised; and

(b)

the severity of the consequences if the threat is realised; and

(c)

the time at which the threat may be realised

statutory register

(a)

means a register, list, or roll of data that is created and maintained (in printed or electronic form) under an enactment; and

(b)

includes a public register

unique identifier, in relation to an individual, means an identifier other than the individual’s name that uniquely identifies the individual

working day means any day of the week other than—

(a)

a Saturday, a Sunday, Waitangi Day, Good Friday, Easter Monday, Anzac Day, the Sovereign’s birthday, or Labour Day; or

(b)

if Waitangi Day or Anzac Day falls on a Saturday or a Sunday, the following Monday; or

(c)

a day in the period commencing on 25 December in one year and ending with 15 January in the next year.

(2)

For the purposes of this Act, a person is to be treated as ordinarily resident in New Zealand if

(a)

the person’s home is in New Zealand; or

(b)

the person is residing in New Zealand with the intention of residing in New Zealand indefinitely; or

(c)

having resided in New Zealand with the intention of establishing their home in New Zealand, or with the intention of residing in New Zealand indefinitely, the person is outside New Zealand but intends to return to establish their home in New Zealand or to reside in New Zealand indefinitely.

Compare: 1993 No 28 s 2(1)

7 Personal information held by agency if held by officer, employee, or member of agency

(1)

For the purposes of this Act, personal information held by a person in the person’s capacity as an officer, an employee, or a member of an agency is to be treated as being held by the agency.

(2)

However, subsection (1) does not apply to—

(a)

personal information held by an officer, an employee, or a member of a public sector agency (Agency A) if—

(i)

the information is held only because of the person’s connection with a private sector agency; and

(ii)

that connection is not in the person’s capacity as an officer, an employee, or a member of Agency A; or

(b)

personal information held by an officer, an employee, or a member of a private sector agency (Agency B) if—

(i)

the information is held only because of the person’s connection with another agency (whether a public sector agency or private sector agency); and

(ii)

that connection is not in the person’s capacity as an officer, an employee, or a member of Agency B.

Compare: 1993 No 28 s 3(1)–(3)

8 Personal information treated as being held by another agency in certain circumstances

(1)

For the purposes of this Act, personal information is treated as being held by an agency (Agency A) even if another agency (Agency B) holds the information

(a)

as agent for Agency A; or

(b)

for the purpose of safe custody on behalf of Agency A; or

(c)

for the purpose of processing the information on behalf of Agency A.

(1)

This section applies if an agency (A) holds information as an agent for another agency (B) (for example, the information is held by A on behalf of B for safe custody or processing).

(2)

For the purposes of this Act, the personal information is to be treated as being held by B, and not A.

(3)

However, the personal information is to be treated as being held by A as well as B if A uses or discloses the information for its own purposes.

(24)

For the purposes of this section, it does not matter whether Agency B A

(a)

is outside New Zealand; or

(b)

holds the information outside New Zealand.

(5)

To avoid doubt, if, under subsection (2), B is treated as holding personal information,

(a)

the transfer of the information to A by B is not a use or disclosure of the information by B; and

(b)

the transfer of the information, and any information derived from the processing of that information, to B by A is not a use or disclosure of the information by A.

Compare: 1993 No 28 s 3(4)

9 Actions of, and disclosure of information to, staff of agency, etc

For the purposes of this Act, an action done by, or information disclosed to, a person employed by, or in the service of, an agency in the performance of the duties of the person’s employment is to be treated as having been done by, or disclosed to, the agency.

Compare: 1993 No 28 s 4

Part 2 Privacy Commissioner

Subpart 1—Appointment of Privacy Commissioner

10 Privacy Commissioner

(1)

There continues to be a Commissioner called the Privacy Commissioner.

(2)

The Commissioner is—

(a)

a corporation sole; and

(b)

a Crown entity for the purposes of section 7 of the Crown Entities Act 2004; and

(c)

the board for the purposes of the Crown Entities Act 2004.

(3)

The Crown Entities Act 2004 applies to the Commissioner except to the extent that this Act expressly provides otherwise.

Compare: 1993 No 28 s 12

11 Deputy Privacy Commissioner

(1)

The Governor-General may, on the recommendation of the responsible Minister, appoint a Deputy Privacy Commissioner.

(2)

Part 2 of the Crown Entities Act 2004, except section 46, applies to the appointment and removal of a Deputy Commissioner in the same manner as it applies to the appointment and removal of the Commissioner.

(3)

Subject to the control of the Commissioner, the Deputy Commissioner may perform or exercise all the functions, duties, and powers of the Commissioner.

(4)

When there is a vacancy in the position of Commissioner or when the Commissioner is (for whatever reason) absent from duty, the Deputy Commissioner may perform or exercise all the functions, duties, and powers of the Commissioner.

(5)

The Deputy Commissioner is entitled to all the protections, privileges, and immunities of the Commissioner.

Compare: 1993 No 28 s 15

12 Holding of other offices

(1)

In addition to the persons specified in section 30(2) of the Crown Entities Act 2004, a member of a local authority is disqualified from being appointed as the Commissioner or Deputy Commissioner.

(2)

If a Judge is appointed as the Commissioner or Deputy Commissioner,—

(a)

the appointment does not affect his or her the Judge’s tenure of judicial office, rank, title, status, precedence, salary, annual or other allowances, or other rights or privileges as a Judge (including those in relation to superannuation); and

(b)

for all purposes, the Judge’s service as Commissioner or Deputy Commissioner must be taken to be service as a Judge.

Compare: 1993 No 28 s 19

13 Superannuation or retiring allowances

(1)

For the purpose of providing superannuation or retiring allowances for the Commissioner or Deputy Commissioner, the Commissioner may, out of the funds of the Commissioner, make payments to or subsidise any retirement scheme (within the meaning of section 6(1) of the Financial Markets Conduct Act 2013).

(2)

Subsections (3) to (5) apply to a person who, immediately before being appointed as the Commissioner or the Deputy Commissioner or, as the case may be, becoming an employee of the Commissioner, is a contributor to the Government Superannuation Fund under Part 2 or 2A of the Government Superannuation Fund Act 1956 (the 1956 Act).

(3)

The person is, for the purposes of the 1956 Act, to be treated as if he or she the person continues to be employed in the Government service while the person is the Commissioner or Deputy Commissioner or, as the case may be, an employee of the Commissioner.

(4)

However, if the person ceases to be a contributor to the Government Superannuation Fund after his or her their appointment or employment, the person may not resume making contributions to the Fund.

(5)

For the purposes of applying the 1956 Act to a person under this section, controlling authority, in relation to the person, means the Commissioner.

Compare: 1993 No 28 Schedule 1 cl 4

Subpart 2—Functions of Privacy Commissioner

14 Functions of Commissioner

(1)

The functions of the Commissioner are—

(a)

to exercise the powers, and carry out the functions and duties, conferred on the Commissioner by or under this Act or any other enactment:

(b)

to provide advice (with or without a request) to a Minister, a Parliamentary Under-Secretary or an agency on any matter relevant to the operation of this Act:

(c)

to promote, by education and publicity, an understanding and acceptance of the information privacy principles and of the objectives of those principles:

(ca)

to assist with the operation of IPP 12:

(d)

to make public statements in relation to any matter affecting the privacy of individuals:

(e)

to receive and invite representations from members of the public on any matter affecting the privacy of individuals:

(f)

to consult and co-operate with other persons and bodies concerned with the privacy of individuals:

(g)

to examine any proposed legislation (including subordinate legislation) or proposed government policy that the Commissioner considers may affect the privacy of individuals, including any proposed legislation that makes provision for either or both of the following:

(i)

the collection of personal information by a public sector agency:

(ii)

the sharing of personal information between public sector agencies:

(h)

to monitor the use of unique identifiers:

(i)

to inquire generally into any matter, including any other enactment or any law, or any practice, or procedure, whether governmental or non-governmental, or any technical development, if it appears to the Commissioner that the privacy of individuals is being, or may be, infringed (for powers of the Commissioner in relation to inquiries, see section 203):

(j)

to undertake research into, and to monitor developments in, data processing and technology to ensure that any adverse effects of the developments on the privacy of individuals are minimised:

(k)

to give advice to any person in relation to any matter that concerns the need for, or desirability of, action by that person in the interests of the privacy of individuals:

(l)

when requested to do so by an agency, to conduct an audit of personal information maintained by that agency for the purpose of ascertaining whether the information is maintained according to the information privacy principles:

(la)

to monitor the operation of this Act and consider whether any amendments to this Act are necessary or desirable:

(m)

to report to the responsible Minister on the results of

(i)

the results of any examination conducted under paragraph (g):

(ii)

the results of the monitoring undertaken under paragraph (h):

(iii)

the results of the research and monitoring undertaken under paragraph (j):

(iv)

the monitoring and consideration undertaken under paragraph (la):

(n)

to report to the Prime Minister on—

(i)

any matter affecting the privacy of individuals, including the need for, or desirability of, taking legislative, administrative, or other action to give protection or better protection to the privacy of individuals:

(ii)

the desirability of New Zealand accepting any international instrument relating to the privacy of individuals:

(iii)

any other matter relating to the privacy of individuals that, in the Commissioner’s opinion, should be drawn to the Prime Minister’s attention:

(o)

to gather any information that will assist in carrying out the functions in paragraphs (a) to (n).

(2)

The Commissioner may at any time, if it is in the public interest or in the interests of any person or body of persons to do so, publish—

(a)

reports relating generally to the performance of the Commissioner’s functions under this Act:

(b)

reports relating to any case or cases investigated by the Commissioner.

(3)

Subsection (2) applies regardless of whether the matters to be dealt with in a report under that subsection have been the subject of a report to the responsible Minister or the Prime Minister.

Compare: 1993 No 28 ss 13(1), (2), 26(1)

15 Commissioner to monitor operation of Act

The Commissioner must

(a)

monitor the operation of this Act; and

(b)

consider whether any amendments to this Act are necessary or desirable; and

(c)

report to the responsible Minister at any time on the results of the monitoring and on any amendments considered necessary or desirable.

Compare: 1993 No 28 s 26(1)

16 Responsible Minister must present to House of Representatives copy of report under section 15 on operation of Act to House of Representatives

As soon as practicable after receiving a report under section 15 14(1)(m)(iv), the responsible Minister must present a copy of the report to the House of Representatives.

Compare: 1993 No 28 s 26(2)

17 Duty to act independently

The Commissioner must act independently in performing his or her statutory functions and duties, and exercising his or her statutory powers, under—

(a)

this Act; and

(b)

any other Act that expressly provides for the functions, powers, or duties of the Commissioner (other than the Crown Entities Act 2004).

Compare: 1993 No 28 s 13(1A)

18 Commissioner to have regard to certain matters

In The Commissioner must, in performing any statutory function or duty, his or her functions and duties, and in exercising his or her powers, under this Act, the Commissioner must any statutory power,

(a)

have regard to the privacy interests of individuals alongside other human rights and interests, including—

(i)

the desirability of facilitating the free flow of information in society; and

(ii)

government and businesses being able to achieve their objectives efficiently; and

(b)

take account of international obligations accepted by New Zealand, including those concerning the international technology of communications; and

(c)

take account of cultural perspectives on privacy; and

(d)

consider any developing general international guidelines relevant to the better protection of individual privacy; and

(e)

have regard to the IPPs and PRPPs.

Compare: 1993 No 28 s 14

Part 3 Information privacy principles, public register privacy principles and codes of practice

Subpart 1—Information privacy principles

19 Information privacy principles

The information privacy principles are as follows:

Information privacy principle 1
Purpose of collection of personal information
(1)

Personal information must not be collected by an agency unless—

(a)

the information is collected for a lawful purpose connected with a function or an activity of the agency; and

(b)

the collection of the information is necessary for that purpose.

(2)

If the lawful purpose for which personal information about an individual is collected does not require the collection of an individual’s identifying information, the agency may not require the individual’s identifying information.

 
Information privacy principle 2
Source of personal information
(1)

If an agency collects personal information, the information must be collected from the individual concerned.

(2)

It is not necessary for an agency to comply with subclause (1) if the agency believes, on reasonable grounds,—

(a)

that non-compliance would not prejudice the interests of the individual concerned; or

(b)

that compliance would prejudice the purposes of the collection; or

(c)

that the individual concerned authorises collection of the information from someone else; or

(d)

that the information is publicly available information; or

(e)

that non-compliance is necessary—

(i)

to avoid prejudice to the maintenance of the law by any public sector agency, including prejudice to the prevention, detection, investigation, prosecution, and punishment of offences; or

(ii)

for the enforcement of a law that imposes a pecuniary penalty; or

(iii)

for the protection of public revenue; or

(iv)

for the conduct of proceedings before any court or tribunal (being proceedings that have been commenced or are reasonably in contemplation); or

(v)

to prevent or lessen a serious threat to the life or health of the individual concerned or any other individual; or

(f)

that compliance is not reasonably practicable in the circumstances of the particular case; or

(g)

that the information—

(i)

will not be used in a form in which the individual concerned is identified; or

(ii)

will be used for statistical or research purposes and will not be published in a form that could reasonably be expected to identify the individual concerned.

 
Information privacy principle 3
Collection of information from subject
(1)

If an agency collects personal information from the individual concerned, the agency must take any steps that are, in the circumstances, reasonable to ensure that the individual concerned is aware of—

(a)

the fact that the information is being collected; and

(b)

the purpose for which the information is being collected; and

(c)

the intended recipients of the information; and

(d)

the name and address of—

(i)

the agency that is collecting the information; and

(ii)

the agency that will hold the information; and

(e)

if the collection of the information is authorised or required by or under law,—

(i)

the particular law by or under which the collection of the information is authorised or required; and

(ii)

whether the supply of the information by that individual is voluntary or mandatory; and

(f)

the consequences (if any) for that individual if all or any part of the requested information is not provided; and

(g)

the rights of access to, and correction of, personal information provided by the IPPs.

(2)

The steps referred to in subclause (1) must be taken before the information is collected or, if that is not practicable, as soon as practicable after the information is collected.

(3)

An agency is not required to take the steps referred to in subclause (1) in relation to the collection of information from an individual if the agency has taken those steps on a recent previous occasion in relation to the collection, from that individual, of the same information or information of the same kind.

(4)

It is not necessary for an agency to comply with subclause (1) if the agency believes, on reasonable grounds,—

(a)

that non-compliance would not prejudice the interests of the individual concerned; or

(b)

that non-compliance is necessary—

(i)

to avoid prejudice to the maintenance of the law by any public sector agency, including prejudice to the prevention, detection, investigation, prosecution, and punishment of offences; or

(ii)

for the enforcement of a law that imposes a pecuniary penalty; or

(iii)

for the protection of public revenue; or

(iv)

for the conduct of proceedings before any court or tribunal (being proceedings that have been commenced or are reasonably in contemplation); or

(c)

that compliance would prejudice the purposes of the collection; or

(d)

that compliance is not reasonably practicable in the circumstances of the particular case; or

(e)

that the information—

(i)

will not be used in a form in which the individual concerned is identified; or

(ii)

will be used for statistical or research purposes and will not be published in a form that could reasonably be expected to identify the individual concerned.

 
Information privacy principle 4
Manner of collection of personal information
(1)

An agency may collect personal information only—

(a)

by a lawful means; and

(b)

by a means that, in the circumstances of the case (having regard particularly to the age of the individual concerned),—

(i)

is fair; and

(ii)

does not intrude to an unreasonable extent upon the personal affairs of the individual concerned.; and

(2)

When collecting personal information from children and young persons, an agency must take into account their vulnerability.

Information privacy principle 5
Storage and security of personal information

An agency that holds personal information must ensure—

(a)

that the information is protected, by such security safeguards as it is are reasonable in the circumstances to take, against—

(i)

loss; and

(ii)

access, use, modification, or disclosure that is not authorised by the agency; and

(iii)

other misuse; and

(b)

that, if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency is done to prevent unauthorised use or unauthorised disclosure of the information.

 
Information privacy principle 6
Access to personal information
(1)

If an agency holds personal information, an individual is entitled to receive from the agency

(a)

confirmation of whether the agency holds any personal information about him or her:

(b)

access to his or her personal information.

(1)An individual is entitled to receive from an agency upon request
(a)confirmation of whether the agency holds any personal information about them; and
(b)access to their personal information.
(2)

If an individual concerned is given access to personal information, the individual must be advised that, under IPP 7, the individual may request the correction of that information.

(3)

This principle is subject to the provisions of Part 4.

 
Information privacy principle 7
Correction of personal information
(1)

If an agency holds personal information,

(a)

an individual concerned is entitled to request the agency to correct the information:

(b)

the agency, on its own initiative, may correct the information.

(2)

At the time of making a request under subclause (1)(a), or at any later time, the individual concerned is entitled to

(a)

provide to the agency a statement of the correction sought to the information; and

(b)

request the agency to attach the statement to the information if the agency is not willing to make the correction sought.

(1)An individual whose personal information is held by an agency is entitled to request the agency to correct the information.
(2)An agency that holds personal information must, on request or on its own initiative, take such steps (if any) that are reasonable in the circumstances to ensure that, having regard to the purposes for which the information may lawfully be used, the information is accurate, up to date, complete, and not misleading.
(2A)When requesting the correction of personal information, or at any later time, an individual is entitled to
(a)provide the agency with a statement of the correction sought to the information (a statement of correction); and
(b)request the agency to attach the statement of correction to the information if the agency does not make the correction sought.
(2B)If an agency that holds personal information is not willing to correct the information as requested and has been provided with a statement of correction, the agency must take such steps (if any) that are reasonable in the circumstances to ensure that the statement of correction is attached to the information in a manner that ensures that it will always be read with the information.
(3)

If an agency corrects personal information or attaches a statement of correction to personal information, that agency must, so far as is reasonably practicable, inform every other agency person to whom the agency has disclosed the personal information.

(4)

Subclauses (1) and (2) to (2B) are subject to the provisions of Part 4.

 
Information privacy principle 8
Accuracy, etc, of personal information to be checked before use or disclosure

An agency that holds personal information must not use or disclose that information without taking any steps that are, in the circumstances, reasonable to ensure that the information is accurate, up to date, complete, relevant, and not misleading.

 
Information privacy principle 9
Agency not to keep personal information for longer than necessary

An agency that holds personal information must not keep that information for longer than is required for the purposes for which the information may lawfully be used.

 
Information privacy principle 10
Limits on use of personal information
(1)

An agency that holds personal information that was obtained in connection with one purpose may not use the information for any other purpose unless the agency believes, on reasonable grounds,—

(a)

that the purpose for which the information is to be used is directly related to the purpose in connection with which the information was obtained; or

(b)

that the information—

(i)

is to be used in a form in which the individual concerned is not identified; or

(ii)

is to be used for statistical or research purposes and will not be published in a form that could reasonably be expected to identify the individual concerned; or

(c)

that the use of the information for that other purpose is authorised by the individual concerned; or

(d)

that the source of the information is a publicly available publication and that, in the circumstances of the case, it would not be unfair or unreasonable to use the information; or

(e)

that the use of the information for that other purpose is necessary—

(i)

to avoid prejudice to the maintenance of the law by any public sector agency, including prejudice to the prevention, detection, investigation, prosecution, and punishment of offences; or

(ii)

for the enforcement of a law that imposes a pecuniary penalty; or

(iii)

for the protection of public revenue; or

(iv)

for the conduct of proceedings before any court or tribunal (being proceedings that have been commenced or are reasonably in contemplation); or

(f)

that the use of the information for that other purpose is necessary to prevent or lessen a serious threat to—

(i)

public health or public safety; or

(ii)

the life or health of the individual concerned or another individual.

(2)

In addition to the uses authorised by subclause (1), an intelligence and security agency that holds personal information that was obtained in connection with one purpose may use the information for any other purpose (a secondary purpose) if the agency believes on reasonable grounds that the use of the information for the secondary purpose is necessary to enable the agency to perform any of its functions.

 
Information privacy principle 11
Limits on disclosure of personal information
(1)

An agency that holds personal information must not disclose the information to any other agency or to any person unless the agency believes, on reasonable grounds,—

(a)

that the disclosure of the information is one of the purposes in connection with which the information was obtained or is directly related to the purposes in connection with which the information was obtained; or

(b)

that the disclosure is to the individual concerned; or

(c)

that the disclosure is authorised by the individual concerned; or

(d)

that the source of the information is a publicly available publication and that, in the circumstances of the case, it would not be unfair or unreasonable to disclose the information; or

(e)

that the disclosure of the information is necessary—

(i)

to avoid prejudice to the maintenance of the law by any public sector agency, including prejudice to the prevention, detection, investigation, prosecution, and punishment of offences; or

(ii)

for the enforcement of a law that imposes a pecuniary penalty; or

(iii)

for the protection of public revenue; or

(iv)

for the conduct of proceedings before any court or tribunal (being proceedings that have been commenced or are reasonably in contemplation); or

(f)

that the disclosure of the information is necessary to prevent or lessen a serious threat to—

(i)

public health or public safety; or

(ii)

the life or health of the individual concerned or another individual; or

(g)

that the disclosure of the information is necessary to enable an intelligence and security agency to perform any of its functions; or

(h)

that the information—

(i)

is to be used in a form in which the individual concerned is not identified; or

(ii)

is to be used for statistical or research purposes and will not be published in a form that could reasonably be expected to identify the individual concerned; or

(i)

that the disclosure of the information is necessary to facilitate the sale or other disposition of a business as a going concern.

(2)

Without limiting the generality of subclause (1)(e)(i), an example of disclosure under that subclause is reporting to the New Zealand Police a reasonably held belief that an offence has been, or may be, committed.

(3)

An agency (A) may not disclose personal information to an overseas person (B) in reliance on subclause (1)(a), (c), (e), (f), (h), or (i) unless

(a)

section 8 applies to A and B; or

(b)

the individual concerned authorises the disclosure of the information to B; or

(c)

B is in a prescribed country or State; or

(d)

A believes on reasonable grounds that B is required to protect the information in a way that, overall, provides comparable safeguards to those in this Act.

(4)

However, subclause (3) does not apply if the personal information is to be disclosed to an overseas person in reliance on subclause (1)(e) or (f) and it is not reasonably practicable in the circumstances for A to comply with the requirements of subclause (3).

(5)

Without limiting the generality of subclause (3)(d), an example of A having the necessary belief on reasonable grounds is A having entered into an agreement with B that provides comparable safeguards to those in this Act.

(6)

In this principle,

overseas person means a person outside New Zealand who is not subject to this Act

prescribed country or State means a country or State that is specified in regulations as having privacy laws comparable to those of New Zealand.

(2)This principle is subject to IPP 12.
 
Information privacy principle 12
Disclosure of personal information outside New Zealand
(1)

An agency (A) may disclose personal information to a foreign person or entity (B) in reliance on IPP 11(1)(a), (c), (e), (f), (h), or (i) only if

(a)

the individual concerned authorises the disclosure to B after being expressly informed by A that B may not be required to protect the information in a way that, overall, provides comparable safeguards to those in this Act; or

(b)

B is carrying on business in New Zealand and, in relation to the information, A believes on reasonable grounds that B is subject to this Act; or

(c)

A believes on reasonable grounds that B is subject to privacy laws that, overall, provide comparable safeguards to those in this Act; or

(d)

A believes on reasonable grounds that B is a participant in a prescribed binding scheme; or

(e)

A believes on reasonable grounds that B is subject to privacy laws of a prescribed country; or

(f)

A otherwise believes on reasonable grounds that B is required to protect the information in a way that, overall, provides comparable safeguards to those in this Act (for example, pursuant to an agreement entered into between A and B).

(2)However, subclause (1) does not apply if the personal information is to be disclosed to B in reliance on IPP 11(1)(e) or (f) and it is not reasonably practicable in the circumstances for A to comply with the requirements of subclause (1).
(3)In this principle,

binding scheme means an internationally recognised scheme in which the participants agree to be bound by

(a)

specified measures for protecting personal information that is collected, held, used, and disclosed; and

(b)

mechanisms for enforcing compliance with those measures

foreign person or entity means

(a)

an individual who is not ordinarily resident in New Zealand:

(b)

a body, incorporated or unincorporated, that

(i)

is not established under the law of New Zealand; and

(ii)

does not have its central control and management in New Zealand:

(c)

the Government of an overseas country

prescribed binding scheme means a binding scheme specified in regulations made under section 212A

prescribed country means a country specified in regulations made under section 212B.

Information privacy principle 12 13
Unique identifiers
(1)

An agency (Agency A) may assign a unique identifier to an individual for use in its operations only if that identifier is necessary to enable Agency A to carry out 1 or more of its functions efficiently.

(2)

Agency A may not assign to an individual a unique identifier that, to Agency A’s knowledge, is the same unique identifier as has been assigned to that individual by another agency (Agency B), unless—

(a)Agency A and Agency B are associated persons within the meaning of subpart YB of the Income Tax Act 2007; or
(b)the unique identifier is to be used by Agency A for statistical or research purposes and no other purpose.
(3)To avoid doubt, Agency A does not assign a unique identifier to an individual under subsection (1) by simply recording a unique identifier assigned to the individual by Agency B for the sole purpose of communicating with Agency B about the individual.
(4)

Agency A must take all reasonable steps to ensure that a unique identifier is assigned only to an individual whose identity is clearly established.

(4)A must take any steps that are, in the circumstances, reasonable to ensure that
(a)a unique identifier is assigned only to an individual whose identity is clearly established; and
(b)the risk of misuse of a unique identifier by any person is minimised (for example, by showing truncated account numbers on receipts or in correspondence).
(5)

Before disclosing a unique identifier to another agency, Agency A must take all reasonable steps to minimise the risk of misuse of the unique identifier by that other agency or any other person.

(6)

An agency may not require an individual to disclose any unique identifier assigned to that individual unless the disclosure is for one of the purposes in connection with which that unique identifier was assigned or is for a purpose that is directly related to one of those purposes.

Compare: 1993 No 28 s 6

20 Application of IPPs to personal information held overseas

(1)

For the purposes of IPP 5 and IPPs 8 to 11, personal information held by an agency includes personal information that is held outside New Zealand by that agency, if the information has been transferred out of New Zealand by that agency or any other agency.

(2)

For the purposes of IPPs 6 and 7, personal information held by an agency includes personal information held outside New Zealand by that agency.

(3)

Nothing in this section applies to render an agency in breach of any of the IPPs in respect of any action that the agency is required to take by or under the law of any place outside New Zealand.

Compare: 1993 No 28 s 10

20 Application of IPPs subject to overseas laws

An action taken by an agency does not breach any of the IPPs if the action is authorised or required by or under the law of any country other than New Zealand.

21 Application of IPPs to public registers

An agency responsible for administering a public register must, in administering that register, comply, so far as is reasonably practicable, with the IPPs.

Compare: 1993 No 28 s 60(1)

22 Relationships between IPPs and other law

(1)

Nothing in IPP 6 or 11 6, 11, or 12 derogates from limits or affects

(a)

a provision contained in any enactment that authorises or requires personal information to be made available; or

(b)

a provision contained in any other Act that—

(i)

imposes a prohibition or restriction in relation to the availability of personal information; or

(ii)

regulates the manner in which personal information may be obtained or made available.

(2)

An action is taken by an agency does not in breach of IPPs 1 to 5, 7 to 10, or 12 1 to 5, 7 to 10, or 13 if the action is authorised or required by or under law.

Compare: 1993 No 28 s 7(1), (2), (4)

23 Exemptions relating to IPPs 1 to 4 and 12 13

(1)

IPPs 1 to 4 apply only to personal information collected after 2 July 1993.

(2)

IPP 12 13(1) to (4) apply applies only to the assignment of unique identifiers after 2 July 1993.

(3)

IPP 12 13(2) applies to the assignment of a unique identifier after 2 July 1993 where the assignment is in respect of a unique identifier that is the same as that assigned by another agency before or after that date.

Compare: 1993 No 28 s 8(1), (5)

24 Exemption for personal information relating to personal or domestic affairs

(1)

IPPs 1 to 3 and 4(b) do not apply to an agency if that agency—

(a)

is an individual; and

(b)

is collecting personal information solely for the purposes of, or in connection with, his or her the individual’s personal or domestic affairs.

(2)

IPPs 5 to 11 12 do not apply to an agency if that agency—

(a)

is an individual; and

(b)

is holding personal information that was collected by a lawful means solely for the purposes of, or in connection with, his or her the individual’s personal or domestic affairs.

(3)

However, the exemptions in subsections (1) and (2) do not apply if

(a)

the personal information is, or was, collected by engaging in misleading or deceptive conduct, or conduct likely to mislead or deceive; or

(b)

the collection, use, or disclosure of the personal information would be highly offensive to a reasonable person.

(3)

However, the exemptions in subsections (1) and (2) do not apply if the collection, use, or disclosure of the personal information would be highly offensive to a reasonable person.

Compare: 1993 No 28 s 56

25 Exemption for intelligence and security agencies

IPPs 2, 3, and 4(b) do not apply to information collected by an intelligence and security agency.

Compare: 1993 No 28 s 57

26 Certain personal information exempt from IPPs 6 and 7

(1)

IPPs 6 and 7 do not apply in respect of—

(a)

personal information during transmission by post, personal delivery, or electronic means; or

(b)

personal information that is contained in any correspondence or communication between an agency and any of the following persons and that relates to an investigation conducted by that person under any Act, not being information that was in existence before the commencement of the investigation:

(i)

an Ombudsman:

(ii)

any officer or employee appointed by the Chief Ombudsman under section 11(1) of the Ombudsmen Act 1975:

(iii)

the Commissioner:

(iv)

any employee or delegate of the Commissioner; or

(c)

personal information held by the Auditor-General, the Deputy Auditor-General, or any employee of the Auditor-General in connection with the performance or exercise of the Auditor-General’s functions, duties, or powers that is not personal information about any employee or former employee of the Auditor-General in their capacity as an employee; or

(d)

personal information contained in evidence given or submissions made to—

(i)

a government inquiry, until the final report of that inquiry is presented to the appointing Minister:

(ii)

a public inquiry (including a Royal commission), until the final report of that inquiry is presented to the House of Representatives:

(iii)

a person or body appointed under any Act to inquire into a specified matter; or

(e)

personal information contained in a video record made under the Evidence Regulations 2007 or any copy or transcript of the video record.

(2)

IPP 7 does not apply to personal information collected by Statistics New Zealand under the Statistics Act 1975.

Compare: 1993 No 28 ss 7(5), 55

27 Commissioner may authorise collection, use, storage, or disclosure of personal information otherwise in breach of IPP 2, 9, 10, or 11 2 or IPPs 9 to 12

(1)

An agency may apply to the Commissioner for authorisation to do any of the following in the circumstances of a particular case:

(a)

collect personal information even if the collection of that information would otherwise be in breach of IPP 2:

(b)

keep personal information even if the keeping of that information would otherwise be in breach of IPP 9:

(c)

use personal information even if the use of that information would otherwise be in breach of IPP 10:

(d)

disclose personal information even if the disclosure of that information would otherwise be in breach of IPP 11 11 or 12.

(2)

An application under subsection (1) must be made in the manner required by the Commissioner.

(3)

If, on receiving an application, the Commissioner is not satisfied that the applicant has taken sufficient steps to give notice of the application to all individuals concerned, the Commissioner may require the applicant to give public notice of the application in a manner that the Commissioner specifies.

(4)

If, on receiving an application, the Commissioner is not satisfied that the applicant has given sufficient opportunity to individuals concerned to object to the application, the Commissioner may require the applicant to give any further opportunity that the Commissioner specifies.

(5)

In considering whether to grant an authorisation, the Commissioner must take into account any objections to the application received from individuals concerned.

(6)

The Commissioner may grant an authorisation sought by an applicant only if the Commissioner is satisfied that, in the special circumstances of the case,—

(a)

the public interest in granting the authorisation outweighs, to a substantial degree, the possibility of—

(i)

any loss, detriment, damage, or injury to the individuals concerned; or

(ii)

any adverse affect on the rights, benefits, privileges, obligations, or interests of the individuals concerned; or

(iii)

any significant humiliation, significant loss of dignity, or significant injury to the feelings of the individuals concerned; or

(b)

granting the authorisation would result in a clear benefit to the individuals concerned that outweighs the possibility of—

(i)

any loss, detriment, damage, or injury to the individuals concerned; or

(ii)

any adverse affect on the rights, benefits, privileges, obligations, or interests of the individuals concerned; or

(iii)

any significant humiliation, significant loss of dignity, or significant injury to the feelings of the individuals concerned.

(7)

The Commissioner may not grant an authorisation under subsection (6) in respect of any specified personal information if the individual concerned objected.

(8)

An authorisation granted under subsection (6) may be given subject to any conditions that the Commissioner thinks fit considers appropriate.

(9)

The Commissioner must maintain on the Commissioner’s Internet site a list of current authorisations granted under this section.

Compare: 1993 No 28 s 54

28 Enforceability of IPPs

(1)

Except as provided in subsection (2), the IPPs do not confer on any person any right that is enforceable in a court of law.

(2)

The entitlements conferred on an individual by IPP 6(1), to the extent that those entitlements relate to personal information held by a public sector agency, are legal rights and are enforceable in a court of law.

Compare: 1993 No 28 s 11

Subpart 2Public register privacy principles

29 Interpretation

In this subpart, unless the context otherwise requires,

public register means any register, roll, list, or other document maintained under a public register provision

public register provision means a provision specified in the second column of Schedule 2 as a public register provision of an enactment specified in the first column of that schedule.

Compare: 1993 No 28 s 58

30 Public register privacy principles

The public register privacy principles are as follows:

Public register privacy principle 1
Search references

Personal information must be made available from a public register only by search references that are consistent with the manner in which the register is indexed or organised.

Public register privacy principle 2
Use of information from public registers

Personal information obtained from a public register must not be re-sorted, or combined with personal information obtained from any other public register, for the purpose of making available for valuable consideration personal information assembled in a form in which that personal information could not be obtained directly from the register.

Public register privacy principle 3
Electronic transmission of personal information from register

Personal information in a public register must not be made available by means of electronic transmission unless the purpose of the transmission is to make the information available to a member of the public who wishes to search the register.

Public register privacy principle 4
Charging for access to public register

Personal information must be made available from a public register for no charge or for no more than a reasonable charge.

Compare: 1993 No 28 s 59

31 Compliance with PRPPs

(1)

The agency responsible for administering a public register must, in administering the register, comply so far as is reasonably practicable with the PRPPs.

(2)

A person that is not an agency responsible for administering a public register must, so far as is reasonably practicable, comply with PRPP 2.

Compare: 1993 No 28 s 60(1), (2)

32 Relationship between PRPPs and other laws

If a PRPP is inconsistent with any enactment, then, to the extent that it is inconsistent, the enactment prevails.

Compare: 1993 No 28 s 60(3)

33 Enforceability of PRPPs

The PRPPs do not confer on any person any right that is enforceable in a court of law.

Compare: 1993 No 28 s 62

34 Power to amend Schedule 2 by Order in Council

The Governor-General may, by Order in Council made on the recommendation of the responsible Minister given after consultation with the Commissioner, amend Schedule 2 by inserting any item.

Compare: 1993 No 28 s 65(1)

Subpart 3—Codes of practice

35 Codes of practice in relation to IPPs

(1)

The Commissioner may at any time issue a code of practice in relation to the IPPs.

(2)

A code of practice may—

(a)

modify the application of 1 or more of the IPPs by—

(i)

prescribing more stringent or less stringent standards:

(ii)

exempting any action from an IPP, either unconditionally or conditionally:

(b)

apply 1 or more of the IPPs without modification:

(c)

prescribe how 1 or more of the IPPs are to be applied or complied with.

(3)

A code of practice may apply in relation to 1 or more of the following:

(a)

any specified information or class or classes of information:

(b)

any specified agency or class or classes of agency:

(c)

any specified activity or class or classes of activity:

(d)

any specified industry, profession, or calling or class or classes of industry, profession, or calling.

(4)

A code of practice may also—

(a)

impose, in relation to any private sector agency, controls in relation to the comparison (whether done manually or by means of any electronic or other device) of personal information with other personal information for the purpose of producing or verifying information about an identifiable individual:

(b)

in relation to charging under section 72,—

(i)

set guidelines to be followed by agencies in determining charges:

(ii)

prescribe circumstances in which no charge may be imposed:

(c)

prescribe procedures for dealing with complaints alleging a breach of the code, without limiting or restricting any provision of Part 5:

(d)

provide for the review of the code by the Commissioner:

(e)

provide for the expiry of the code.

(5)

A code of practice may not limit or restrict the entitlements under IPP 6 or 7.

(6)

Despite the definition of the term individual in section 6(1),—

(a)

a sector-specific code of practice may be issued that applies 1 or more of the IPPs to information about deceased persons (whether or not the code also applies 1 or more of the IPPs to other information); and

(b)

the code of practice has effect under section 43 as if those IPPs so applied, and the provisions of this Act apply accordingly.

Compare: 1993 No 28 s 46

36 Codes of practice in relation to public registers

(1)

The Commissioner may at any time issue, in relation to any public register, a code of practice.

(2)

A code of practice issued under this section may

(a)

modify the application, in relation to a public register, of 1 or more of the PRPPs, or 1 or more of the IPPs, or both, by

(i)

prescribing more stringent or less stringent standards:

(ii)

exempting any action from a PRPP or an IPP, either unconditionally or conditionally:

(b)

prescribe how 1 or more of the PRPPs, or 1 or more of the IPPs, or both, are to be applied or complied with:

(c)

impose requirements that are not prescribed by any PRPP.

(3)

A code of practice issued under this section may also provide for

(a)

the review of the code by the Commissioner:

(b)

the expiry of the code.

Compare: 1993 No 28 s 63(1)(3)

37 Relationship between codes and other law

If a code of practice is inconsistent with any enactment, then, to the extent that it is inconsistent, the enactment prevails.

Compare: 1993 No 28 s 63(4)

38 Issue of code of practice

(1)

The Commissioner may issue a code of practice under section 35 or 36 on—

(a)

the Commissioner’s own initiative; or

(b)

the application of any person.

(2)

An application may be made under subsection (1)(b) only—

(a)

by a body that represents the interests of any class or classes of agency, industry, profession, or calling (a group); and

(b)

if the code of practice sought by the applicant is intended to apply to that group, or any activity of the group.

(3)

Before issuing a code of practice, the Commissioner must—

(a)

give public notice of the Commissioner’s intention to issue the code and include a statement that—

(i)

the details of the proposed code, including a draft of the proposed code, may be obtained from the Commissioner; and

(ii)

submissions on the proposed code may be made in writing to the Commissioner within the period specified in the notice; and

(b)

do everything reasonably possible to advise all persons affected by the proposed code, or the representatives of those persons, of—

(i)

the details of the proposed code; and

(ii)

the reasons for the proposed code; and

(c)

give the persons affected by the code, or the representatives of those persons, the opportunity to make submissions on the proposed code; and

(d)

consider any submissions made on the proposed code.

(4)

Publication in the Gazette of a notice under subsection (3)(a) is conclusive proof that the requirements of that provision have been complied with in respect of the code of practice to which the notice relates.

Compare: 1993 No 28 ss 47(1), (3), (4), 48(1), (2)

39 Urgent issue of code of practice

(1)

If the Commissioner considers that it is necessary to issue a code of practice, or to amend or revoke any code of practice, and that following the procedure set out in section 38(3) would be impracticable because it is necessary to issue the code or, as the case may be, the amendment or revocation urgently, the Commissioner may issue the code of practice or, as the case may be, the amendment or revocation without complying with that procedure.

(2)

Every code of practice, and every amendment to or revocation of a code of practice, issued in accordance with this section,—

(a)

must be identified as a temporary code or amendment or revocation; and

(b)

remains in force for the period (not exceeding 1 year after the date of its issue) specified for that purpose in the code or, as the case may be, the amendment or the revocation.

(3)

Nothing in sSection 40(2) applies in respect of does not apply to a code of practice, or any amendment to or revocation of a code of practice, issued in accordance with this section.

Compare: 1993 No 28 s 52

40 Notification, availability, and commencement of codes of practice

(1)

If the Commissioner issues a code of practice is issued under section 35 or 36,—

(a)

the Commissioner must, as soon as practicable after the code is issued, ensure that there a notice is published in the Gazette, as soon as practicable after the code is issued, a notice that—

(i)

states that the code has been issued; and

(ii)

specifies a place at which copies of the code are available for inspection free of charge and for purchase; and

(b)

the Commissioner must ensure that, so long as the code remains in force, the code is publicly available on an Internet site maintained by or on behalf of the Commissioner, and that copies of the code are available—

(i)

for inspection by members of the public free of charge; and

(ii)

for purchase by members of the public at a reasonable price.

(2)

Every A code of practice must comes into force on the 28th day after the date of its notification in the Gazette or on any later day that is specified in the code.

Compare: 1993 No 28 s 49

41 Application of Legislation Act 2012 to codes of practice

All codes of practice are disallowable instruments, but not legislative instruments, for the purposes of the Legislation Act 2012 and must be presented to the House of Representatives under section 41 of that Act.

Compare: 1993 No 28 s 50

42 Amendment and revocation of codes of practice

(1)

The Commissioner may at any time issue an amendment or a revocation of a code of practice.

(2)

The provisions of sections 38, 40, and 41 apply in respect of any amendment or revocation of a code of practice.

Compare: 1993 No 28 s 51

43 Effect of codes of practice

If a code of practice issued under section 35 is in force,—

(a)

any action that would otherwise be a breach of an IPP is, for the purposes of Part 5, treated as not breaching that IPP if the action complies with the code; and

(b)

failure to comply with the code, even if the failure would not otherwise be a breach of any IPP, is, for the purposes of Part 5, treated as breaching a breach of an IPP.

(2)

If a code of practice issued under section 36 is in force, the doing of any action that would otherwise be a breach of a PRPP or an IPP is, for the purposes of Part 5, treated as not breaching that IPP or PRPP if the action is done in compliance with the code.

(3)

If a code of practice issued under section 36 modifies a PRPP and is in force, failure to comply with the code, even if the failure would not otherwise be a breach of any PRPP, is, for the purposes of Part 5, treated as breaching an PRPP.

(4)

If a code of practice issued under section 36 modifies an IPP and is in force, failure to comply with the code, even if the failure would not otherwise be a breach of any IPP, is, for the purposes of Part 5, treated as breaching an IPP.

Compare: 1993 No 28 ss 53, 64(a)

Part 4 Access to and correction of personal information

Subpart 1—Access to personal information

44 Interpretation

(1)

In this subpart and subpart 3, access request means

(a)

a request made under IPP 6(1)(a) to confirm that an agency holds personal information about a requestor; or

(b)

a request made under IPP 6(1)(b) to access personal information held by an agency about the requestor; or

(c)

a request made under IPP 6(1)(a) and (b).

(2)

In this subpart, requestor, in relation to an access request, means the individual who makes the request.

(1)

In this subpart and subpart 3, IPP 6 request means a request made under IPP 6.

(2)

In this subpart, requestor, in relation to an IPP 6 request, means the individual who made the request.

Compare: 1993 No 28 s 33

45 Individuals may make access IPP 6 request

An access IPP 6 request may be made only by a requestor who is an individual the individual concerned.

Compare: 1993 No 28 s 34

46 Urgency

(1)

A requestor may ask that an access IPP 6 request be treated as urgent (an urgent access IPP 6 request).

(2)

A requestor making an urgent access IPP 6 request must state the reason why the request should be treated as urgent.

(3)

On receiving an urgent access IPP 6 request, an agency must consider the request and the reason stated for its urgency when determining the priority to be given to responding to it.

Compare: 1993 No 28 s 37

47 Assistance

Every An agency must give reasonable assistance to an individual who—

(a)

wishes to make an access IPP 6 request; or

(b)

is making an access IPP 6 request.

Compare: 1993 No 28 s 38

48 Transfer of access IPP 6 request

(1)

This section applies if an agency that receives an access IPP 6 request—

(a)

does not hold the information to which the request relates, but believes that the information is held by another agency; or

(b)

believes that the request information to which the request relates is more closely connected with the functions or activities of another agency.

(2)

The agency must promptly, and in any case not later than 10 working days after the day on which the access IPP 6 request is received, transfer the request to the other agency and inform the requestor accordingly.

(3)

However, subsection (2) does not apply if the agency has good cause to believe that the requestor does not want the request transferred to another agency.

(4)

If, in reliance on subsection (3), the agency does not transfer the request, the agency must promptly, and in any case not later than 10 working days after the day on which the access IPP 6 request was received, inform the requestor that—

(a)

this section applies in respect of the request; and

(b)

in reliance on subsection (3), the request has not been transferred; and

(c)

the name of the agency to which the request could be transferred.

Compare: 1993 No 28 s 39

49 Decision on access request under IPP 6(1)(a)

(1)

On receiving an access request made under IPP 6(1)(a) that is not transferred under section 48, an agency must, as soon as is reasonably practicable, and in any case not later than 20 working days after the day on which the request is received, give or send to the requestor a response to the request.

(2)

A response must

(a)

confirm that the agency holds personal information about the requestor; or

(b)

confirm that the agency does not hold personal information about the requestor; or

(c)

state that the agency neither confirms nor denies that it holds personal information about the requestor.

(3)

A response under subsection (2)(c) may be given only if,

(a)

had the request been made under IPP 6(1)(b), the agency would have relied on section 52(1)(a)(i) or (d), 54, 55, or 57(b) to refuse to disclose information, or refuse to disclose information if it existed; and

(b)

the agency is satisfied that, had the request been made under IPP 6(1)(b), the interest protected by any of those provisions would have been likely to be prejudiced by the agency confirming whether or not it held personal information about the requestor.

Compare: 1993 No 28 ss 32, 40(1)

50 Decision on access request under IPP 6(1)(b)

(1)

On receiving an access request made under IPP 6(1)(b) that is not transferred under section 48, an agency must, as soon as is reasonably practicable, and in any case not later than 20 working days after the day on which the request is received, give or send to the requestor a response to his or her request.

(2)

A response must notify the requestor that

(a)

access to the information, or some of the information, requested is granted, and state

(i)

the way the information is to be made available; and

(ii)

the charge (if any) payable under section 72 in respect of the request, and whether all or part of that charge is required to be paid in advance; or

(b)

access to the information, or some of the information, requested is refused; or

(c)

the agency neither confirms nor denies that it holds the information, or some of the information, requested.

(3)

A response under subsection (2)(b) may be given only if the agency is able to rely on any of sections 52 to 57 to refuse access to the information.

(4)

A response under subsection (2)(c) may be given only if the agency

(a)

is able to rely on sections 52(1)(a)(i) or (d), 54, 55, or 57(b) to refuse to disclose the information or refuse to disclose the information if it existed; and

(b)

is satisfied that the interest protected by any of those provisions would be likely to be prejudiced by the agency confirming whether or not it holds personal information about the requestor.

(5)

If an agency decides that a charge is payable in respect of a request, the agency must, at the same time as notifying the requestor of that decision, notify the requestor of his or her right to make a complaint to the Commissioner in respect of the charge.

(6)

After giving a response under subsection (2)(a) and receiving any charge required to be paid in advance, the agency must make available to the requestor the information requested.

Compare: 1993 No 28 ss 30, 32, 40(1), (2)

50 Responding to IPP 6 request

(1)

If an agency does not transfer an IPP 6 request under section 48, the agency must, as soon as is reasonably practicable, and in any case not later than 20 working days after the day on which the request is received, respond to the request.

(2)

A response must notify the requestor that

(a)

the agency does not hold personal information in a way that enables the information to be readily retrieved; or

(b)

the agency does not hold any personal information about the individual to whom the request relates; or

(c)

the agency does hold personal information about the individual to whom the request relates and, if access to the information has been requested, that

(i)

access to that information, or some of that information, is granted; or

(ii)

access to that information, or some of that information, is not granted; or

(d)

the agency neither confirms nor denies that it holds any personal information about the individual to whom the request relates.

50A Decision to grant access to personal information

(1)

If an agency grants access to personal information, the notice under section 50(2)(c)(i) must state

(a)

the way the information is to be made available; and

(b)

the charge (if any) payable under section 72 in respect of the request, and whether all or part of that charge is required to be paid in advance; and

(c)

the requestor’s right to make a complaint to the Commissioner about the charge that is payable (if any).

(2)

After giving notice under section 50(2)(c)(i) and receiving any charge required to be paid in advance, the agency must make the information available to the requestor.

Compare: 1993 No 28 s 40(1), (2)

50B Decision to refuse access to personal information

(1)

An agency may refuse access to the personal information requested, or some of the personal information requested, only if the agency is able to rely on any of sections 52 to 57 (see also section 22).

(2)

The notice given under section 50(2)(c)(ii) must state

(a)

the reason for the refusal; and

(b)

the requestor’s right to make a complaint to the Commissioner in respect of the refusal.

(3)

The notice must also state the grounds in support of the reason for the refusal if

(a)

the reason is that set out in section 53; or

(b)

the reason is not that set out in section 53, but the requestor has requested disclosure of the grounds.

(4)

However,

(a)

subsection (3)(a) does not apply if disclosing the grounds would prejudice the interests protected by section 53:

(b)

subsection (3)(b) does not apply if disclosing the grounds would prejudice the interests protected by any of sections 52, 54, and 57:

(c)

subsection (3)(b) does not apply if disclosing the grounds would prejudice the interests protected by section 55 and the reason for not disclosing those grounds is not outweighed by other considerations that make it desirable, in the public interest, to disclose them.

Compare: 1993 No 28 ss 30, 44

50C Decision to neither confirm nor deny personal information is held

(1)

An agency may neither confirm nor deny that it holds the personal information, or some of the personal information, requested if the agency

(a)

is able to rely on section 52(1)(a)(i) or (d), 54, 55, or 57(b) to refuse to disclose the information or refuse to disclose the information if it existed; and

(b)

is satisfied that the interest protected by any of those provisions would be likely to be prejudiced by the agency confirming whether or not it holds information about the requestor.

(2)

The notice given under section 50(2)(d) must inform the requestor of the requestor’s right to make a complaint to the Commissioner in respect of the agency’s response.

Compare: 1993 No 28 s 32

51 Extension of time limits

(1)

On receiving an access IPP 6 request, an agency may extend the time limit set out in section 48, 49, or 50 in respect of the request if—

(a)

the request is for a large quantity of information, or necessitates a search through a large quantity of information, and meeting the original time limit would unreasonably interfere with the operations of the agency; or

(b)

consultations necessary to make a decision on the request are such that a response to the request cannot reasonably be given within the original time limit; or

(c)

the processing of the request raises issues of such complexity that a response to the request cannot reasonably be given within the original time limit.

(2)

Any extension under subsection (1) must be for a reasonable period of time having regard to the circumstances.

(3)

The extension is effected by giving notice of the extension to the requestor within 20 working days after the day on which the request is received.

(4)

The notice effecting the extension must—

(a)

specify the period of the extension; and

(b)

give the reasons for the extension; and

(c)

state that the requestor has the right to make a complaint to the Commissioner about the extension; and

(d)

contain any other information that may be necessary.

Compare: 1993 No 28 s 41

52 Protection, etc, of individual as reason for refusing request under IPP 6(1)(b) access to personal information

(1)

An agency may refuse access to any personal information requested under IPP 6(1)(b) if—

(a)

the disclosure of the information would—

(i)

be likely to endanger the safety of any individual pose a serious threat to the life, health, or safety of any individual, or to public health or public safety; or

(ii)

create a significant likelihood of serious harassment of an individual; or

(iii)

include disclosure of information about another person who—

(A)

is the victim of an offence or alleged offence; and

(B)

would be caused significant distress, loss of dignity, or injury to feelings by the disclosure of the information; or

(b)

after consultation is undertaken (where practicable) by or on behalf of the agency with the requestor’s health practitioner of the individual concerned, the agency is satisfied that—

(i)

the information relates to the requestor individual concerned; and

(ii)

the disclosure of the information (being information that relates to the physical or mental health of the requestor) would be likely to prejudice the physical or mental health of the requestor individual concerned; or

(c)

in the case of a requestor the individual concerned is under the age of 16, and the disclosure of that the information would be contrary to the requestor’s interests of the individual concerned; or

(d)

the disclosure of that the information (being information in respect of a requestor the individual concerned who has been convicted of an offence or is or has been detained in custody) would be likely to prejudice the safe custody or the rehabilitation of the requestor individual concerned.

(2)

In this section,—

health practitioner means—

(a)

a medical practitioner within the meaning of section 5(1) of the Health Practitioners Competence Assurance Act 2003; or

(b)

a person who is, or is deemed to be, registered with an authority appointed by or under the Health Practitioners Competence Assurance Act 2003 as a practitioner of a particular health profession and whose scope of practice includes the assessment of a person’s mental capacity

medical practitioner means a person who

(a)

is, or is deemed to be, registered with the Medical Council of New Zealand as a practitioner of the profession of medicine; and

(b)

holds a current practising certificate

victim has the meaning given to it in section 8 of the Prisoners’ and Victims’ Claims Act 2005.

Compare: 1993 No 28 ss 27(1)(d), 29(1)(c), (d), (e), (4)

53 Evaluative material as reason for refusing request under IPP 6(1)(b) access to personal information

(1)

An agency may refuse access to any personal information requested under IPP 6(1)(b) if—

(a)

the information is evaluative material and the disclosure of that information or of the information identifying the person who supplied it would breach an express or implied promise—

(i)

that was made to the person who supplied the information; and

(ii)

that was to the effect that the information or the identity of the person who supplied it, or both, would be held in confidence; or

(b)

the information is evaluative material that was made available by the agency to another agency, and that other agency may refuse to disclose the information under paragraph (a).

(2)

In this section, evaluative material

(a)

means evaluative or opinion material compiled by an agency solely—

(i)

for the purpose of determining the suitability, eligibility, or qualifications of the individual to whom the material relates—

(A)

for employment or for appointment to office; or

(B)

for promotion in employment or office or for continuance in employment or office; or

(C)

for removal from employment or office; or

(D)

for the awarding of contracts, awards, scholarships, honours, or other benefits; or

(ii)

for the purpose of determining whether any contract, award, scholarship, honour, or benefit should be continued, modified, or cancelled; or

(iii)

for the purpose of deciding whether to insure any individual or property or to continue or renew the insurance of any individual or property; but

(b)

does not include any evaluative or opinion material described in paragraph (a) that is compiled by a person employed or engaged by the an agency in the ordinary course of that person’s employment or duties.

Compare: 1993 No 28 s 29(1)(b), (3)

54 Security, defence, international relations as reason for refusing request under IPP 6(1)(b) access to personal information

An agency may refuse access to any personal information requested under IPP 6(1)(b) if the disclosure of the information would be likely—

(a)

to prejudice the security or defence of New Zealand or the international relations of the Government of New Zealand; or

(b)

to prejudice the entrusting of information to the Government of New Zealand on a basis of confidence by—

(i)

the Government of any other country or any agency of the Government of any other country; or

(ii)

any international organisation; or

(c)

to prejudice the security or defence of—

(i)

the self-governing State of the Cook Islands; or

(ii)

the self-governing State of Niue; or

(iii)

Tokelau; or

(iv)

the Ross Dependency; or

(d)

to prejudice relations between any of the Governments of—

(i)

New Zealand:

(ii)

the self-governing State of the Cook Islands:

(iii)

the self-governing State of Niue; or

(e)

to prejudice the international relations of the Government of—

(i)

the self-governing State of the Cook Islands; or

(ii)

the self-governing State of Niue.

Compare: 1993 No 28 s 27

55 Trade secret as reason for refusing request under IPP 6(1)(b) access to personal information

(1)

An agency may refuse access to any personal information requested under IPP 6(1)(b) if the information needs protecting because making the information available would—

(a)

disclose a trade secret; or

(b)

be likely to unreasonably prejudice the commercial position of the person who supplied the information or who is the subject of the information.

(2)

Subsection (1) does not apply if, in the circumstances of the particular case, the withholding of that information is outweighed by other considerations that make it desirable, in the public interest, to make the information available.

Compare: 1993 No 28 s 28

56 Administrative reasons for refusing request under IPP 6(1)(b)

An agency may refuse access to any information requested under IPP 6(1)(b) if

(a)

the information requested is not readily retrievable; or

(b)

the information requested does not exist or, despite reasonable efforts to locate it, cannot be found; or

(c)

the information requested is not held by the agency.

Compare: 1993 No 28 s 29(2)

57 Other reasons for refusing request under IPP 6(1)(b) access to personal information

An agency may refuse access to any personal information requested under IPP 6(1)(b) if—

(aa)

the information requested does not exist or, despite reasonable efforts to locate it, cannot be found; or

(a)

the disclosure of the information would involve the unwarranted disclosure of the affairs of—

(i)

another individual; or

(ii)

a deceased person; or

(b)

the disclosure of the information would be likely to prejudice the maintenance of the law by any public sector agency, including—

(i)

the prevention, investigation, and detection of offences; and

(ii)

the right to a fair trial; or

(c)

the disclosure of the information would breach legal professional privilege; or

(d)

in the case of a request made to Radio New Zealand Limited or Television New Zealand Limited, the disclosure of the information would be likely to reveal the source of information of a bona fide news media journalist, and

(i)

the information is subject to an obligation of confidence; or

(ii)

the disclosure of the information would be likely to prejudice the supply of similar information, or information from the same source; or

(e)

the disclosure of the information, being information contained in material placed in any library or museum or archive, would breach a condition subject to which that material was placed; or

(f)

the disclosure of the information would constitute contempt of court or of the House of Representatives; or

(g)

the request is made by a defendant or a defendant’s agent and is—

(i)

for information that could be sought by the defendant under the Criminal Disclosure Act 2008; or

(ii)

for information that could be sought by the defendant under that Act and that has been disclosed to, or withheld from, the defendant under that Act; or

(h)

the agency has reasonable grounds for believing that the request was made under duress; or

(i)

the request is frivolous or vexatious, or the information requested is trivial.

Compare: 1993 No 28 ss 27(1)(c), 29(1)(a), (f)–(j), (2)

58 Agency may impose conditions instead of refusing access to information under section 57 to personal information

(1)

This section applies if an agency has good reason under any of sections 52 to 57 to refuse access to any personal information requested under IPP 6(1)(b).

(2)

Instead of refusing access to the personal information requested under IPP 6(1)(b), the agency may grant access to the information, but may impose conditions relating to either or both of the following:

(a)

the requestor’s use of the information:

(b)

the requestor’s disclosure of the information to any other person.

59 Requestor to be informed of certain matters if response given under section 49(2)(c) or 50(2)(c)

(1)

This section applies if an agency responds to a request under IPP 6(1)(a) or (b) by stating that the agency neither confirms nor denies that it holds personal information about the requestor.

(2)

The agency must inform the requestor of

(a)

the reason for the response; and

(b)

the requestor’s right to make a complaint to the Commissioner in respect of that response.

(3)

The agency must also disclose to the requestor the grounds in support of the reason for the response if the requestor has requested disclosure of the grounds.

(4)

However, subsection (3) does not apply if disclosing the grounds would prejudice the interests protected by any of sections 52(1)(a)(i) and (d), 54, 55, and 57(b).

Compare: 1993 No 28 s 44

60 Requestor to be informed of certain matters if request under IPP 6(1)(b) refused

(1)

This section applies if an agency refuses access to information requested under IPP 6(1)(b).

(2)

The agency must inform the requestor of

(a)

the reason for the refusal; and

(b)

the requestor’s right to make a complaint to the Commissioner in respect of the refusal.

(3)

The agency must also disclose to the requestor the grounds in support of the reason for the refusal if

(a)

the reason is that set out in section 53(1)(a); or

(b)

the reason is not that set out in section 53(1)(a), but the requestor has requested disclosure of the grounds.

(4)

However,

(a)

subsection (3)(a) does not apply if disclosing the grounds would prejudice the interests protected by section 53(1)(a):

(b)

subsection (3)(b) does not apply if disclosing the grounds would prejudice the interests protected by any of sections 52, 54, and 57(e) to (i):

(c)

subsection (3)(b) does not apply if disclosing the grounds would prejudice the interests protected by section 55 and the withholding of those grounds is not outweighed by other considerations that make it desirable, in the public interest, to disclose them.

Compare: 1993 No 28 s 44

61 Withholding personal information requested under IPP 6(1)(b) contained in document

(1)

If the personal information requested under IPP 6(1)(b) is contained in a document and there is good reason under any of sections 52 to 57 for withholding some of that information, the agency may decide to grant the requestor access to a copy of that document under section 50(2) with any deletions or alterations in respect of the information that could be withheld that it considers necessary.

(2)

If information is withheld under subsection (1), the agency must inform the requestor of—

(a)

the reason for the decision to withhold the information; and

(b)

the requestor’s right to make a complaint to the Commissioner in respect of that decision.

(3)

The agency must also disclose to the requestor the grounds in support of the reason for the decision to withhold the information if—

(a)

the reason is that set out in section 53(1)(a); or

(b)

the reason is not that set out in section 53(1)(a), but the requestor has requested disclosure of the grounds.

(4)

However,—

(a)

subsection (3)(a) does not apply if disclosing the grounds would prejudice the interests protected by section 53(1)(a):

(b)

subsection (3)(b) does not apply if disclosing the grounds would prejudice the interests protected by any of sections 52, 54, and 57(e) to (i):

(c)

subsection (3)(b) does not apply if disclosing the grounds would prejudice the interests protected by section 55 and the withholding of those grounds is not outweighed by other considerations that make it desirable, in the public interest, to disclose them.

Compare: 1993 No 28 s 43

62 Ways personal information in document may be made available

(1)

If the personal information requested by an individual under IPP 6(1)(b) is in a document, that information may be made available in 1 or more of the following ways:

(a)

by giving the requestor a reasonable opportunity to inspect the document; or

(b)

by providing the requestor with a copy a hard copy or an electronic copy of the document; or

(c)

in the case of a document that is an article or a thing from which sounds or visual images are capable of being reproduced, by making arrangements for the requestor to hear or view the sounds or visual images; or

(d)

in the case of a document by which words are recorded in a manner in which they are capable of being reproduced in the form of sound or in which words are contained in the form of shorthand writing or in codified form, by providing the requestor with a written transcript of the words recorded or contained in the document; or

(e)

by giving an excerpt or a summary of the document’s contents; or

(f)

by giving oral information about the document’s contents.

(2)

Subject to section 61, the agency must make the information available in the way preferred by the requestor unless to do so would—

(a)

impair the efficient administration of the agency; or

(b)

be contrary to any legal duty of the agency in respect of the document.

(3)

If the information is not provided in the way preferred by the requestor, the agency must give to the requestor—

(a)

the reason for not providing the information in that way; and

(b)

if the requestor so requests, the grounds in support of that reason.

Compare: 1993 No 28 s 42

63 Responsibilities of agency before giving access to personal information

If information is requested under IPP 6(1)(b) an agency receives a request to access personal information, the agency—

(a)

may give access to the information only if the agency is satisfied of the identity of the requestor; and

(ab)

must not give access to the information if the agency has reasonable grounds to believe that the request is made under duress; or

(b)

must ensure, by the adoption of appropriate procedures, that any information intended for a requestor is received—

(i)

only by that requestor; or

(ii)

if the request is made by a requestor as agent for an individual, only by the requestor or the individual; and

(c)

must ensure that, if the request is made by a requestor as agent for an individual, the requestor has the written authority of the individual to obtain the information, or is otherwise properly authorised by the individual to obtain the information.

Compare: 1993 No 28 s 45

Subpart 2—Correction of personal information

64 Interpretation

(1)

In this subpart and subpart 3, correction request means—

(a)

a request made under IPP 7(1)(a) to correct personal information; or

(b)

a request made under IPP 7(2)(b) 7(2A)(b) to attach a statement of correction to personal information.

(2)

In this subpart, requestor, in relation to a correction request, means the individual who made the request.

65 Individuals may make correction requests

A correction request may be made only by a requestor who is an individual the individual concerned.

Compare: 1993 No 28 s 34

66 Urgency

(1)

A requestor may ask that a correction request be treated as urgent (an urgent correction request).

(2)

A requestor making an urgent correction request must state the reason why the request should be treated as urgent.

(3)

On receiving an urgent correction request, an agency must consider the request and the reason stated for its urgency when determining the priority to be given to responding to it.

Compare: 1993 No 28 s 37

67 Assistance

Every An agency must give reasonable assistance to an individual who—

(a)

wishes to make a correction request; or

(b)

is making a correction request.

Compare: 1993 No 28 s 38

68 Transfer of correction request

(1)

This section applies if an agency that receives a correction request—

(a)

does not hold the information to which the request relates, but believes that the information is held by another agency; or

(b)

believes that the request information to which the request relates is more closely connected with the functions or activities of another agency.

(2)

The agency must promptly, and in any case not later than 10 working days after the day on which the correction request is received, transfer the request to the other agency and inform the individual who made the request accordingly.

(3)

However, subsection (2) does not apply if the agency has good cause to believe that the requestor does not want the request transferred to another agency.

(4)

If, in reliance on subsection (3), the agency does not transfer the request, the agency must promptly, and in any case not later than 10 working days after the day on which the correction request was received, inform the requestor

(a)

that this section applies in respect of the request; and

(b)

that, in reliance on subsection (3), the request has not been transferred; and

(c)

which agency the request could be transferred to.

Compare: 1993 No 28 s 39

69 Decision on request under IPP 7(1)(a)

(1)

On receiving a correction request made under IPP 7(1)(a) that is not transferred under section 68, an agency must as soon as is reasonably practicable, and in any case not later than 20 working days after the day on which the request is received,

(a)

decide whether to grant the request; and

(b)

give or send to the requestor a response to the request.

(2)

A response must notify the requestor that

(a)

the request has been granted, and of the steps that will be taken to correct the information; or

(b)

the request has not been granted and state the reason, and that

(i)

the requestor may, if he or she has not done so already, provide to the agency a statement of the correction sought with a request under IPP 7(2)(b); and

(ii)

the requestor has the right to make a complaint to the Commissioner in respect of the refusal to grant the request.

(3)

If an agency decides to grant a request, the agency must take any steps to correct the information that are in the circumstances reasonable to ensure that, having regard to the purposes for which the information may lawfully be used, the information is accurate, up to date, complete, and not misleading.

Compare: 1993 No 28 ss 6 (IPP 7(2)), 40(1)

69 Decision on request to correct personal information

(1)

As soon as is reasonably practicable after receiving a request under IPP 7(1), and in any case not later than 20 working days after receiving the request, an agency must

(a)

decide whether to grant the request; and

(b)

notify the requestor that

(i)

the agency has corrected, or will correct, the personal information; or

(ii)

the agency will not correct the personal information.

(2)

A notice under subsection (1)(b)(i) must inform the requestor of the action the agency has taken, or will take, to correct the information.

(3)

A notice under subsection (1)(b)(ii) must inform the requestor of

(a)

the reason for the agency’s refusal to correct the information; and

(b)

the requestor’s entitlement to provide a statement of the correction sought and to request that it be attached to the information (if the requestor has not done so already); and

(c)

the requestor’s right to make a complaint to the Commissioner in respect of the agency’s refusal to correct the information.

Compare: 1993 No 28 ss 6 (IPP 7(2)), 40(1)

70 Decision on request under IPP 7(2)(b)

(1)

This section applies if an agency

(a)

does not grant a correction request made under IPP 7(1)(a); and

(b)

receives a correction request under IPP 7(2)(b) that is not transferred under section 68.

(2)

The agency must as soon as is reasonably practicable, and in any case not later than 20 working days after the day on which the correction request made under IPP 7(2)(b) is received,

(a)

take any steps that are reasonable in the circumstances to attach the statement of correction to the information in such a manner that it will always be read with the information; and

(b)

inform the requestor

(i)

that steps have been taken to attach the statement of correction to the information, and what those steps are; or

(ii)

that no steps have been taken to attach the statement of correction to the information.

Compare: 1993 No 28 ss 6 (IPP 7(3)), 40

70 Decision on request to attach statement of correction

(1)

As soon as practicable after receiving a request under IPP 7(2A)(b), an agency must

(a)

decide whether to grant the request; and

(b)

notify the requestor that

(i)

the agency has attached the statement of correction to the information; or

(ii)

the agency has not attached the statement of correction to the information.

(2)

A notice under subsection (1)(b)(i) must inform the requestor of the action the agency has taken to attach the statement of correction to the information.

(3)

A notice under subsection (1)(b)(ii) must inform the requestor of the requestor’s right to make a complaint to the Commissioner in respect of the agency’s refusal to attach a statement of correction to the information.

Compare: 1993 No 28 ss 6 (IPP 7(3)), 40

71 Extension of time limits

(1)

On receiving a correction request, an agency may extend the time limit set out in section 68, 69, or 70 68 or 69 in respect of the request if—

(a)

the request necessitates a search through a large quantity of information, and meeting the original time limit would unreasonably interfere with the operations of the agency; or

(b)

consultations necessary to make a decision on the request are such that a response to the request cannot reasonably be given within the original time limit.; or

(c)

the processing of the request raises issues of such complexity that a response to the request cannot reasonably be given within the original time limit.

(2)

Any extension under subsection (1) must be for a reasonable period of time, having regard to the circumstances.

(3)

The extension is effected by giving notice of the extension to the requestor within 20 working days after the day on which the request is received.

(4)

The notice effecting the extension must—

(a)

specify the period of the extension; and

(b)

give the reasons for the extension; and

(c)

state that the requestor has the right to make a complaint to the Commissioner about the extension; and

(d)

contain any other information that may be necessary.

Compare: 1993 No 28 s 41

Subpart 3—Charges

72 Charges

(1)

An agency may not impose a charge for

(a)

receiving an access request; or

(b)

transferring an access request to another agency; or

(c)

processing an access request; or

(d)

receiving a correction request; or

(e)

transferring a correction request; or

(f)

processing a correction request.

(2)

An agency may impose a charge for providing assistance in accordance with section 47 or 67 if the agency

(a)

is a private sector agency; and

(b)

makes information available in compliance, in whole or in part, with a request under IPP 6(1)(a) or (b).

(3)

A private sector agency, and a public sector agency authorised under section 73 to do so, may impose a charge for

(a)

making information available in compliance, in whole or in part, with a request under IPP 6(1)(b):

(b)

attaching a statement of correction to personal information in compliance with a request under IPP 7(2)(b).

(4)

A charge imposed under subsection (2) or (3) must be reasonable, and in the case of a charge imposed under subsection (3)(a) may reflect

(a)

the cost of the labour and materials involved in making the information available; and

(b)

in the case of an urgent access request received under section 46, any costs involved in making the information available urgently.

(5)

An agency may require all or part of a charge to be paid in advance.

Compare: 1993 No 28 ss 35(1)(5), 40(2)

72 Charges

(1)

In relation to an IPP 6 request,

(a)

a public sector agency may, if authorised under section 73, impose a charge for making information available in compliance, in whole or in part, with the request:

(b)

a private sector agency may, subject to the provisions of any applicable code of practice, impose a charge for

(i)

providing assistance under section 47, but only if the agency makes information available in compliance, in whole or in part, with the request:

(ii)

making information available in compliance, in whole or in part, with the request.

(2)

In relation to a correction request,

(a)

a public sector agency may, if authorised under section 73, impose a charge for attaching a statement of correction to personal information:

(b)

a private sector agency may, subject to the provisions of any applicable code of practice, impose a charge for

(i)

providing assistance under section 67:

(ii)

attaching a statement of correction to personal information.

(3)

Except as provided in subsections (1) and (2), no public sector agency or private sector agency may impose any charge in relation to an IPP 6 request or a correction request.

(4)

A charge imposed under subsection (1)(a), (1)(b)(ii), or (2) must be reasonable and, in the case of a charge imposed under subsection (1)(a) or (b)(ii), regard may be had to

(a)

the cost of the labour and materials involved in making the information available; and

(b)

any costs involved in making the information available urgently (in the case of an urgent IPP 6 request received under section 46).

(5)

An agency may require all or part of a charge to be paid in advance.

Compare: 1993 No 28 ss 35, 40(2)

73 Commissioner may authorise public sector agency to impose charge

(1)

If the conditions in subsection (2) are satisfied, the Commissioner may authorise a public sector agency to impose a charge for

(a)

granting, in whole or in part, an access request under IPP 6(1)(b):

(b)

attaching a statement of correction to personal information in compliance with a request under IPP 7(2)(b).

(2)

The conditions are that

(a)

the request is received from, or on behalf of, an individual who

(i)

is residing outside New Zealand; and

(ii)

is not a New Zealand citizen or permanent resident of New Zealand; or

(b)

the Commissioner is satisfied that the public sector agency would otherwise be commercially disadvantaged, in comparison with any competitor in the private sector.

(1)

The Commissioner may authorise a public sector agency to impose a charge under section 72(1)(a) or (2)(a) if the Commissioner is satisfied that the public sector agency will be commercially disadvantaged in comparison with any competitor in the private sector if it were not able to impose a charge.

(3)

The Commissioner may impose any conditions on an authorisation given under subsection (1) that the Commissioner thinks fit considers appropriate.

(4)

The Commissioner may, at any time, revoke an authorisation given under subsection (1), but only after giving the agency an opportunity to be heard.

Compare: 1993 No 28 s 36

Part 5 Complaints, investigations, and proceedings

74 Interpretation

In this Part, unless the context otherwise requires,—

access direction means an access direction made by the Commissioner under section 96(5)(a)

action has the meaning given to it by in section 6, and includes a decision

aggrieved individual means an individual whose privacy is the subject of—

(a)

a complaint under subpart 1:; or

(b)

an investigation under subpart 2

approved information sharing agreement has the meaning given to it by in section 138

complainant, in relation to a complaint, means the individual person who made the complaint

information matching agreement means an agreement entered into under section 178

parties,—

(a)

in relation to an investigation conducted by the Commissioner on receiving a complaint under section 78(1), means—

(i)

the complainant whose complaint is the subject of the investigation; and

(ii)

the aggrieved individual (if not the complainant); and

(iii)

the respondent:

(b)

in relation to an investigation conducted by the Commissioner on his or her the Commissioner’s own initiative, means—

(i)

the aggrieved individual or aggrieved individuals (if known); and

(ii)

the respondent

public register complaint means a complaint that

(a)

a public register provision is inconsistent with 1 or more of the IPPs or PRPPs; or

(b)

an agency responsible for administering a public register is not, in the administration of that register, complying with

(i)

the IPPs; or

(ii)

the PRPPs; or

(iii)

both the IPPs and the PRPPs; or

(c)

an agency is not complying with PRPP 2; or

(d)

an agency is not complying with a code of practice issued under section 36

public register provision has the meaning given to it in section 29

representative, in relation to an aggrieved individual, means any person lawfully acting on behalf of the aggrieved individual

respondent means an agency whose action is the subject of an investigation under subpart 2.

Compare: 1993 No 28 ss 55, 61(1), (3), 64(b)

75 Interference with privacy of individual

(1)

In this Act, an action of an agency is an interference with the privacy of an individual in any of the circumstances set out in subsection (2) or (3).

(2)

An action of an agency is an interference with the privacy of an individual if the action breaches,—

(a)

in relation to the individual,—

(i)

1 or more of the IPPs; or

(ii)

the provisions of an approved information sharing agreement; or

(iii)

the provisions of an information matching agreement or section 179 or 181; or

(iv)

section 119 (which requires an agency to give notice to affected individuals or the public of a notifiable privacy breach); and

(b)

the action—

(i)

has caused, or may cause, loss, detriment, damage, or injury to the individual; or

(ii)

has adversely affected, or may adversely affect, the rights, benefits, privileges, obligations, or interests of the individual; or

(iii)

has resulted in, or may result in, significant humiliation, significant loss of dignity, or significant injury to the feelings of the individual.

(3)

An action of an agency is an interference with the privacy of an individual if, in relation to a request made by an individual under subpart 1 or 2 of Part 4 IPP 6 or 7, the agency has, without proper basis, made

(a)

made a decision that has no proper basis to refuse to grant a request under pursuant to IPP 6; or

(b)

made a decision that has no proper basis to refuse to grant a request under IPP 7; or

(a)

a decision to refuse a request under IPP 6; or

(b)

a decision to refuse a request under IPP 7; or

(c)

made any other decision under Part 4 that has no proper basis in relation to the request.

(4)

For the purpose of subsection (3)(a), the following must be treated as a decision by an agency to refuse to grant a request under IPP 6:

(a)

a failure to comply with the time limits in Part 4 for responding to the request:

(b)

undue delay in making information available after granting the request.

(5)

For the purpose of subsection (3)(b), the following must be treated as a decision by an agency to refuse to grant a request under IPP 7:

(a)

a failure to comply with the time limits in Part 4 for responding to the request:

(b)

undue delay in correcting information after granting the request:

(c)

undue delay in attaching a statement of correction after granting the request.

Compare: 1993 No 28 s 66

Subpart 1—Complaints

76 Types of cComplaints

(1)

The following types of A complaints may be made under this Part alleging that an action of an agency is, or appears to be, an interference with the privacy of an individual.:

(a)

a complaint alleging that an action of an agency is, or appears to be, an interference with the privacy of an individual:

(b)

a public register complaint.

(2)

A complaint may be made together with 1 or more other complaints of the same or of a different type.

77 Who may make complaint

(1)

A complaint may be made by—

(a)

an aggrieved individual; or

(ab)

a representative of the aggrieved individual; or

(b)

a representative of 1 or more 2 or more aggrieved individuals.

(2)

A representative referred to in subsection (1)(b) may, but need not, be an aggrieved individual.

Compare: 1993 No 28 s 67(1)

78 Form of complaint

(1)

A complaint must be made to the Commissioner and may be made orally or in writing.

(2)

A complaint made orally must be put in writing as soon as practicable.

(3)

If a person wishing to make a complaint to the Commissioner requires assistance to put the complaint in writing, the Commissioner must give that person any assistance that is reasonably necessary in the circumstances.

Compare: 1993 No 28 ss 67(2), 68

79 Procedure on receipt of complaint

(1)

As soon as practicable after receiving a complaint, the Commissioner must consider the complaint and—

(a)

decide, in accordance with section 80, not to investigate the complaint; or

(b)

decide, in accordance with section 81, to defer taking action on the complaint; or

(c)

decide, in accordance with section 82, to refer the complaint to another person; or

(d)

decide, in accordance with section 83, to refer the complaint, or part of the complaint, to an overseas privacy enforcement authority; or

(e)

decide, in accordance with section 84, to explore the possibility of securing a settlement between the complainant aggrieved individual and the agency whose action is the subject of the complaint; or

(f)

decide to investigate the complaint in accordance with subpart 2.

(2)

As soon as practicable after making a decision under subsection (1), the Commissioner must—

(a)

advise the complainant of that decision; and

(b)

advise the complainant of the reasons for the decision, if the decision is made under subsection (1)(a), (b), or (c).

Compare: 1993 No 28 ss 70, 71(3), 72(3), 72A(3), 72B(3), 72C(3)

80 Commissioner may decide not to investigate complaint

(1)

The Commissioner may decide not to investigate a complaint if, in the Commissioner’s opinion,—

(a)

the complainant or the aggrieved individual (not being the complainant) has not made reasonable efforts to resolve the complaint directly with the agency concerned; or

(b)

there is an alternative dispute resolution process available to the complainant resolve the complaint because of the agency’s membership of a particular profession or industry; or

(c)

there is an adequate remedy or right of appeal, other than the right to petition the House of Representatives or to make a complaint to an Ombudsman, that it would be reasonable for the aggrieved individual to pursue; or

(d)

the complaint relates to a matter in respect of which a code of practice has been issued that includes a complaints procedure, and the complainant has not taken reasonable steps to pursue, or fully pursue, the redress available under that procedure; or

(e)

the complainant aggrieved individual knew about the action that is the subject of the complaint for 12 months or more before making the complaint; or

(f)

the time that has elapsed between the date on which the subject of the complaint arose and the date on which the complaint was made is such that an investigation of the complaint is no longer practicable or desirable; or

(g)

the aggrieved individual does not want the complaint pursued; or

(h)

the complainant does not have a sufficient personal interest in the subject of the complaint; or

(i)

the subject of the complaint is trivial; or

(j)

the complaint is frivolous, vexatious, or not made in good faith.

(2)

Despite anything in subsection (1), the Commissioner may, in the Commissioner’s discretion, decide not to investigate a complaint if it appears to the Commissioner that, having regard to all the circumstances of the case, an investigation is unnecessary.

Compare: 1993 No 28 s 71(1); 1975 No 9 s 17(1)(f)(i)

81 Commissioner may decide to defer taking action on complaint

The Commissioner may decide to defer taking action on a complaint if

(a)

the complainant has not complained to the agency concerned; and

(b)

the Commissioner considers that the complainant should do so in an attempt to directly resolve the complaint.

82 Referral of complaint to another person

(1)

This section applies if, on after receiving a complaint (not being a public register complaint), the Commissioner considers that the complaint relates, in whole or in part, to a matter that is more properly within the jurisdiction of any of the following persons:

(a)

an Ombudsman; or:

(b)

the Health and Disability Commissioner; or:

(c)

the Inspector-General of Intelligence and Security; or:

(d)

the Independent Police Conduct Authority.

(2)

As soon as practicable, the The Commissioner must—

(a)

consult the person specified in subsection (1) who the Commissioner considers has jurisdiction to deal with the complaint; and

(b)

decide the appropriate means of dealing with the complaint.

(3)

If the Commissioner decides that the complaint should be dealt with, in whole or in part, by a person specified in subsection (1), the Commissioner must, as soon as practicable, refer the complaint, or the appropriate part of the complaint, to that person.

Compare: 1993 No 28 ss 72, 72A, 72B

83 Referral of complaint to overseas privacy enforcement authority

(1)

This section applies if, on receiving a complaint (not being a public register complaint), the Commissioner considers that the complaint relates, in whole or in part, to a matter that is more properly within the jurisdiction of an overseas privacy enforcement authority.

(2)

As soon as practicable, the Commissioner may—

(a)

consult the overseas privacy enforcement authority and the complainant; and

(b)

decide the appropriate means of dealing with the complaint.

(3)

If the Commissioner decides that the complaint should be dealt with, in whole or in part, by the overseas privacy enforcement authority and both the authority and the complainant agree, the Commissioner may refer the complaint, or the appropriate part of the complaint, to the authority.

Compare: 1993 No 28 s 72C

84 Exploring possibility of settlement and assurance before investigating complaint

(1)

At any time after receiving a complaint and before commencing an investigation, the Commissioner may decide to use his or her best endeavours to—

(a)

secure a settlement of the complaint; and

(b)

if appropriate, secure a satisfactory assurance from the agency whose action is the subject of the complaint that there will not be a repetition of the action that gave rise to the complaint, or of any similar kind of action.

(2)

After using his or her best endeavours under subsection (1), the Commissioner may refer a complaint to the Director without conducting an investigation if

(a)

the Commissioner is unable to secure a settlement or a satisfactory assurance; or

(b)

it appears that a term of settlement previously secured between the agency and the complainant has not been complied with; or

(c)

it appears that the action that is the subject of the complaint was done in contravention of any term of settlement or an assurance previously secured under this Act or the Privacy Act 1993.

Compare: 1993 No 28 ss 74, 77(2)(c)

84A Referral of complaint to Director without conducting investigation

The Commissioner may refer a complaint to the Director without conducting an investigation if

(a)

the Commissioner is unable to secure a settlement or a satisfactory assurance under section 84; or

(b)

it appears that a term of settlement previously secured between the agency and the aggrieved individual has not been complied with; or

(c)

it appears that the action that is the subject of the complaint was done in contravention of any term of settlement or an assurance previously secured under this Act or the Privacy Act 1993.

Compare: 1993 No 28 s 77(2)(a), (c)

Subpart 2—Investigations by Commissioner

85 Application of this subpart

This subpart applies to investigations conducted by the Commissioner—

(a)

into complaints received under section 78(1); or

(b)

on his or her the Commissioner’s own initiative, in relation to into any matter in respect of which a complaint may be made under this Act.

86 Commencing investigation

(1)

As the first step of an investigation, the Commissioner must notify the following persons that he or she is commencing an investigation:

(a)

the aggrieved individual, if that individual

(i)

is known; and

(ii)

is not a complainant who has been advised of a decision under section 79(2)(a); and

(b)

the respondent.

(1)

As the first step of an investigation, the Commissioner must notify the respondent that the Commissioner is commencing an investigation.

(2)

A notice given under subsection (1)(b) must set out—

(a)

the details of—

(i)

the complaint; or

(ii)

the subject of the investigation; and

(b)

the right to provide, within a reasonable time, a written response to the Commissioner.

Compare: 1993 No 28 s 73

87 Exploring possibility of settlement and assurance during investigation

(1)

At any time during an investigation of a complaint, the Commissioner may decide to use his or her best endeavours to

(a)

secure a settlement of the complaint; and

(b)

if appropriate, secure a satisfactory assurance from the agency whose action is the subject of the complaint that there will not be a repetition of the action that gave rise to the complaint, or of any similar kind of action.

(2)

At any time during an investigation being conducted on the Commissioner’s own initiative, the Commissioner may decide to use his or her best endeavours to secure a satisfactory assurance from the respondent that there will not be a repetition of the action that gave rise to the investigation, or of a similar kind of action.

(3)

After using his or her best endeavours under subsection (1) or (2), the Commissioner may refer the complaint or the matter that is the subject of the investigation to the Director without conducting any further investigation if

(a)

the Commissioner is unable to secure a settlement or a satisfactory assurance; or

(b)

it appears that a term of settlement previously secured between the agency and the complainant has not been complied with; or

(c)

it appears that the action that is the subject of the complaint or that gave rise to the investigation was done in contravention of any term of settlement or an assurance previously secured under this Act or the Privacy Act 1993.

Compare: 1993 No 28 ss 74, 77(1), (2)

88 Conducting investigation

(1)

The Commissioner must conduct an investigation in a timely manner.

(2)

During an investigation, the Commissioner may—

(a)

hear and obtain information from any person; and

(b)

make any inquiries.

(3)

At any time during an investigation, the Commissioner may decide to take no further action on a complaint or matter if the Commissioner—

(a)

is satisfied of any of the matters set out in section 80; or

(b)

considers that any further action is unnecessary or inappropriate.

(4)

As soon as practicable after making a decision under subsection (3), the Commissioner must notify the parties of that decision.

(4)

As soon as practicable after making a decision under subsection (3), the Commissioner must notify the parties of

(a)

that decision; and

(b)

the reason for that decision.

(5)

It is not necessary for the Commissioner to hold any a hearing, and no person is entitled as of right to be heard by the Commissioner.

(6)

Any investigation held by the Commissioner must be conducted in private.

Compare: 1993 No 28 ss 71(2), 75, 90(1), (2)

89 Commissioner may regulate own procedure

When conducting an investigation, the Commissioner may regulate his or her adopt any procedure as he or she thinks fit, subject to this Act and any regulations made under this Act. the Commissioner considers appropriate that is not inconsistent with this Act or any regulations made under section 213(1)(a).

Compare: 1993 No 28 s 90(3)

89A Exploring possibility of settlement and assurance during investigation

(1)

At any time during an investigation of a complaint, the Commissioner may decide to use best endeavours to

(a)

secure a settlement of the complaint; and

(b)

if appropriate, secure a satisfactory assurance from the agency whose action is the subject of the complaint that there will not be a repetition of the action that gave rise to the complaint, or of any similar kind of action.

(2)

At any time during an investigation being conducted on the Commissioner’s own initiative, the Commissioner may decide to use best endeavours to secure a satisfactory assurance from the respondent that there will not be a repetition of the action that gave rise to the investigation, or of a similar kind of action.

Compare: 1993 No 28 ss 74, 77(1), (2)

89B Referral of complaint to Director without completing investigation

The Commissioner may refer the complaint or the matter that is the subject of the investigation to the Director without conducting any further investigation if

(a)

the Commissioner is unable to secure a settlement or a satisfactory assurance under section 89A; or

(b)

it appears that a term of settlement previously secured between the agency and the aggrieved individual has not been complied with; or

(c)

it appears that the action that is the subject of the complaint or that gave rise to the investigation was done in contravention of any term of settlement or an assurance previously secured under this Act or the Privacy Act 1993.

Compare: 1993 No 28 s 77(2)

90 Compulsory conferences of parties to complaint

(1)

At any time during an investigation of a complaint, the Commissioner may call a conference of the parties—

(a)

by sending each of them a notice requesting their attendance at a specified time and place; or

(b)

by any other means agreed by the parties.

(2)

The objectives of a conference are—

(a)

to identify the matters in issue between the parties; and

(b)

to try to obtain agreement between the parties on the resolution of those matters in order to settle the complaint.

(3)

If a person fails to comply with a request under subsection (1) to attend a conference, the Commissioner may issue a summons requiring the person to attend a conference at a time and place specified in the summons.

(4)

Section 159 of the Criminal Procedure Act 2011 applies to a summons under this section as if it were a witness summons issued under that section.

(5)

This section does not apply in respect of the investigation of a public register complaint.

Compare: 1993 No 28 s 76

91 Power to summon persons

(1)

The Commissioner may summon and examine on oath any person who the Commissioner considers is able to give information relevant to an investigation, and may for that purpose administer an oath to the person.

(2)

Every examination by the Commissioner under subsection (1) is to be treated as a judicial proceeding within the meaning of section 108 of the Crimes Act 1981 1961 (which relates to perjury).

(3)

A person who is summoned by the Commissioner under this section is entitled to the same fees, allowances, and expenses as if the person were a witness in a court, and—

(a)

the provisions of any regulations prescribing the fees, allowances, and expenses payable to persons giving evidence under the Criminal Procedure Act 2011 apply; and

(b)

the Commissioner has the powers of a court under such those regulations to fix or disallow, in whole or in part, or to increase, any amounts payable under the regulations.

Compare: 1993 No 28 s 91(1)–(3), (5)

92 Power to require information and documents

(1)

The At any time during an investigation, the Commissioner may, by notice, require any person to provide—

(a)

any information in the person’s possession, or under the person’s control, that the Commissioner considers may be relevant to the investigation:

(b)

any documents or things in the person’s possession, or under the person’s control, that the Commissioner considers may be relevant to the investigation.

(2)

A person who receives a notice under subsection (1) must comply with that notice as soon as practicable, but in no case later than—

(a)

the date specified in the notice; or

(b)

if no date is specified in the notice, the 20th working day after the date of receipt of the notice.

(3)

However, a person may request an extension of the time limit for complying with a notice received under subsection (1) if—

(a)

the requirement in the notice relates to, or necessitates a search through, a large quantity of information, documents, or things, and meeting the original time limit would unreasonably interfere with the operations of the agency; or

(b)

the consultations necessary before the requirement in the notice can be complied with are such that meeting the original time limit is unreasonable; or

(c)

the complexity of the issues raised by the requirement in the notice is such that meeting the original time limit is unreasonable.

(4)

A request under subsection (3) must be made to the Commissioner before the expiry of the date in subsection (2)(b) and specify—

(a)

the period of the extension sought; and

(b)

the reasons for the extension; and

(c)

any other relevant information.

(5)

The Commissioner must grant a request made under subsection (3) if satisfied that any of the grounds specified in that subsection are established.

Compare: 1993 No 28 ss 91(4), 92(1), (2), 93

93 Disclosure of information may be required despite obligation of secrecy

(1)

A person who is bound by the provisions of an enactment to maintain secrecy in relation to, or not to disclose, any matter may be required to do the following even though compliance with that requirement would be in breach of the obligation of secrecy or non-disclosure:

(a)

give evidence to, or answer questions put by, the Commissioner:

(b)

provide information, documents, or things to the Commissioner.

(2)

Compliance with a requirement of this kind is not a breach of the relevant obligation of secrecy or non-disclosure or of the enactment by which that obligation is imposed.

(3)

However, the Commissioner may not require information, documents, or things to be provided if—

(a)

the Prime Minister certifies that the giving of any information, document, or thing might prejudice—

(i)

the security or defence of New Zealand, or the international relations of the Government of New Zealand; or

(ii)

any interest protected by section 7 of the Official Information Act 1982 (which relates to the Cook Islands, Niue, Tokelau, and the Ross Dependency); or

(b)

the Attorney-General certifies that the giving of any information, document, or thing—

(i)

might prejudice the prevention, investigation, or detection of offences; or

(ii)

might involve the disclosure of proceedings of Cabinet, or any committee of Cabinet, relating to matters of a secret or confidential nature, and the disclosure would be injurious to the public interest.

(4)

This section is subject to section 94.

Compare: 1993 No 28 s 95

94 Protection and privileges of persons required to provide information, etc

(1)

Every person has the same privileges as witnesses have in a court of law, in relation to—

(a)

giving evidence to, or answering questions put by, the Commissioner:

(b)

providing information, documents, or things to the Commissioner.

(2)

However, if the Commissioner issues a notice under section 92 in relation to a particular complaint under IPP 6 and the person who receives the notice claims privilege over any information, document, or thing, that person must nevertheless provide to the Commissioner the information, document, or thing that is the subject of the complaint to the Commissioner for the purpose of the Commissioner determining whether it is properly withheld from the aggrieved individual.

(3)

When any information, document, or thing is provided under subsection (2), the Commissioner must not—

(a)

use the information, document, or thing other than for the purpose specified in subsection (2); or

(b)

take into account the information or any information in the document or thing in forming an opinion about the release of any other information; or

(c)

give his or her an opinion as to whether the claim of privilege is valid to any person other than—

(i)

the complainant (if any):

(ii)

the aggrieved person:

(iii)

the respondent:

(iv)

the Director of Human Rights Proceedings:

(v)

the Human Rights Review Tribunal; or

(d)

release the information, document, or thing, or any information derived from the document or thing, to any person other than—

(i)

any lawyer engaged by the Commissioner for the purpose of providing legal advice as to whether the information, document, or thing would be properly withheld under subsection (1); or

(ii)

the Director of Human Rights Proceedings, if the Commissioner has given an opinion to the Director under paragraph (c)(iv); or

(iii)

the Human Rights Review Tribunal, if the Commissioner is required to provide a report or information under section 114(1).

(4)

Subsection (3)(c) does not prevent the Commissioner from giving, either generally or to a particular person, an opinion in a form that does not identify—

(a)

the person who provided the information, document, or thing; and or

(b)

a person who is the subject of the information, document, or thing.

(5)

Subsection (3)(d) does not prevent the Commissioner from giving the information, document, or thing, or any information derived from the document or thing, to a person if—

(a)

the person who provided the information, document, or thing consents; and

(b)

the person who is the subject of the information, document, or thing consents.

(6)

The privileges protected by this section do not include public interest immunity (see section 209).

(7)

A person who complies with any requirement of the Commissioner under section 92 or 93 is not liable to prosecution for an offence against any enactment (other than section 212) in respect of that compliance.

Compare: 1993 No 28 s 94

95 Disclosed information privileged

(1)

Any information, document, or thing provided by a person in the course of an investigation by the Commissioner, or during any hearing before the Commissioner, is privileged in the same manner as if the investigation or hearing were proceedings in a court.

(2)

The following persons may not be required to give evidence in any court, or in any proceedings of a judicial nature, in respect of anything coming to their knowledge in performing or exercising their functions, duties, or powers under this Act:

(a)

the Commissioner, or any person who has held the appointment of Commissioner:

(b)

a person who is employed or engaged, or who has been employed or engaged, by the Commissioner:

(c)

the Director.

(3)

Subsection (2) does not apply in respect of proceedings for—

(a)

an offence against section 78, 78AA(1), 78A(1), 105, 105A, or 105B of the Crimes Act 1961; or

(b)

the offence of conspiring to commit an offence against section 78, 78AA(1), 78A(1), 105, 105A, or 105B of the Crimes Act 1961 any of the provisions listed in paragraph (a); or

(c)

the offence of attempting to commit an offence against section 78, 78AA(1), 78A(1), 105, 105A, or 105B of the Crimes Act 1961 any of the provisions listed in paragraph (a).

(4)

For the purposes of clause 3 of Part 2 of Schedule 1 of the Defamation Act 1992, any report of the Commissioner under this Act is taken to be an official report.

Compare: 1993 No 28 s 96

96 Procedure after completion of investigation relating to breach of IPP 6 access to personal information

(1)

This section applies after the Commissioner has completed an investigation of an action of an agency under subpart 1 of Part 4 that appears to be an interference with the privacy of an individual.

(2)

The Commissioner may,—

(a)

in the case of an investigation conducted on a complaint, make a determination that the complaint—

(i)

has substance; or

(ii)

does not have substance; or

(b)

in the case of an investigation conducted on his or her the Commissioner’s own initiative, make a determination that the matter that is the subject of the investigation—

(i)

should be proceeded with; or

(ii)

should not be proceeded with.

(3)

If the Commissioner determines that a complaint has substance, the Commissioner must use his or her best endeavours to secure a settlement of the complaint and an assurance of the kind specified in section 87(1)89A(1).

(4)

If the Commissioner determines that the matter that is the subject of an investigation should be proceeded with, the Commissioner must use his or her best endeavours to secure an assurance of the kind specified in section 87(2)89A(2).

(5)

If the complaint or matter has not been resolved despite the Commissioner using his or her best endeavours under subsection (3) or (4), the Commissioner may do 1 or more of the following:

(a)

make any access direction that the Commissioner considers appropriate that requires an agency to provide an individual access to his or her personal information:

(b)

refer the complaint or matter, as the case may be, to the Director:

(c)

take any other action that the Commissioner considers appropriate.

(6)

Without limiting subsection (5)(a) or (b), the Commissioner may determine that a complaint has substance, or that the matter that is the subject of an investigation should be proceeded with, refer the complaint or matter, as the case may be, to the Director if the action that is the subject of the complaint or investigation was done in contravention of any term of settlement or assurance previously secured under this Act or the Privacy Act 1993.

(7)

Without limiting subsection (5)(a), the Commissioner may direct an agency to do any of the following before a specified date:

(a)

confirm whether or not the agency holds any specified personal information:

(b)

permit any complainant access to specified information:

(c)

make specified information available to any complainant in a particular way.

(8)

As soon as practicable, the Commissioner must give notice to the parties of—

(a)

any determination made, or not made, under subsection (2) and the reasons for making or not making that determination; and

(b)

any direction made under subsection (5)(a) section 96A; and

(c)

any referral made under subsection (5)(b); and

(d)

any other action taken under subsection (5)(c); and

(e)

any determination made under subsection (6).

(b)

any access direction made under subsection (5)(a); and

(c)

any referral made under subsection (5)(b) or (6); and

(d)

any other action taken under subsection (5)(c).

(9)

An agency may, under section 110, appeal to the Tribunal against a direction made under subsection (5)(a).

96A Access direction

(1)

An access direction made under section 96(5)(a) may direct an agency to provide an individual access to the individual’s personal information in any manner that the Commissioner considers appropriate.

(2)

Without limiting subsection (1), the Commissioner may direct an agency to do any of the following before a specified date:

(a)

confirm whether the agency holds any specified personal information:

(b)

permit the individual access to any specified personal information:

(c)

make any specified information available to the individual in a particular way.

(3)

The Commissioner may, at any time, on the request of the individual or on the Commissioner’s own initiative,

(a)

amend an access direction; or

(b)

cancel an access direction.

97 Procedure after completion of investigation relating to charging

(1)

This section applies after the Commissioner has completed an investigation of an action of an agency under subpart 3 of Part 4 that appears to be an interference with the privacy of an individual because, in relation to a request made by the individual under subpart 1 or 2 of Part 4, the agency has imposed a charge that is—

(a)

contrary to section 72; or

(b)

unreasonable.

(2)

If it has not been possible to secure a settlement, the Commissioner may make a determination that the charge imposed by the agency is—

(a)

properly imposed:

(b)

improperly imposed:

(c)

reasonable:

(d)

unreasonable.

(3)

If the Commissioner makes a determination under subsection (2)(d), the Commissioner may also determine the appropriate charge for the agency to impose.

(4)

As soon as practicable, the Commissioner must notify the parties to any determination made, or not made, under subsection (2) or (3).

(5)

A determination made by the Commissioner under subsection (2) is final and binding and no proceedings may be commenced in the Tribunal by the parties in respect of that determination.

(6)

If the Commissioner makes a determination under subsection (3) and the agency does not agree to reduce the charge it has imposed to the amount determined by the Commissioner to be appropriate (or less), the aggrieved individual may commence proceedings in the Tribunal complaining that the action of the agency is an interference with the privacy of an individual because it breaches IPP 6.

(a)

the imposition of the charge is treated as an interference with the privacy of an individual for the purposes of section 75(3); and

(b)

the Commissioner may take 1 or more of the actions specified in section 96(5).

Compare: 1993 No 28 ss 75, 78

98 Procedure after completion of investigation relating to public register

(1)

After completing an investigation into whether a public register provision is inconsistent with an IPP or PRPP, the Commissioner must

(a)

report his or her findings to the Minister responsible for the administration of the provision that is the subject of the investigation; and

(b)

provide a summary of the report to the complainant (if any).

(2)

After completing an investigation into whether an agency responsible for administering a public register is not, in administering that register, complying with the IPPs, or the PRPPs, or both the IPPs and PRPPs, the Commissioner must

(a)

report his or her findings to the agency whose actions were the subject of the investigation; and

(b)

provide a summary of the report to the complainant (if any).

(3)

After completing an investigation into whether the action of an agency is inconsistent with PRPP 2, or a code of practice issued under section 36, the Privacy Commissioner must

(a)

report his or her findings to the agency whose actions were the subject of the investigation; and

(b)

provide a summary of the report to the complainant (if any).

(4)

A report referred to in subsection (1)(a), (2)(a), or (3)(a) may include recommendations on the need for, or desirability of, taking any legislative, administrative, or other action to ensure adherence, or greater adherence, to the IPPs or PRPPs, or both.

Compare: 1993 No 28 s 61

99 Procedure after completion of other investigations

(1)

After the Commissioner has completed an investigation under this subpart, other than an investigation to which section 96, or 97, or 98 applies, the Commissioner may,—

(a)

in the case of an investigation conducted on receiving a complaint, make a determination that the complaint—

(i)

has substance; or

(ii)

does not have substance; or

(b)

in the case of an investigation conducted on his or her the Commissioner’s own initiative, make a determination that the subject of the investigation—

(i)

should be proceeded with; or

(ii)

should not be proceeded with.

(2)

If the Commissioner determines that a complaint has substance, the Commissioner must use his or her best endeavours to secure a settlement of the complaint and an assurance of the kind specified in section 87(1)89A(1).

(3)

If the Commissioner determines that a matter that is the subject of an investigation should be proceeded with, the Commissioner must use his or her best endeavours to secure an assurance of the kind specified in section 87(2) 89A(2).

(4)

If the complaint or matter has not been resolved despite the Commissioner using his or her best endeavours, the Commissioner may do either or both of the following:

(a)

refer the complaint or the matter, as the case may be, to the Director:

(b)

take any other action the Commissioner considers appropriate.

(5)

Without limiting subsection (4)(a) or (b), the Commissioner may determine that a complaint has substance, or that the matter that is the subject of an investigation should be proceeded with, refer the complaint or matter, as the case may be, to the Director if the action that is the subject of the complaint or investigation was done in contravention of any term of settlement or assurance previously secured under this Act or the Privacy Act 1993.

(6)

As soon as practicable, the Commissioner must notify the parties to the investigation of—

(a)

any determination made, or not made, under subsection (1); and

(b)

any referral made under subsection (4)(a); and

(c)

any other action taken under subsection (4)(b).

Compare: 1993 No 28 ss 75, 77(1), (2)

100 Special procedure relating to intelligence and security agency

(1)

Nothing in section 90, 96, 97, or 99 or subpart 3 applies to—

(a)

any complaint made under this Part in relation to an action of an intelligence and security agency; or

(b)

any investigation conducted under this Part in relation to an action of an intelligence and security agency.

(2)

If, after completing an investigation, the Commissioner is of the opinion that an action of an intelligence and security agency is an interference with the privacy of an individual, the Commissioner must provide to the intelligence and security agency a report setting out—

(a)

his or her that opinion; and

(b)

the reasons for that opinion.

(3)

A report provided under subsection (2) may include any recommendations that the Commissioner considers appropriate.

(4)

When making a report under subsection (2), the Commissioner may request the intelligence and security agency to notify him or her the Commissioner within a specified time of any steps the agency proposes to take in response to the report and to any recommendations included in the report.

(5)

If, within a reasonable time after any report is made, the intelligence and security agency has taken no steps in response to the report that the Commissioner considers to be adequate and appropriate, the Commissioner may send a copy of the report to the Prime Minister.

(6)

As soon as practicable after receiving a report under subsection (5), the Prime Minister may present the report, or any part of the report, to the House of Representatives.

Compare: 1993 No 28 s 81

101 Commissioner to report breach of duty or misconduct

If, during or after an investigation, the Commissioner is of the opinion that there is evidence of any significant breach of duty or misconduct on the part of an agency, or an officer, an employee, or a member of an agency, the Commissioner must refer the matter to the appropriate authority.

Compare: 1993 No 28 s 80

Subpart 3—Proceedings before Human Rights Review Tribunal

Proceedings in relation to complaints or investigations

102 Director may commence proceedings in Tribunal

(1)

This section applies if a complaint or matter is referred by the Commissioner to the Director under section 84A, 89B, 96(5)(b), (6) or 99(4)(a) or (5).

(2)

The Director must—

(a)

decide whether to commence proceedings in the Tribunal in respect of that the complaint or matter; and

(b)

give written notice to the following persons of his or her that decision:

(i)

the complainant (if any); and

(ii)

the aggrieved individual (if known); and

(iii)

the agency whose action was the subject of the Commissioner’s investigation complaint or matter.

(3)

Before commencing any proceedings in the Tribunal, the Director must give the agency an opportunity to be heard.

(4)

The parties to proceedings commenced under this section are—

(a)

the Director, as the plaintiff; and

(b)

the agency, as the defendant.

(5)

The An aggrieved individual may join, or be joined in, the proceedings only if the Tribunal so orders.

(6)

The Director may bring proceedings on behalf of a class of individuals, and may seek on behalf of individuals who belong to the class any of the remedies described in section 107, if the Director considers that a respondent is carrying on a practice that affects that class and that is an interference with the privacy of an individual.

Compare: 1993 No 28 s 82

103 Aggrieved individual may commence proceedings in Tribunal

(1)

The An aggrieved individual, or a representative of the aggrieved individual, may commence proceedings in the Tribunal in respect of a complaint or matter investigated under subpart 2 in any case where—

(a)

the Commissioner, having commenced an investigation, decides not to further investigate the complaint or matter; or

(b)

the Commissioner does not make a determination on a under section 96(2), 97(2), or 99(1) in respect of the complaint or matter; or

(c)

the Commissioner determines that the complaint does not have substance, or that the matter should not be proceeded with; or

(d)

the Commissioner determines that the complaint has substance, or the matter should be proceeded with, but does not refer the complaint or matter to the Director; or

(e)

the Commissioner does not make a direction under section 96(5)(a); or

(f)

the Commissioner makes a direction under section 96(5)(a) but the aggrieved individual is not satisfied with the terms of that direction; or

(g)

the Commissioner makes a determination under section 97(3) but the respondent does not comply with that determination and the aggrieved individual invokes section 97(6); or

(e)

the Commissioner makes an access direction under section 96(5)(a), but the aggrieved individual is not satisfied with the terms of the access direction; or

(h)

the Director decides not to commence proceedings in respect of a the complaint or matter referred to him or her the Director by the Commissioner; or

(i)

the Director notifies the aggrieved individual that he or she the Director agrees to the aggrieved individual commencing proceedings in respect of a the complaint or matter referred to the Director by the Commissioner.

(2)

An aggrieved individual A person commencing proceedings under subsection (1)(a) must do so within 6 months after receiving the notice given by the Commissioner under section 88(4).

(3)

An aggrieved individual A person commencing proceedings under subsection (1)(b) or (c), (c), (d), or (e) must do so within 6 months after receiving the notice given by the Commissioner under section 96(8)(a) or 99(6)(a).

(4)

An aggrieved individual commencing proceedings under subsection (1)(d) must do so within 6 months after receiving the notice given by the Commissioner under section 96(8) or 99(6).

(5)

An aggrieved individual commencing proceedings under subsection (1)(e) or (f) must do so within 6 months after receiving the notice given by the Commissioner under section 96(8).

(6)

An aggrieved individual commencing proceedings under subsection (1)(g) must do so within 6 months after the refusal by an agency to impose a charge that does not exceed the appropriate amount determined by the Commissioner under section 97(3).

(7)

An aggrieved individual A person commencing proceedings under subsection (1)(h) must do so within 6 months after receiving the notice given by the Director under section 102(2)(b).

(8)

An aggrieved individual A person commencing proceedings under subsection (1)(i) must do so within 6 months after receiving the notice given by the Director under that subsection (1)(i).

(9)

The parties to proceedings commenced under this section are—

(a)

the aggrieved individual, or the aggrieved individual’s representative, as the plaintiff; and

(b)

the agency whose action was the subject of the Commissioner’s investigation, as the defendant.

Compare: 1993 No 28 s 83

104 Right of Director to appear in proceedings commenced under section 103

(1)

In any proceedings commenced in the Tribunal under section 103, the Director may appear and be heard in person or by his or her a lawyer

(a)

in the proceedings commenced in the Tribunal:

(b)

in proceedings commenced in any court relating to the proceedings commenced in the Tribunal.

(1)

The Director may appear and be heard in person or by a lawyer

(a)

in any proceedings commenced in the Tribunal under section 103; and

(b)

in proceedings commenced in any court relating to the proceedings commenced in the Tribunal.

(2)

If the Director appears in any proceedings,—

(a)

the Director has the same rights as the parties to the proceedings to—

(i)

call evidence on any matter; and

(ii)

examine, cross-examine, and re-examine witnesses; and

(b)

the Tribunal or court may order—

(i)

any party to pay the costs incurred by the Director by reason of the Director’s appearance; or

(ii)

the Director to pay the costs incurred by any or all of the parties by reason of his or her the Director’s appearance.

(3)

If the Director declines to appear and be heard in any proceedings,—

(a)

the Commissioner may instead appear and be heard in the proceedings; and

(b)

subsection (2) applies to the Commissioner in the same way as it applies to the Director.

(4)

Nothing in this section limits or affects—

(a)

section 107(3); or

(b)

any power of a court to award costs in any proceedings to which the Director is a party.

Compare: 1993 No 28, s 86(1)–(3), (5), (6)

105 Apology not admissible except for assessment of remedies

(1)

If an apology is given by an agency in connection with an action alleged to be an interference with the privacy of an individual, it is not admissible as evidence in any civil proceedings against the agency under this Part except as provided in subsection (2).

(2)

An agency may bring evidence of the apology for the purpose of the Tribunal’s assessing of remedies to be awarded against the agency.

106 Onus of proof

Where If any provision of this Act, or any code of practice issued under section 35 or 36, excepts or exempts any action from being an interference with the privacy of an individual, the defendant has the onus of proving that exception or exemption in any proceedings under this Part.

Compare: 1993 No 28 s 87

107 Remedies in respect of interference with privacy

(1)

This section applies if proceedings are commenced in the Tribunal in respect of an action that is alleged to be an interference with the privacy of an individual.

(2)

If, in the proceedings, the Tribunal is satisfied on the balance of probabilities that any action of the defendant is an interference with the privacy of an individual, the Tribunal may grant 1 or more of the following remedies:

(a)

a declaration that the action of the defendant is an interference with the privacy of an individual:

(b)

an order restraining the defendant from continuing or repeating the interference, or from engaging in, or causing or permitting others to engage in, conduct of the same kind as that constituting the interference, or conduct of any similar kind specified in the order:

(c)

damages in accordance with section 108:

(d)

an order that the defendant perform any acts specified in the order with a view to remedying the interference, or redressing any loss or damage suffered by the aggrieved individual as a result of the interference, or both:

(e)

any other relief that the Tribunal thinks fit considers appropriate.

(3)

It is not a defence to proceedings that the interference was unintentional or without negligence on the part of the defendant, but the Tribunal must take the conduct of the defendant into account in deciding what, if any, remedy to grant.

Compare: 1993 No 28 s 85(1), (4)

108 Damages

(1)

In any proceedings, the Tribunal may award damages against the defendant for an interference with the privacy of an individual in respect of 1 or more of the following:

(a)

pecuniary loss suffered as a result of, and expenses reasonably incurred by the aggrieved individual for the purpose of the transaction or activity out of which the interference arose:

(ab)

expenses reasonably incurred by the aggrieved individual for the purpose of the transaction or activity out of which the interference arose:

(b)

loss of any benefit, whether or not of a monetary kind, that the aggrieved individual might reasonably have been expected to obtain but for the interference:

(c)

humiliation, loss of dignity, and injury to the feelings of the aggrieved individual.

(2)

Subsection (1) is subject to subpart 1 of Part 2 of the Prisoners’ and Victims’ Claims Act 2005.

(3)

The Director must pay damages recovered under this section to the aggrieved individual on whose behalf the proceedings were brought.

(4)

Subsection (3) is subject to subsections (5) to (7).

(5)

If the aggrieved individual is a minor who is not married or not in a civil union, the Director may, in his or her discretion, decide to pay the damages to Public Trust or to any person or trustee corporation acting as the manager of any property of the aggrieved individual.

(6)

If the aggrieved individual is a mentally disordered person within the meaning of section 2 of the Mental Health (Compulsory Assessment and Treatment) Act 1992 whose property is not being managed under the Protection of Personal and Property Rights Act 1988, the Director may, in his or her discretion, decide to pay the damages to Public Trust.

(7)

If the aggrieved individual is a person whose property is being managed under the Protection of Personal and Property Rights Act 1988, the Director must ascertain whether the terms of the property order cover management of money received as damages and,—

(a)

if damages fall within the terms of the property order, the Director must pay the damages to the person or trustee corporation acting as the property manager; or

(b)

if damages do not fall within the terms of the property order, the Director may, in his or her discretion, decide to pay the damages to Public Trust.

(8)

If money is paid to Public Trust under subsection (5), (6), or (7),—

(a)

sections 103 to 110 of the Contract and Commercial Law Act 2017 apply in the case of a minor who is not married or not in a civil union; and

(b)

sections 108D, 108F, and 108G of the Protection of Personal and Property Rights Act 1988 apply, with any necessary modifications, in the case of a person referred to in subsection (6) or (7)(b); and

(c)

section 108E of the Protection of Personal and Property Rights Act 1988 applies, with any necessary modifications, in the case of an individual referred to in subsection (7)(a).

Compare: 1993 No 28 s 88; 1994 No 88 s 57

Access orders

109 Enforcement of access direction made by Commissioner under section 96(5)(a) after investigation of IPP 6 breach

(1)

In the circumstances specified in subclause (2), If an agency has not complied with an access direction, or lodged an appeal under section 110, an aggrieved individual may apply to the Tribunal for an access order requiring an the agency to comply with a direction made by the Commissioner under section 96(5)(a) the access direction.

(2)

The circumstances are that the agency

(a)

has not complied with the direction; and

(b)

has not lodged an appeal under section 110.

(3)

If the Tribunal grants an application, the Tribunal must specify in the access order the date by which the agency must comply with the access direction made by the Commissioner under section 96(5)(a).

(3A)

An application under this section may be heard by the Chairperson sitting alone unless the Chairperson considers that, because of the issues involved, it would be more appropriate for the application to be heard by the Tribunal.

(4)

An agency that, without reasonable excuse, fails to comply with an access order commits an offence and is liable on conviction to a fine not exceeding $10,000.

Appeals against access direction made after investigation of IPP 6 breach

110 Appeal to Tribunal against access direction of Commissioner under section 96(5)(a)

(1)

An agency that has received notice of a direction made by the Commissioner under section 96(5)(a) after the completion of an investigation against which an access direction has been made may appeal to the Tribunal against the direction.

(2)

The parties to the appeal are the parties to the investigation.

111 Time for lodging appeal

(1)

An appeal under section 110 must be lodged with the Tribunal within 20 working days from the date of the notice given to the parties to the complaint under section 96(8) (the appeal period).

(2)

The Tribunal Chairperson may accept an appeal lodged not later than 3 months after the appeal period if, on an application made for that purpose by the party lodging the appeal, the Tribunal Chairperson is satisfied that exceptional circumstances prevented the appeal from being lodged within the appeal period.

112 Interim order suspending Commissioner’s direction pending appeal

(1)

The cChairperson of the Tribunal may make an interim order suspending a an access direction direction made by the Commissioner under section 96(5)(a) until an appeal is determined if the cChairperson is satisfied that it is necessary and in the interests of justice to make the order.

(2)

If an interim order is made, a party may apply to the High Court to vary or rescind the order, unless the order was made with that party’s consent.

(3)

An application under subsection (2) may be made only with the leave of the Tribunal.

(a)

made only with the leave of the Chairperson:

(b)

made instead of, but not as well as, an appeal against the interim order under section 123(1) of the Human Rights Act 1993.

(4)

An application may be made instead of but not as well as an appeal against the interim order under section 123(1) of the Human Rights Act 1993.

113 Appeal may be determined on papers

(1)

The Tribunal may determine an appeal on the papers if the Tribunal considers it appropriate.

(2)

Before doing so, the Tribunal must give the parties a reasonable opportunity to comment on whether the proceeding should be dealt with in that manner.

114 Determination of appeal

(1)

The Tribunal may require the Commissioner to provide either or both of the following:

(a)

a written report setting out the considerations to which the Commissioner had regard in making the access direction:

(b)

any information held by the Commissioner relating to the making of the access direction that is required to determine the appeal.

(2)

At the hearing of an appeal (other than an appeal determined on the papers), the Commissioner is entitled to appear in person, or by his or her a representative, and be heard.

(3)

The Tribunal may determine an appeal by—

(a)

confirming the direction appealed against:

(b)

modifying the direction appealed against:

(c)

reversing the direction appealed against.

(4)

The Tribunal may award damages in accordance with section 108.

Miscellaneous

114A Proceedings involving access to personal information

(1)

This section applies if

(a)

proceedings are commenced in the Tribunal under section 102 or 103 in respect of a complaint about a decision made by an agency under subpart 1 of Part 4 to refuse access to personal information; or

(b)

an appeal is lodged in the Tribunal under section 110 against an access direction directing an agency to provide access to personal information.

(2)

During the proceedings the Tribunal may, for the purpose of determining whether the agency may properly refuse access to personal information, do either or both of the following:

(a)

require the agency to produce the personal information to the members of the Tribunal (but to no other person):

(b)

allow the agency to give evidence and make submissions in the absence of

(i)

other parties; and

(ii)

all lawyers (if any) representing those other parties; and

(iii)

all members of the public.

(3)

However, the Tribunal may only exercise the powers in subsection (2) if it is necessary to do so to avoid compromising the matters that the agency considers justify refusing access to the personal information.

115 Costs

(1)

In any proceedings under section 102, 103, 109, or 110, the Tribunal may award costs against either party whether or not it makes any other order.

(2)

If, in any proceedings before the Tribunal or a court, costs are ordered to be paid by the Director, those costs must be paid by the Commissioner.

(3)

The Commissioner is not entitled to be indemnified by the aggrieved individual in respect of any costs the Commissioner is required to pay under subsection (1).

Compare: 1993 No 28 ss 85(2), (3), 86(4)

116 Certain provisions of Human Rights Act 1993 to apply

(1)

Sections 92Q to 92W and Part 4 of the Human Rights Act 1993 apply, with any necessary modifications, Except to the extent modified by this subpart, the provisions of the Human Rights Act 1993 specified in subsection (2) apply to proceedings under section 102, 103, 109, or 110 of this Act as if they were proceedings under the Human Rights Act 1993.

(2)

The provisions of the Human Rights Act 1993 referred to in subsection (1) are

(a)

sections 92Q to 92W; and

(b)

Part 4 (except sections 96, 97, 108A, and 108B).

Compare: 1993 No 28 s 89

Part 6 Notifiable privacy breaches and compliance notices

Subpart 1—Notifiable privacy breaches

117 Interpretation

(1)

In this subpart,—

affected individual, in relation to personal information that is the subject of a privacy breach,—

(a)

means the individual to whom the information relates; and

(b)

includes an individual inside or outside New Zealand; and

(c)

despite the definition of individual in section 6(1), includes a deceased person—

(i)

if a sector-specific code of practice issued under section 35 specifies that the code applies to information about deceased persons; and

(ii)

to the extent that the code of practice applies 1 or more IPPs to that information

notifiable privacy breach means a privacy breach that has caused any of the types of harm listed in section 75(2)(b) to an affected individual or individuals or there is a risk it will do so

notifiable privacy breach

(a)

means a privacy breach that it is reasonable to believe has caused serious harm to an affected individual or individuals or is likely to do so (see section 117A for factors that must be considered by an agency when assessing whether a privacy breach is likely to cause serious harm); but

(b)

does not include a privacy breach if the personal information that is the subject of the breach is held by an agency who is an individual and the information is held solely for the purposes of, or in connection with, the individual’s personal or domestic affairs

privacy breach, in relation to personal information held by an agency,—

(a)

means—

(i)

unauthorised or accidental access to, or disclosure, alteration, loss, or destruction of, the personal information; or

(ii)

an action that prevents the agency from accessing the information on either a temporary or permanent basis; and

(b)

includes any of the things listed in paragraph (a)(i) or an action under paragraph (a)(ii), whether or not it—

(i)

was caused by a person inside or outside the agency; or

(ii)

is attributable in whole or in part to any action by the agency; or

(iii)

is ongoing.

(2)

For the purposes of this subpart, the meanings of access, disclosure, and loss are not limited by the use of those words or the meanings ascribed to them elsewhere in this Act.

Compare: 1956 No 65 s 22B

117A Assessment of likelihood of serious harm being caused by privacy breach

When an agency is assessing whether a privacy breach is likely to cause serious harm in order to decide whether the breach is a notifiable privacy breach, the agency must consider the following:

(a)

any action taken by the agency to reduce the risk of harm following the breach:

(b)

whether the personal information is sensitive in nature:

(c)

the nature of the harm that may be caused to affected individuals:

(d)

the person or body that has obtained or may obtain personal information as a result of the breach (if known):

(e)

whether the personal information is protected by a security measure:

(f)

any other relevant matters.

118 Agency to notify Commissioner of notifiable privacy breach

An agency must notify the Commissioner as soon as practicable after becoming aware that a notifiable privacy breach has occurred.

119 Agency to notify affected individual or give public notice of notifiable privacy breach

(1)

An agency must notify an affected individual as soon as practicable after becoming aware that a notifiable privacy breach has occurred, unless subsection (2) or an exception in section 120 applies or a delay is permitted under section 120(3A).

(2)

If it is not reasonably practicable to notify an affected individual or each member of a group of affected individuals, the agency must instead give public notice of the privacy breach, unless an exception in section 120 applies or a delay is permitted under section 120(3A).

(3)

Public notice must be given—

(a)

in a form in which no affected individual is identified; and

(b)

in accordance with any regulations made under section 213(1)(a).

(4)

If subsection (2) or an exception in section 120 is relied on, the agency must notify the affected individual or individuals at a later time if—

(a)

circumstances change so that subsection (2) or the exception no longer applies; and

(b)

at that later time, there is or remains a risk that the privacy breach will cause any of the types of harm listed in section 75(2)(b) serious harm to the affected individual or individuals.

(5)

A failure to notify an affected individual or give public notice under this section may be an interference with privacy under this Act (see section 75(2)(a)(iv)).

120 Exceptions to obligations to notify affected individual or give public notice of notifiable privacy breachExceptions to or delay in complying with requirement to notify affected individuals or give public notice of notifiable privacy breach

(1)

An agency is not required to notify an affected individual or give public notice of a notifiable privacy breach if the agency believes that the notification or notice would be likely to—

(a)

prejudice the security or defence of New Zealand or the international relations of the Government of New Zealand; or

(b)

prejudice the maintenance of the law by any public sector agency, including the prevention, investigation, and detection of offences, and the right to a fair trial; or

(c)

endanger the safety of any person; or

(d)

reveal a trade secret.

(2)

An agency is not required to notify an affected individual or give public notice (relating to a particular individual) of a notifiable privacy breach—

(a)

if the individual is under the age of 16 and the agency is satisfied believes that the notification or notice would be contrary to that individual’s interests; or

(b)

if, after consultation is undertaken by the agency with the individual’s health practitioner (where practicable), the agency is satisfied believes that the notification or notice would be likely to prejudice the physical or mental health of the individual.

(3)

If an agency decides not to notify an affected individual for either of those reasonsIf subsection (2) applies, the agency must—

(a)

consider whether it would be appropriate to notify a representative instead of the individual (if a representative is known or can be readily identified); and

(b)

before deciding whether to notify a representative, take into account the circumstances of both the individual and the privacy breach; and

(c)

if the agency decides it is appropriate to notify a representative and has identified a representative, notify that person.

(3A)

An agency may delay notifying an affected individual or giving public notice of a notifiable privacy breach (but not delay notifying the Commissioner) only

(a)

if the agency believes that a delay is necessary because notification or public notice may have risks for the security of personal information held by the agency and those risks outweigh the benefits of informing affected individuals; and

(b)

for a period during which those risks continue to outweigh those benefits.

(3B)

An agency may rely on an exception, or delay in notifying affected individuals or giving public notice, under this section and, in relation to a delay, do so for the period referred to in subsection (3A)(b), only if the agency believes on reasonable grounds that the exception applies, the ground for delay exists, or the circumstances referred to in subsection (3A)(b) continue to exist.

(4)

The agency must advise the Commissioner as soon as practicable if

(a)

the agency relies on subsection (1) and does not notify an affected individual or give public notice of the breach; or

(b)

the agency

(i)

relies on subsection (2) and does not notify an affected individual or give public notice of the breach; and

(ii)

cannot or decides not to notify a representative of that individual.

(5)

In this section, representative,

(a)

for an affected individual under the age of 16, means his or her parent or guardian:

(b)

for an affected individual aged 16 or over, means an individual appearing to be lawfully acting on that individual’s behalf or in that individual’s interests.

(4)

In this section,

health practitioner has the meaning given to it in section 52(2)

representative,

(a)

of an affected individual under the age of 16, means that individual’s parent or guardian:

(b)

of an affected individual aged 16 or over, means an individual appearing to be lawfully acting on that individual’s behalf or in that individual’s interests.

Compare: 1982 No 156 s 6

121 Requirements for notification

(1)

A notification to the Commissioner under section 118 must—

(a)

describe the notifiable privacy breach, including—

(i)

the number of affected individuals (if known); and

(ii)

the identity of any person or body that the agency suspects may be in possession of personal information as a result of the privacy breach (if known); and

(b)

explain the steps that the agency has taken or intends to take in response to the privacy breach, including whether any affected individual has been or will be contacted; and

(c)

if the agency is relying on section 119(2) to give public notice of the breach, set out the reasons for relying on that section; and

(d)

if the agency is relying on an exception to notification of affected individuals in an exception, or is delaying notifying an affected individual or giving public notice, under section 120, state the exception relied on and set out the reasons for relying on it or state the reasons why a delay is needed and the expected period of delay; and

(e)

state the names or give a general description of any other agencies that the agency has contacted about the privacy breach and the reasons for having done so; and

(f)

give details of a contact person within the agency for inquiries.

(2)

A notification to an affected individual under section 119 or a representative under section 120(3) must—

(a)

describe the notifiable privacy breach and state whether the agency has or has not identified any person or body that the agency suspects may be in possession of the affected individual’s personal information (but, except as provided in subsection (2A), must not include any particulars that could identify that person or body); and

(b)

explain the steps taken or intended to be taken by the agency in response to the privacy breach; and

(c)

where practicable, set out the steps the affected individual may wish to take to mitigate or avoid potential loss or harm (if any); and

(d)

confirm that the Commissioner has been notified under section 118; and

(e)

state that the individual has the right to make a complaint to the Commissioner; and

(f)

give details of a contact person within the agency for inquiries.

(2A)

A notification to an affected individual or their representative may identify a person or body that has obtained or may obtain that affected individual’s personal information (where the identity is known) if a serious threat exists to the life or health of the affected individual or any other person.

(3)

A notification to an affected individual must not include any particulars about any other affected individuals.

(4)

In order to comply with the requirement under sections 118 and 119 that notification must be made as soon as practicable, an agency may provide the information required by this section incrementally. However, any information that is available at any point in time must be provided as soon as practicable after that point in time.

122 Offence to fail to notify Commissioner

(1)

An agency that, without reasonable excuse, fails to notify the Commissioner of a notifiable privacy breach under section 118 commits an offence and is liable on conviction to a fine not exceeding $10,000.

(2)

It is not a defence to a charge under this section that the agency

(a)

did not consider the privacy breach to be a notifiable privacy breach, if, in the circumstances, it was reasonable for the agency to have done so; or

(b)

has taken steps to address the privacy breach.

(2)

It is not a defence to a charge under this section that the agency has taken steps to address the privacy breach.

(3)

It is a defence to a charge under this section that an agency did not consider the privacy breach to be a notifiable privacy breach, but only if it was reasonable to do so in the circumstances.

(4)

Despite section 211(1)(a), an employee does not commit an offence under this section if anything they do or omit to do results in their employer failing to notify the Commissioner under section 118.

122A Liability of principals

(1)

This section applies to any process or proceeding under this Act relating to a failure to notify an affected person, or give public notice, of a notifiable privacy breach under section 119.

(2)

Anything relating to a notifiable privacy breach that is known by an agent is to be treated as being known by the principal agency.

(3)

To avoid doubt, section 211(1)(b) also applies to cases to which this section applies.

123 Publication of identity of agencies in certain circumstances

(1)

The Commissioner may publish the identity of an agency that has notified the Commissioner of a notifiable privacy breach if—

(a)

the agency consents to publication; or

(b)

the Commissioner is satisfied that it is in the public interest to do so.

(2)

This section does not prevent the publication of details of any notifiable privacy breach in a form in which the agency or any affected individual is not identified and for the purpose of informing the public about the extent and nature of privacy breaches.

Subpart 2—Compliance notices

124 Compliance notices

(1)

The Commissioner may issue a compliance notice to an agency if he or she the Commissioner considers that 1 or both of the following may have occurred:

(a)

a breach of this Act, including an action listed in section 75(2)(a) or non-compliance with a PRPP:

(b)

an action that is to be treated as a breach of an IPP or an interference with the privacy of an individual under another Act.

(2)

Before issuing a compliance notice, the Commissioner may, but is not required to,—

(a)

assess whether any person has suffered harm (for example, the types of harm listed in section 75(2)(b)):

(b)

use other means under this Act or another Act for dealing with the breach.

(3)

A compliance notice may be issued at any time, including concurrently with the use of any other means for dealing with the breach.

Example

The Commissioner issues a compliance notice while dealing with the same breach as a complaint under Part 5.

125 Issuing compliance notice

(1)

The Commissioner must consider the following factors before issuing a compliance notice:

(a)

whether there is another means under this Act or another Act for dealing with the breach:

(b)

the seriousness of the breach:

(c)

the likelihood of a repeat of the breach:

(d)

the number of people who may be or are affected by the breach:

(e)

whether the agency has been co-operative in all dealings with the Commissioner:

(f)

the likely costs to the agency of complying with the notice.

(2)

However, each of those factors need be considered only to the extent that—

(a)

it is relevant in the Commissioner’s view:

(b)

information about the factor is readily available to the Commissioner.

(3)

Before issuing a compliance notice, the Commissioner must provide the agency concerned with a reasonable opportunity to comment on a written notice that—

(a)

describes the breach, citing the relevant statutory provision or provisions; and

(b)

summarises the conclusions reached about the factors in subsection (1) that have been considered by the Commissioner; and

(c)

describes particular steps that the Commissioner considers need to be taken to remedy the breach (if any) and any conditions he or she the Commissioner considers appropriate (if any); and

(d)

states the date or dates by which the Commissioner proposes that the agency must remedy the breach and report to the Commissioner (if any).

(4)

In each case, the Commissioner must determine the period of time that will give the agency a reasonable opportunity to comment, taking into account the circumstances of the case.

(5)

For the purpose of this subpart,—

breach means any of the things described in section 124(1)(a) and (b):

remedy the breach means to comply with the relevant statutory provision or provisions.

126 Form and service of compliance notice

(1)

A compliance notice issued to an agency must—

(a)

state the name of the agency; and

(b)

describe the breach, citing the relevant statutory provision or provisions; and

(c)

require the agency to remedy the breach; and

(d)

inform the agency of the right of appeal under section 131; and

(e)

contain any other information required by any regulations made under section 213(1)(b).

(2)

A compliance notice issued to an agency may—

(a)

identify particular steps that the Commissioner considers need to be taken by the agency to remedy the breach:

(b)

include conditions that the Commissioner considers are appropriate:

(c)

state the date or dates by which the agency must—

(i)

remedy the breach; and

(ii)

report to the Commissioner on the steps taken to do so:

(d)

include other information that the Commissioner considers would be useful.

Compare: 1993 No 28 s 114D

127 Agency response to compliance notice

(1)

An agency that is served with is issued with a compliance notice must take steps to comply with the notice, including taking any particular steps specified in the notice.

(2)

The agency must do so as soon as practicable after receiving the compliance notice and must remedy the breach by the date stated in the notice unless that date is varied or modified, or the notice is cancelled or suspended, under this subpart.

128 Commissioner may vary or cancel compliance notice

(1)

The Commissioner may vary or cancel a compliance notice at any time if he or she the Commissioner considers that—

(a)

any of the information listed in section 126 needs to be added to or amended in the notice; or

(b)

all or part of the notice has been complied with; or

(c)

all or part of the notice is no longer needed.

(2)

The Commissioner must give written notice to the agency concerned of a decision under this section.

(3)

The notice must inform the agency of the right to appeal under section 131.

(4)

A variation or cancellation of a compliance notice takes effect on the first working day after the day on which the notice of the decision is given to the agency.

Compare: 1993 No 28 s 114E

129 Commissioner’s power to obtain information

(1)

Before deciding whether to issue a compliance notice or to vary or cancel a compliance notice, the Commissioner may hear or obtain information from any person who the Commissioner considers may have relevant information.

(2)

Sections 90 91 to 94 95 apply as if the Commissioner were carrying out an investigation under Part 5.

(3)

Except as provided for in sections 90 91 to 94 95, the Commissioner may regulate his or her the Commissioner’s procedure as he or she thinks fit the Commissioner considers appropriate.

Compare: 1993 No 28 ss 90, 114C

129A Publication of details of compliance notice

(1)

The Commissioner must publish the following information:

(a)

the identity of an agency to whom or which a compliance notice has been issued:

(b)

other details about the compliance notice or the breach that is the subject of the notice, that the Commissioner considers should be published:

(c)

a statement or comment about the breach, that the Commissioner considers is appropriate in the circumstances.

(2)

Publication of all or part of the listed information is not required if

(a)

an agency satisfies the Commissioner that publication of the information would result in undue hardship to the agency; and

(b)

in the Commissioner’s view, that hardship outweighs the public interest in publication.

Proceedings

130 Enforcement of compliance notice

(1)

The Commissioner may take enforcement proceedings in the Human Rights Review Tribunal—

(a)

if the time for an appeal under section 131 has passed and no appeal has been lodged against a compliance notice; and

(b)

if—

(i)

the Commissioner has reason to believe that the agency has not remedied or will not remedy the breach by the date stated in the notice; or

(ii)

the agency has failed to report to the Commissioner on the steps taken to remedy the breach by the date stated in the notice.

(2)

An agency may object to enforcement of a compliance notice only on the ground that the agency believes that the notice has been fully complied with.

(3)

In proceedings under this section, the Tribunal—

(a)

must not examine or make any determination about the issuing or merits of a compliance notice:

(b)

may examine and make a determination about whether a compliance notice has been fully complied with:

(c)

may order a remedy under section 133(1)(a).

(4)

Proceedings under this section may be heard by the Chairperson sitting alone unless the Chairperson considers that, because of the issues involved, it would be more appropriate for the proceedings to be heard by the Tribunal.

Compare: 1988 No 110 s 45

131 Appeal against compliance notice or Commissioner’s decision under section 128 to vary or cancel notice

(1)

An agency that has been issued with a compliance notice may appeal to the Human Rights Review Tribunal—

(a)

against all or part of the notice; or

(b)

against a decision by the Commissioner under section 128 to vary or cancel the notice.

(2)

An appeal must be lodged within 15 working days from the day on which the compliance notice is issued or the notice of the decision is given to the agency.

(3)

The Tribunal may allow an appeal and order a remedy under section 133(1)(b) if it considers that—

(a)

the compliance notice or decision against which the appeal is brought is not in accordance with the law; or

(b)

to the extent that the compliance notice or decision involved an exercise of discretion by the Commissioner, the Commissioner ought to have exercised his or her that discretion differently; or

(c)

the agency has fully complied with the compliance notice.

(4)

The Tribunal may review any determination of fact on which the compliance notice or decision was based.

(5)

The Tribunal must not cancel or modify a compliance notice for the reason that—

(a)

the breach was unintentional or without negligence on the part of the agency; or

(b)

the agency has taken steps to remedy the breach, unless there is no further reasonable step that the agency can take to do so.

Compare: 1993 No 28 s 114G

132 Interim order suspending compliance notice pending appeal

(1)

The Chairperson of the Tribunal may make an interim order suspending all or part of a compliance notice for a certain period until an appeal is determined if he or she is satisfied that it is necessary and in the interests of justice to make the order.

(2)

If an interim order is made, a party may apply to the High Court to vary or rescind the order, unless the order was made with that party’s consent.

(3)

An application under subsection (2) may be made to the High Court only with the leave of the Tribunal.

(a)

made only with the leave of the Tribunal:

(b)

made instead of, but not as well as, an appeal against the interim order under section 123(1) of the Human Rights Act 1993.

(4)

An application may be made instead of, but not as well as, an appeal against the interim order under section 123(1) of the Human Rights Act 1993.

Compare: 1993 No 82 ss 95, 96

133 Remedies, costs, and enforcement

(1)

The Human Rights Review Tribunal may,—

(a)

in enforcement proceedings under section 130, grant 1 or more both of the following remedies:

(i)

an order that the agency comply with a compliance notice by a date specified in the order (which may vary from the date originally stated in the notice):

(ii)

an order that the agency perform any act specified in the order by a date specified in the order (for example, reporting to the Commissioner on progress in complying with the compliance notice):

(b)

in an appeal under section 131, grant 1 or more both of the following remedies:

(i)

an order that confirms, cancels, or modifies the compliance notice; or

(ii)

an order that confirms, overturns, or modifies the decision:

(c)

in either type of proceeding, award costs as the Tribunal thinks fit considers appropriate.

(2)

An award of costs may, on registration of a certified copy of the Tribunal’s decision, be enforced in the District Court as if it were an order of that court.

(3)

An agency that, without reasonable excuse, fails to comply with an order under subsection (1)(a) or with a compliance notice that is confirmed or modified under subsection (1)(b)(i) commits an offence and is liable on conviction to a fine not exceeding $10,000.

Compare: 1993 No 28 s 85; 1993 No 82 s 121

134 Application of Human Rights Act 1993

Except to the extent expressly modified by this subpart, Part 4 of the Human Rights Act 1993 (except sections 95, 96, 97, 108A, and 108B) applies to proceedings under this subpart with any necessary modifications.

Compare: 1993 No 28 s 114H

135 Commissioner may be represented in proceedings

In proceedings under this subpart, the Commissioner is entitled to appear in person or to be represented by counsel a lawyer or an agent.

Part 7 Sharing, accessing, and matching personal information

Subpart 1—Information sharing

136 Purpose of this subpart

The purpose of this subpart is to authorise agencies to share personal information in accordance with an authorised approved information sharing agreement to facilitate the provision of public services.

Compare: 1993 No 28 s 96A

137 Relationship between subpart 1 and other law relating to information disclosure

(1)

To avoid doubt, nothing in this subpart—

(a)

limits the collection, use, or disclosure of personal information that is authorised or required by or under any enactment; or

(b)

compels agencies to enter into an information sharing agreement if those agencies are already allowed to share personal information—

(i)

by or under any other enactment; or

(ii)

because an exemption from or a modification to 1 or more of the IPPs or any code of practice is not required to make the sharing of the information lawful.

(2)

Without limiting subsection (1)(a),—

(a)

this subpart does not limit section 22, 25, or 27; and

(b)

this subpart and subparts 2 to 4 do not limit one another.

(3)

An information sharing agreement may—

(a)

duplicate an information sharing provision by providing for an agency to share the same personal information specified in the information sharing provision—

(i)

with the same agencies specified in the information sharing provision; and

(ii)

for the same purposes specified in the information sharing provision; or

(b)

extend an information sharing provision that is not a restricted information sharing provision by providing for an agency to share the same personal information specified in the information sharing provision—

(i)

with the same agencies specified in the information sharing provision for a purpose not specified in the information sharing provision; or

(ii)

with an agency not specified in the information sharing provision for a purpose specified in the information sharing provision; or

(iii)

with an agency not specified in the information sharing provision and for a purpose not specified in the information sharing provision; or

(c)

duplicate a restricted information sharing provision by providing for an agency to share the same personal information as specified in the restricted information sharing provision—

(i)

with the same agencies specified in the restricted information sharing provision; and

(ii)

for the same purposes specified in the restricted information sharing provision; or

(d)

extend in any manner specified in paragraph (b) a restricted information sharing provision, but only if—

(i)

the restricted information sharing provision is an information matching provision (as defined in section 178 177); or

(ii)

there is express statutory authorisation to do so.

(4)

In subsection (3),—

information sharing provision means a provision in any enactment other than this Act that authorises or requires the sharing of personal information by an agency with 1 or more other agencies for 1 or more specified purposes

restricted information sharing provision means an information sharing provision that expressly restricts the purposes for which the personal information may be shared to those purposes specified.

Compare: 1993 No 28 s 96B

138 Interpretation

In this subpart, unless the context otherwise requires,—

adverse action has the meaning given to it by in section 177

approved information sharing agreement means an information sharing agreement approved by an Order in Council that is for the time being in force

code of practice means a code of practice issued under section 35

department has the meaning given to it by in section 6 and also includes—

(a)

the New Zealand Police:

(b)

the New Zealand Transport Agency

information sharing agreement or agreement means an agreement between or within agencies that enables the sharing of personal information (whether or not the sharing also includes information that is not personal information) to facilitate the provision of a public service

lead agency means a department or specified organisation that enters into an information sharing agreement and is designated as the lead agency in—

(a)

the agreement; and

(b)

the Order in Council approving the agreement

local authority means a local authority or public body named or specified in Schedule 1 of the Local Government Official Information and Meetings Act 1987

Order in Council, except in section 161, means an Order in Council made under section 145(1)

organisation means—

(a)

an organisation named in Part 2 of Schedule 1 of the Ombudsmen Act 1975; and

(b)

an organisation named in Schedule 1 of the Official Information Act 1982

private sector agency means a non-government agency

public sector agency means a department, an organisation, or a local authority

public service means a public function or duty that is conferred or imposed on a public sector agency—

(a)

by or under law; or

(b)

by a policy of the Government

relevant Minister means the Minister who, under the authority of any warrant or with the authority of the Prime Minister, is for the time being responsible for a lead agency

sharing, in relation to any information referred to in an approved information sharing agreement, means all or any of the following activities if authorised by an approved information sharing agreement:

(a)

collecting the information:

(b)

storing the information:

(c)

checking the information:

(d)

using the information:

(e)

disclosing the information:

(f)

exchanging the information:

(g)

if necessary, assigning a unique identifier to an individual

specified organisation means any of the following organisations:

(a)

the Accident Compensation Corporation:

(b)

the Civil Aviation Authority of New Zealand:

(c)

a district health board:

(d)

the Earthquake Commission:

(e)

Education New Zealand:

(f)

Fire and Emergency New Zealand:

(g)

Housing New Zealand Corporation:

(h)

the New Zealand Qualifications Authority:

(i)

the Tertiary Education Commission:

(j)

WorkSafe New Zealand.

Compare: 1993 No 28 s 96C

139 Information sharing between agencies

An approved information sharing agreement may authorise an agency to share any personal information with 1 or more other agencies in accordance with the terms of the agreement.

Compare: 1993 No 28 s 96D

140 Information sharing within agencies

An approved information sharing agreement may authorise a part of an agency to share any personal information with 1 or more parts of the same agency in accordance with the terms of the agreement.

Compare: 1993 No 28 s 96E

141 Parties to information sharing agreement

(1)

Two or more of the following may enter into an information sharing agreement:

(a)

a public sector agency:

(b)

a private sector agency:

(c)

a part of a public sector agency:

(d)

a part of a private sector agency.

(2)

Subsection (1) is subject to subsections (3) and (4).

(3)

An overseas agency may not enter into an information sharing agreement.

(4)

At least 1 of the agencies that enters into an information sharing agreement must be—

(a)

a public sector agency that is a department or specified organisation; or

(b)

part of a public sector agency that is a department or specified organisation.

Compare: 1993 No 28 s 96F

142 Agreement may apply to classes of agencies

(1)

An agency (A) may enter into an information sharing agreement with a department or specified organisation that specifies a class of agencies to which the agreement may apply.

(2)

At any time after an agreement has been entered into, an agency (not being a department or specified organisation) that is a member of a class of agencies specified in the agreement may become a party to the agreement by the lead agency naming that agency as a party in a schedule to the agreement (a Schedule of Parties).

(2)

At any time after an agreement has been entered into, the lead agency may

(a)

agree to an agency (not being a department or specified organisation) that is a member of a class of agencies specified in the agreement becoming a party to the agreement; and

(b)

name that agency as a party in a schedule to the agreement (the Schedule of Parties).

(3)

If at any time an agency named in the Schedule of Parties no longer wishes to be a party to the agreement, the lead agency must, on the request of that agency, remove the agency’s name from the Schedule of Parties.

(4)

A lead agency need not obtain the consent of any other party to the agreement before—

(a)

naming an agency in the Schedule of Parties; or

(b)

removing the name of an agency from the Schedule of Parties.

(5)

An agency that becomes a party to the agreement under subsection (2) may, but need not, share or participate in the sharing of any personal information with 1 or more other agencies in accordance with the terms of the agreement.

(6)

Unless the context otherwise requires, every reference in this Part to a party to an information sharing agreement includes an agency that becomes a party to an agreement under subsection (2) or (3).

Compare: 1993 No 28 s 96G

143 Lead agency

(1)

If only 1 public sector agency that is a department or specified organisation enters into an information sharing agreement, it must be designated as the lead agency for the agreement.

(2)

If more than 1 public sector agency that is a department or specified organisation enters into an information sharing agreement, the parties to the agreement may agree between themselves which of those public sector agencies is to be designated as the lead agency.

Compare: 1993 No 28 s 96H

144 Form and content of information sharing agreement

(1)

An information sharing agreement must be in writing.

(2)

An information sharing agreement must—

(a)

specify with due particularity the purpose of the information sharing agreement:

(b)

set out the information referred to in section 146:

(c)

contain an overview of the operational details about the sharing of information under the agreement:

(d)

specify the safeguards that will apply to protect the privacy of individuals and ensure that any interference with their privacy is minimised:

(e)

if a party to the agreement is a private sector agency, state which public sector agency will be responsible for dealing with complaints about an alleged interference with privacy if the private sector agency is unable to be held to account for those complaints:

(f)

state that every party to the agreement must give any reasonable assistance that is necessary in the circumstances to allow the Commissioner or an individual who wishes to make a complaint about an interference with privacy to determine the agency against which the complaint should be made:

(g)

if entered into under section 142,—

(i)

designate an agency as the lead agency; and

(ii)

specify with due particularity the class of agencies to which the agreement may apply; and

(iii)

include a schedule that sufficiently identifies the agencies within that class that are parties to the agreement.

(3)

An information sharing agreement may specify any other terms or conditions that the parties may agree to, including—

(a)

the fees and charges that are payable under the agreement; and

(b)

any other business processes relating to the sharing of information under the agreement.

Compare: 1993 No 28 s 96I

145 Governor-General may approve information sharing agreement by Order in Council

(1)

The Governor-General may, by Order in Council made on the recommendation of the relevant Minister, approve an information sharing agreement.

(2)

An Order in Council may grant an exemption from or modify the application of—

(a)

1 or more of the IPPs (except IPPs 6 and 7):

(b)

any code of practice (except a code of practice that modifies IPPs 6 and 7).

(3)

An Order in Council that, under subsection (2), grants an exemption from 1 or more of the IPPs (except IPPs 6 and 7) or a code of practice (except a code of practice that modifies IPPs 6 and 7) may provide that the exemption is unconditional or is subject to any conditions that are prescribed in the Order in Council.

(4)

An Order in Council that, under subsection (2), modifies the application of 1 or more of the IPPs or any code of practice may do so by prescribing standards that are more stringent or less stringent than the standards that are prescribed by the principle IPP or, as the case may be, the code of practice.

Compare: 1993 No 28 s 96J

146 Requirements for Order in Council

An Order in Council made under section 145(1) must—

(a)

state, if applicable,—

(i)

the nature of the exemption granted under section 145(2) and the conditions of the exemption (if any):

(ii)

how any IPPs or codes of practice will be modified under section 145(2):

(b)

state the public service or public services the provision of which the information sharing agreement is intended to facilitate:

(c)

specify with due particularity the personal information or the type of personal information to be shared under the agreement:

(d)

set out the parties, or classes of parties, to the agreement and designate one of the parties as the lead agency:

(e)

for every party to the agreement,—

(i)

describe the personal information or type of personal information that the party may share with each of the other parties; and

(ii)

state how the party may use the personal information; and

(iii)

state the adverse actions that the party can reasonably be expected to take as a result of the sharing of personal information received under the agreement; and

(iv)

specify the procedure that the party must follow before taking adverse action against an individual as a result of the sharing of personal information received under the agreement if the requirement in section 152(1) does not apply because of section 153(a)(ii):

(f)

for every class of agency to which the agreement may apply (if any),—

(i)

describe the personal information or type of personal information that a member of that class of agency that becomes a party to the agreement (a prospective party) may share with each of the other parties; and

(ii)

state how a prospective party may use the personal information; and

(iii)

state the adverse actions that a prospective party can reasonably be expected to take as a result of sharing personal information under the agreement; and

(iv)

specify the procedure that a prospective party must follow before taking adverse action against an individual as a result of sharing personal information under the agreement if the requirement in section 152(1) does not apply because of section 153(a)(ii):

(g)

state the Internet site address where a copy of the agreement can be accessed.

Compare: 1993 No 28 s 96K

147 Further provisions about Order in Council

(1)

An Order in Council made under section 145(1) must provide that it comes into force on a date specified in the Order in Council (which must not be a date that is before earlier than the date on which it is made).

(2)

An Order in Council made under section 145(1) must insert into Schedule 3

(a)

a description of each of the following:

(i)

the information sharing agreement that is approved by the Order in Council:

(ii)

the public service or the public services the provision of which the agreement is intended to facilitate:

(iii)

the personal information or type of personal information that may be shared between or within the agencies that are party to the agreement; and

(b)

the name of the agreement; and

(c)

the name of the lead agency for the agreement; and

(d)

the Internet site address where a copy of the agreement can be accessed.

Compare: 1993 No 28 s 96L

148 Status of Order in Council

For the purposes of the Legislation Act 2012, an Order in Council made under section 145(1) is a legislative instrument and a disallowable instrument and must be presented to the House of Representatives under section 41 of that Act.

Compare: 1993 No 28 s 96M

149 Matters to which relevant Minister must have regard before recommending Order in Council

(1)

Before recommending the making of an Order in Council under section 145(1), the relevant Minister must—

(a)

be satisfied of the matters set out in subsection (2); and

(b)

have regard to any submissions made under section 150(1)(a) in relation to the information sharing agreement that is proposed for approval by the Order in Council.

(2)

The matters referred to in subsection (1)(a) are as follows:

(a)

that the information sharing agreement will facilitate the provision of a particular public service or particular public services:

(b)

that the type and quantity of personal information to be shared under the agreement are no more than is necessary to facilitate the provision of that public service or those public services:

(c)

that the agreement does not unreasonably impinge on the privacy of individuals and contains adequate safeguards to protect their privacy:

(d)

that the benefits of sharing personal information under the agreement are likely to outweigh the financial and other costs of sharing it:

(e)

that any potential conflicts or inconsistencies between the sharing of personal information under the agreement and any other enactment have been identified and appropriately addressed.

Compare: 1993 No 28 s 96N

150 Consultation on proposed information sharing agreement

(1)

The parties proposing to enter into an information sharing agreement must, before the proposed agreement is concluded,—

(a)

consult and invite submissions on the proposed agreement from,—

(i)

the Commissioner; and

(ii)

any person or organisation that the agencies consider represents the interests of the classes of individuals whose personal information will be shared under the proposed agreement; and

(iii)

any person or organisation that the parties consider represents the interests of any specified class of agency to which the agreement may apply; and

(iv)

any other person or organisation that the agencies consider should be consulted; and

(b)

have regard to any submissions made under paragraph (a).

(2)

The Commissioner—

(a)

must consider the privacy implications of the proposed agreement; and

(b)

may make any submissions under subsection (1)(a)(i) that he or she thinks fit the Commissioner considers appropriate.

(3)

The agencies must give the relevant Minister a copy of the submissions made under subsection (1)(a) (if any).

Compare: 1993 No 28 s 96O

151 Commissioner may prepare and publish report on approved information sharing agreement

(1)

If an information sharing agreement is approved by Order in Council, the Commissioner may prepare a report for the relevant Minister on any matter relating to privacy that arises or is likely to arise in respect of the agreement.

(2)

Without limiting subsection (1), the Commissioner may include in a the report under that subsection

(a)

any comment that he or she the Commissioner wishes to make about the consultation that the agencies carried out under section 150(1)(a); and

(b)

any submissions that he or she the Commissioner made to the agencies under section 150(1)(a)(i).

(3)

The Commissioner—

(a)

may publish a report under subsection (1); but

(b)

must consult the relevant Minister before doing so.

Compare: 1993 No 28 s 96P

152 Requirement to give notice of adverse action

(1)

A party to an approved information sharing agreement must give written notice to an individual before it takes any adverse action against the individual on the basis (whether in whole or in part) of personal information about the individual that was shared under the agreement.

(2)

The notice must—

(a)

give details of the adverse action that the party proposes to take and the personal information about the individual on which the action is based; and

(b)

state that the individual has 10 working days from the receipt of the notice within which to dispute the correctness of that personal information.

(3)

To avoid doubt, the individual who is given the notice may take any steps that are available under any enactment to dispute any proposed adverse action against him or her, but the only basis on which he or she the individual may show cause under this section as to why the proposed adverse action should not be taken is that it is based on incorrect personal information.

Compare: 1993 No 28 s 96Q

153 When requirement to give notice of adverse action applies

The requirement to give notice under section 152 applies unless—

(a)

an approved information sharing agreement provides that a party to the agreement may—

(i)

give a shorter period of notice than the 10-working-day period referred to in section 152(2)(b); or

(ii)

dispense with the giving of the notice; or

(b)

if an approved information sharing agreement does not include a provision of the kind specified in paragraph (a), the Commissioner, on the application of a party to an approved information sharing agreement, allows the party in the circumstances of a particular case to—

(i)

give a shorter period of notice than the 10-working-day period referred to in section 152(2)(b); or

(ii)

dispense with the giving of the notice.

Compare: 1993 No 28 s 96R

154 Responsibilities of lead agency

(1)

A lead agency for an information sharing agreement must, if the agreement is approved by Order in Council under section 145(1),—

(a)

make a copy of the agreement—

(i)

available for inspection, free of charge, at the lead agency’s head office on any working day; and

(ii)

accessible, free of charge, on an Internet site maintained by or on behalf of the lead agency; and

(b)

prepare a report on the operation of the agreement at the intervals required by the Commissioner under section 156; and

(c)

carry out any other responsibilities imposed by this Part.

(2)

A lead agency does not need to comply with subsection (1)(a)(ii) if the relevant Minister designates an Internet site maintained by or on behalf of another public sector agency as the Internet site where a copy of the agreement is to be made accessible free of charge.

(3)

To avoid doubt, nothing in this section applies to a party to an information sharing agreement that is not the lead agency except as provided in subsection (2).

Compare: 1993 No 28 s 96S

155 Report of lead agency

(1)

A report prepared by a lead agency under section 154(1)(b) must include the matters prescribed in regulations made under this Act section 213(1)(c) that the Commissioner specifies after having regard to—

(a)

the costs of reporting:

(b)

the degree of public interest in information about the matters prescribed in those regulations:

(c)

the significance of the privacy implications of the approved information sharing agreement.

(2)

A report must be included—

(a)

in the lead agency’s annual report under the Public Finance Act 1989, if it is required annually; or

(b)

in the lead agency’s annual report under the Public Finance Act 1989 that immediately follows the end of each interval specified under section 154(1)(b).

Compare: 1993 No 28 s 96T

156 Commissioner may specify frequency of reporting by lead agency

(1)

The Commissioner may require a lead agency to prepare a report under section 154(1)(b)

(a)

annually; or

(b)

at less frequent intervals that the Commissioner may specify.

(2)

In determining the appropriate frequency in subsection (1) of a report under section 154(1)(b), the Commissioner must have regard to—

(a)

the costs of reporting:

(b)

the degree of public interest in information about the matters prescribed in regulations made under this Act the matters to be included in the report:

(c)

the significance of the privacy implications of the approved information sharing agreement.

Compare: 1993 No 28 s 96U

157 Amendment of approved information sharing agreement

(1)

This section applies if the parties to an approved information sharing agreement amend the agreement (whether in accordance with the Commissioner’s recommendation in a report under section 159(1) or otherwise).

(2)

As soon as practicable after the amendment is made, the lead agency must—

(a)

give written notice of the amendment to—

(i)

the Commissioner; and

(ii)

the relevant Minister; and

(b)

make a copy of the amendment—

(i)

available for inspection, free of charge, at the lead agency’s head office on any working day; and

(ii)

accessible, free of charge, on the Internet site where a copy of the agreement is accessible.

(3)

The information sharing agreement approved by Order in Council continues to have effect as if the amendment notified under subsection (2) had not been made, unless the Governor-General, by a further Order in Council made on the recommendation of the relevant Minister, approves the agreement as amended by the parties.

(4)

Sections 145 to 151 apply, subject to with any necessary modifications, to the approval of the agreement as amended.

(5)

Nothing in sSubsection (2)(a), (3), or (4) applies does not apply if the amendment to an approved information sharing agreement relates only to—

(a)

the fees and charges payable under the agreement; or

(b)

a name or description of a party to the agreement; or

(c)

naming an agency as a party to the agreement under section 142(2); or

(d)

removing an agency as a party to the agreement under section 142(3); or

(e)

any terms or conditions of the agreement that the lead agency, after consulting the Commissioner, considers do not, or are unlikely to, have any effect on the privacy implications of the agreement.

Compare: 1993 No 28 s 96V

158 Review of operation of approved information sharing agreement

(1)

The Commissioner may, on his or her the Commissioner’s own initiative, conduct a review of the operation of an approved information sharing agreement—

(a)

at the end of a period of 12 months after the Order in Council approving the agreement is made; and

(b)

at any time that the Commissioner considers appropriate for any subsequent reviews.

(2)

In conducting a review, the Commissioner must—

(a)

consult the following persons and organisations about the review:

(i)

the parties to the agreement:

(ii)

any person or organisation that the Commissioner considers represents the interests of the classes of individuals whose personal information is being shared under the agreement; and

(b)

consider any submissions made on the review.

(3)

The parties to the agreement must take all reasonable steps to co-operate with the review.

Compare: 1993 No 28 s 96W

159 Report on findings of review

(1)

After completing a review under section 158, the Commissioner may provide a report to the relevant Minister if he or she the Commissioner has reasonable grounds to suspect that an approved information sharing agreement is—

(a)

operating in an unusual or unexpected way (that is, in a way that was not foreseen by the Commissioner or the parties to the agreement at the time the agreement was entered into):

(b)

failing to facilitate the provision of the public service or public services to which it relates:

(c)

unreasonably impinging on the privacy of individuals:

(d)

operating in such a way that the financial and other costs of sharing personal information under the agreement outweigh the benefits of sharing it.

(2)

The Commissioner may recommend in the report that—

(a)

the parties to the agreement should amend it in 1 or more material respects; or

(b)

the Order in Council by which the agreement was approved should be revoked.

Compare: 1993 No 28 s 96X

160 Relevant Minister must present to House of Representatives copy of report under section 159(1) and report setting out Government’s response to House of Representatives

The relevant Minister must—

(a)

present a copy of a report under section 159(1) to the House of Representatives within 5 working days after receiving it from the Commissioner or, if Parliament is not in session, as soon as practicable after the commencement of the next session of Parliament; and

(b)

as soon as practicable after complying with paragraph (a), present a report to the House of Representatives setting out the Government’s response to the report under section 159(1).

Compare: 1993 No 28 s 96Y

161 Power to amend Schedule 3 by Order in Council

(1)

Without limiting the matters that an Order in Council made under section 145 must insert into Schedule 3 in accordance with section 147(2), the Governor-General may, by Order in Council,—

(a)

make any amendments to Schedule 3 that are required—

(i)

to recognise the abolition or dissolution of any agency that is party to an approved information sharing agreement or any change in the name of such an agency; or

(ii)

to reflect any change in the Internet site address where a copy of an approved information sharing agreement can be accessed; or

(iii)

to reflect any amendments to an approved information sharing agreement that are approved under section 157; or

(iv)

to correct any error or omission in any description in that schedule:

(b)

repeal any description or matter in Schedule 3, including all of the descriptions or matters relating to an approved information sharing agreement if the Order in Council by which it was approved has expired or has been revoked:

(c)

otherwise amend or replace Schedule 3.

(2)

To avoid doubt, any of the matters set out in this section may be included in an Order in Council made under section 145 or in a separate Order in Council made under this section.

Compare: 1993 No 28 s 96Z

Subpart 2—Identity information

162 Purpose of this subpart

The purpose of this subpart is to authorise accessing agencies, when carrying out specified functions, to verify the identity of an individual by accessing identity information held about that individual by a holder agency.

163 Relationship between this subpart and other law relating to information disclosure

This subpart does not—

(a)

limit the collection, use, or disclosure of personal information that—

(i)

is authorised or required by or under any enactment; or

(ii)

is permitted by the information privacy principles; or

(b)

limit subpart 1, 3, or 4.

164 Interpretation

In this subpart,—

access, in relation to a database, includes remote access to that database

accessing agency means an agency specified in the first column of Schedule 4

biometric information, in relation to a person, means information that comprises—

(a)

1 or more of the following kinds of personal information:

(i)

a photograph of all or any part of the person’s head and shoulders:

(ii)

impressions of the person’s fingerprints:

(iii)

a scan of the person’s irises; and

(b)

an electronic record of the personal information that is capable of being used for biometric matching

database means any information recording system or facility used by an agency to store information

holder agency means an agency specified in the third column of Schedule 4

identity information, in relation to an individual, means any information that identifies, or relates to the identity of, the individual, and includes (without limitation) the following information:

(a)

the individual’s biographical details (for example, the individual’s name, address, date of birth, place of birth, and gender):

(b)

the individual’s biometric information:

(c)

a photograph or visual image of the individual:

(d)

details of the individual’s—

(i)

New Zealand travel document; or

(ii)

certificate of identity:

(e)

details of any distinguishing features (including tattoos and birthmarks).

165 Access by agencies to identity information

An accessing agency may, for the purpose specified in the second column of Schedule 4 opposite the name of the accessing agency, have access to an individual’s identity information held by a holder agency specified in the third column of that schedule opposite the name of the accessing agency.

166 Manner and form of access

(1)

Access to identity information permitted under section 165 may be facilitated between a holder agency and an accessing agency in the manner agreed by the agencies (for example, by direct access to information stored in a holder agency’s database, or by exchange of information between the agencies).

(2)

Identity information that is held by a holder agency and accessed by an accessing agency under section 165 may be made available to the accessing agency in the form agreed by the agencies.

167 Annual reporting requirement

The chief executive of an accessing agency must include in every annual report prepared by the chief executive for the purposes of section 43 of the Public Finance Act 1989, or any other applicable enactment requiring an annual report to Parliament, details of the operation of this Part and Schedule 4.

168 Power to amend Schedule 4 by Order in Council

(1)

The Governor-General may, by Order in Council made on the recommendation of the responsible Minister given after consultation with the Privacy Commissioner, amend Schedule 4 by—

(a)

inserting, repealing, amending, or replacing any item in Schedule 4; or

(b)

repealing Schedule 4 and substituting a new schedule.

(2)

Before recommending the making of an Order in Council facilitating access by an accessing agency to identity information held by a holder agency, the responsible Minister must be satisfied that—

(a)

the purpose for which the identity information is to be accessed relates to a specified function of the accessing agency; and

(b)

the identity information to be accessed is no more than is reasonably necessary to enable the accessing agency to achieve that purpose; and

(c)

any potential conflicts or inconsistencies between the sharing of personal information under Schedule 4 and any other enactment have been identified and appropriately addressed.

Subpart 3—Law enforcement information

169 Purpose of this subpart

The purpose of this subpart is to authorise specified public sector agencies to have access to law enforcement information held by other specified agencies about identifiable individuals.

170 Relationship between this subpart and other law relating to information disclosure

This subpart does not—

(a)

limit the collection, use, or disclosure of personal information that—

(i)

is authorised or required by or under any enactment; or

(ii)

is permitted by the information privacy principles; or

(b)

limit subpart 1, 2, or 4.

171 Interpretation

In this subpart, unless the context otherwise requires,—

accessing agency means any public sector agency for the time being specified in Schedule 5 as an agency to which law enforcement information held by a holder agency is available

agency includes a court in relation to its judicial functions

holder agency means—

(a)

a court holding law enforcement information described in Schedule 5 as court records; and

(b)

a public sector agency specified in Schedule 5 holding law enforcement information otherwise described in that schedule.

law enforcement information means any information that—

(a)

is about an identifiable individual; and

(b)

is specified in Schedule 5.

Compare: 1993 No 28 s 110

172 Access by accessing agencies to law enforcement information

(1)

An accessing agency may have access to law enforcement information held by a holder agency if such access is authorised by the provisions of Schedule 5.

(2)

Subsection (1) prevails over overrides

(a)

section 237 and Schedule 1 of the District Court Act 2016; and

(b)

section 174 and Schedule 2 of the Senior Courts Act 2016.

Compare: 1993 No 28 s 111

173 Power to amend Schedule 5 by Order in Council

(1)

The Governor-General may, by Order in Council made on the recommendation of the responsible Minister given after consultation with the Privacy Commissioner, amend Schedule 5 by—

(a)

inserting, repealing, amending, or replacing any item in Schedule 5; or

(b)

repealing Schedule 5 and substituting a new schedule.

(2)

However, no Order in Council may be made under subsection (1) that amends law enforcement information in Schedule 5 that is described in that schedule as court records.

Subpart 4—Authorised information matching programmes

174 Purpose of this subpart

The purpose of this subpart is to authorise agencies to compare personal information in accordance with an authorised information matching programme.

175 Application of this subpart

This subpart applies to the disclosure of personal information under an information matching programme authorised by an information matching provision that was specified in Schedule 3 of the Privacy Act 1993 before its repeal.

176 Relationship between this subpart and other law relating to information disclosure

This subpart does not—

(a)

limit the collection, use, or disclosure of personal information that—

(i)

is authorised or required by or under any enactment; or

(ii)

is permitted by the information privacy principles; or

(b)

limit subparts 1 to 3.

177 Interpretation

In this subpart and Schedule 7, unless the context otherwise requires,—

adverse action means any lawful action of an agency that may adversely affect the rights, benefits, privileges, obligations, or interests of any specific individual, including any decision—

(a)

to cancel or suspend any monetary payment:

(b)

to refuse an application for a monetary payment:

(c)

to alter the rate or amount of a monetary payment:

(d)

to recover an overpayment of a monetary payment:

(e)

to impose a penalty:

(f)

to recover a penalty or fine:

(g)

to make an assessment of the amount of any tax, levy, or other charge, or of any contribution, that is payable by an individual, or to alter an assessment of that kind:

(h)

to investigate the possible commission of an offence:

(i)

to make a deportation order in relation to the individual, to serve the individual with a deportation liability notice, or to deport the individual from New Zealand

authorised information matching programme means an information matching programme that is authorised by an information matching provision

discrepancy, in relation to an authorised information matching programme, means a result of that programme that warrants the taking of further action by an agency for the purpose of giving effect to the objective of the programme

information matching programme means the comparison (whether manually or by means of any electronic or other device) of any document that contains personal information about 10 or more individuals with 1 or more other documents that contain personal information about 10 or more individuals, for the purpose of producing or verifying information that may be used for the purpose of taking adverse action against an identifiable individual

information matching provision means any provision specified in the second column of Schedule 6 as an information matching provision of an enactment specified in the first column of that schedule

information matching rules means the rules for the time being set out in Schedule 7

monetary payment includes—

(a)

a benefit within the meaning of section 3(1) as defined in Schedule 2 of the Social Security Act 1964 2018:

(b)

a lump sum payable under section 61DB, 61DC, or 61DD 90 of that Act:

(c)

any special assistance granted out of a Crown Bank Account from money appropriated by Parliament under section 124(1)(d) or (da) 101 of that Act:

(d)

any monetary entitlement payable under Part 4, 10, or 11 of the Accident Compensation Act 2001.

Compare: 1993 No 28 s 97

178 Information matching agreements

(1)

Personal information held by an agency may be disclosed to another agency under an authorised information matching programme only in accordance with a written agreement that—

(a)

is entered into between the agencies; and

(b)

includes provisions that reflect the information matching rules, or provisions that are no less onerous than those rules.

(2)

An agreement may provide that the agencies involved in the authorised information matching programme may charge each other fees for the services provided for the purposes of the programme.

(3)

The parties to an agreement entered into under this section must ensure that a copy of the agreement, and of any amendments subsequently made to the agreement, are immediately forwarded to the Commissioner.

Compare: 1993 No 28 s 99

179 Use of results of authorised information matching programme

(1)

Subject to any other enactment or rule of law that limits or restricts the information that may be taken into account in taking adverse action against an individual, an agency that is involved in an authorised information matching programme may take adverse action against an individual on the basis of any discrepancy produced by that programme.

(2)

If an agency decides to take adverse action against an individual on the basis of a discrepancy produced by an authorised information matching programme, the adverse action must be commenced not later than 12 months after the date on which the agency received or derived information from the programme that gave rise to the discrepancy (or any extended time limit granted by the Commissioner under section 180).

(3)

Subsection (1) does not limit or restrict the use that may lawfully be made, by an agency, of any information produced by an authorised information matching programme.

Compare: 1993 No 28 s 100

180 Extension of time limit

If an agency derives or receives information produced by an authorised information matching programme, the Commissioner may, either generally or in respect of any case or class of cases, grant an extension of the time limit set out in section 179(2) in respect of that information if the Commissioner is satisfied that the agency cannot reasonably be required to meet that time limit because of—

(a)

the large quantity of information derived or received by the agency; or

(b)

the complexity of the issues involved; or

(c)

any other reason.

Compare: 1993 No 28 s 102

181 Notice of adverse action proposed

(1)

A specified agency must not take adverse action against an individual on the basis (whether in whole or in part) of a discrepancy produced by an authorised information matching programme—

(a)

unless that agency has given that individual written notice that—

(i)

specifies the particulars of the discrepancy and of the adverse action that it proposes to take; and

(ii)

states that the individual has 5 working days from the receipt of the notice in which to show cause why the action should not be taken; and

(b)

until the expiration of those 5 working days.

(2)

Subsection (1) does not prevent the department for the time being responsible for the administration of the Social Security Act 1964 2018 from immediately suspending sole parent support, the supported living payment, an emergency benefit, jobseeker support, a young parent payment, or a youth payment paid to an individual if—

(a)

the discrepancy arises in respect of departure information supplied to that department under section 280 308 of the Customs and Excise Act 1996 2018; and

(b)

before or immediately after the decision to suspend the benefit, the department gives the individual written notice that—

(i)

specifies the particulars of the discrepancy and the suspension of benefit, and any other adverse action that the department proposes to take; and

(ii)

states that the individual has 5 working days from the receipt of the notice to show cause why the benefit ought not to have been suspended or why the adverse action should not be taken, or both.

(3)

An adverse action must not be taken under subsection (2) until the expiry of the 5 working days referred to in paragraph (b)(ii).

(4)

Subsection (1) does not prevent the Commissioner of Inland Revenue from immediately taking action to recover amounts relating to—

(a)

unpaid amounts owed to the Commissioner by an individual who is in serious default and who is identified in information supplied to the Commissioner under section 280H 306 of the Customs and Excise Act 1996 2018; or

(b)

financial support under the Child Support Act 1991 owed to the Commissioner by an individual who is identified in information supplied to the Commissioner under section 280K 307 or 280L 313 of the Customs and Excise Act 1996 2018.

(5)

Subsections (1) and (2) do not prevent an agency from taking adverse action against an individual even if compliance with the requirements of those subsections would prejudice any investigation into the commission of an offence or the possible commission of an offence.

(6)

Subsection (1) does not prevent any constable or any bailiff from immediately executing a warrant to arrest an individual in respect of the non-payment of all or any part of a fine if—

(a)

the discrepancy arises in respect of arrival and departure information supplied under section 280D 310 of the Customs and Excise Act 1996 2018; and

(b)

before executing the warrant is executed, the individual concerned is—

(i)

informed of the intention to execute the warrant; and

(ii)

given an opportunity to confirm that he or she is they are the individual named in the warrant; and

(iii)

given the opportunity to confirm that neither of the following circumstances applies:

(A)

the fine has been paid:

(B)

an arrangement to pay the fine over time has been entered into.

(7)

In this section,—

amount of reparation has the same meaning as given to it in section 79(1) of the Summary Proceedings Act 1957

bailiff means a bailiff of the District Court or of the High Court

fine means—

(a)

a fine within the meaning of section 79(1) of the Summary Proceedings Act 1957:

(b)

a fine to which section 19 of the Crimes Act 1961 applies:

(c)

a fine to which section 43 or 45 of the Misuse of Drugs Amendment Act 1978 applies:

(d)

any amount payable under section 138A(1) of the Sentencing Act 2002.

(8)

This section is subject to section 180C(1) of the Corrections Act 2004.

Compare: 1993 No 28 s 103(1)–(2), (5)

182 Reporting requirements

(1)

If the Commissioner so requires, an agency that is involved in an authorised information matching programme must report to the Commissioner in respect of that the programme.

(2)

Without limiting the generality of subsection (1), the matters on which the Commissioner may require an agency to submit a report include the following:

(a)

the actual costs and benefits of an authorised information matching programme:

(b)

any difficulties experienced in the operation of an authorised information matching programme and how those difficulties are being, or have been, overcome:

(c)

whether internal audits or other forms of assessment are undertaken by an agency in relation to an authorised information matching programme, and, if so, the results of those audits or assessments:

(d)

if an agency dispenses with the giving of notice under section 181, the reasons why that dispensation is made and the grounds in support of those reasons:

(e)

the details of the operation of an authorised information matching programme, including—

(i)

the number of matches undertaken:

(ii)

the proportion of matches that revealed discrepancies in information involved in the matching:

(iii)

the number of discrepancies revealed:

(iv)

the proportion of cases in which action was taken as a result of the discrepancies:

(v)

the number of cases in which action was taken:

(vi)

the number of cases in which action was taken even though the accuracy of the discrepancy was challenged:

(vii)

the proportion of cases in which action did not proceed after the individual concerned was notified of the discrepancy:

(viii)

the number of cases in which action taken as a result of a discrepancy was successful:

(f)

any other matters that the Commissioner considers relevant.

Compare: 1993 No 28 s 104

183 Reports on authorised information matching programmes

(1)

The Commissioner must, before the end of each calendar year, report to the responsible Minister on each authorised information matching programme that is carried out (in whole or in part) during the financial year ending on 30 June in that year.

(2)

A report must set out, in relation to each programme,—

(a)

an outline of the programme; and

(b)

an assessment of the extent of the programme’s compliance, during that year, with—

(i)

sections 178 to 181; and

(ii)

the information matching rules; and

(c)

the details of each extension granted under section 180, the reasons why the extension was granted, and the grounds in support of those reasons.

(3)

This section does not require the Commissioner to disclose in any report any information relating to an information matching programme that would be likely to frustrate the objective of the programme.

(4)

Sections 90 to 94 apply in relation to an assessment carried out by the Commissioner for the purposes of subsection (2)(b), and all references in those sections to an investigation must be read as a reference to an assessment.

(5)

As soon as practicable after receiving a report, the responsible Minister must present a copy of the report to the House of Representatives.

Compare: 1993 No 28 s 105

184 Reports on information matching provisions

(1)

The Commissioner must, at 5-yearly intervals,—

(a)

review the operation of every information matching provision and consider, in particular, whether—

(i)

the authority conferred by the information matching provision should be continued; and

(ii)

any amendments to the provision are necessary or desirable; and

(b)

report the result of the review to the responsible Minister.

(2)

The first report of an information matching provision under this section is due not later than—

(a)

5 years after the date of the last report prepared in respect of that information matching provision by the Commissioner under section 106 of the Privacy Act 1993; or

(b)

5 years after the commencement of this section, if no previous report has been prepared in respect of that information matching provision by the Commissioner.

Compare: 1993 No 28 s 106

185 Responsible Minister must present to House of Representatives copy of report under section 184 and report setting out Government’s response to House of Representatives

The responsible Minister must—

(a)

present a copy of a report under section 184 to the House of Representatives within 5 working days after receiving it from the Commissioner or, if Parliament is not in session, as soon as practicable after the commencement of the next session of Parliament; and

(b)

within 6 months after complying with paragraph (a), present a report to the House of Representatives setting out the Government’s response to the report under section 184.

186 Avoidance of controls on information matching through use of exceptions to information privacy principles

Despite section 176, if the collection or disclosure of information is authorised by an information matching provision, nothing in IPP 2(2)(e)(i) or IPP 11 11(1)(e)(i) authorises or permits the collection or disclosure of that information for the purposes of—

(a)

any authorised information matching programme; or

(b)

any information matching programme whose objective is similar in nature to any authorised information matching programme.

Compare: 1993 No 28 s 108

187 Avoidance of controls on information matching through use of official information statutes

Despite anything in the Official Information Act 1982 or the Local Government Official Information and Meetings Act 1987, no a public sector agency may must not disclose under either of those enactments, to any other public sector agency, under those Acts any personal information if the sole or principal purpose for which that information is sought is used in information is sought solely or principally for use in an information matching programme.

Compare: 1993 No 28 s 109

188 Power to amend Schedule 6 by Order in Council

The Governor-General may, by Order in Council made on the recommendation of the responsible Minister,—

(a)

amend Schedule 6 by—

(i)

replacing a reference to an information matching provision that has been renumbered with a reference to the corresponding renumbered information matching provision:

(ii)

repealing an information matching provision; or

(b)

repeal Schedule 6.

189 Power to amend Schedule 7 by Order in Council

(1)

The Governor-General may, by Order in Council made on the recommendation of the Privacy Commissioner, amend the information matching rules in Schedule 7.

(2)

The power conferred by subsection (1) includes the power to—

(a)

replace Schedule 7:

(b)

repeal Schedule 7.

Compare: 1993 No 28 s 107

190 Amendments to other enactments related to this subpart

The enactments listed in Schedule 8 are amended in the manner set out in that schedule.

191 Expiry of section 190 and Schedule 8

Section 190 and Schedule 8 expire and are repealed on the close of 1 January September 2020.

Part 8 Transfer Prohibiting onward transfer of personal information outside received in New Zealand from overseas

192 Interpretation

In this Part, unless the context otherwise requires, transfer prohibition notice means a notice given under section 193 prohibiting the transfer of personal information from New Zealand to another country.

State includes any State, territory, province, or other part of a country

transfer prohibition notice means a notice given under section 193 prohibiting the transfer of personal information from New Zealand to another State.

Compare: 1993 No 28 s 114A

193 Prohibition on transfer of personal information outside New Zealand

(1)

The Commissioner may prohibit a transfer of personal information from New Zealand to another State country if the Commissioner is satisfied, on reasonable grounds, that—

(a)

the information has been, or will be, received in New Zealand from another State country and is likely to be transferred to a third State country where it will not be subject to a law providing comparable safeguards to those in this Act; and

(b)

the transfer would be likely to lead to a contravention of the basic principles of national application set out in Part Two of the OECD Guidelines and in Schedule 9 of this Act.

(2)

In determining whether to prohibit a transfer of personal information, the Commissioner must also consider, in addition to the matters set out in subsection (1) and section 18, the following:

(a)

whether the transfer affects, or is likely to affect, any individual; and

(b)

the general desirability of facilitating the free flow of information between New Zealand and other States countries; and

(c)

any existing or developing international guidelines relevant to transborder data flows, including (but not limited to)—

(i)

the OECD Guidelines:

(ii)

the European Union Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data.

(ii)

the General Data Protection Regulation.

(3)

Subsection (1) does not apply if the transfer of the information, or the information itself, is—

(a)

required or authorised by or under any enactment; or

(b)

required by any convention or other instrument that imposes international obligations on New Zealand.

Compare: 1993 No 28 s 114B

194 Commissioner’s power to obtain information

(1)

To enable the Commissioner to determine whether to prohibit a transfer of personal information, the Commissioner may hear or obtain information from any person as the Commissioner considers necessary, and for that purpose subpart 2 of Part 5 applies as if the Commissioner were carrying out an investigation under that subpart.

(2)

In exercising his or her any power