November 27, 2020

Volume X, Number 332


November 25, 2020

Subscribe to Latest Legal News and Analysis

New Zealand Advances New Privacy Bill

On June 26, 2020, New Zealand Justice Minister Andrew Little announced that the bill to repeal and replace New Zealand’s existing Privacy Act 1993 (the “Privacy Bill”) had passed its third reading in Parliament. The Privacy Bill received royal assent on June 30, 2020.

The Privacy Bill retains certain aspects of the Privacy Act 1993, but includes some significant changes. Key reforms include:

  • Scope/Applicability. The Privacy Bill applies to all agencies (defined to include individuals, public sector agencies and private businesses) carrying out business in New Zealand, regardless of whether they have a physical presence in the country.

  • Mandatory Data Breach Notification. The Privacy Bill introduces a mandatory requirement for businesses to report certain data breaches (i.e., those that pose a risk of harm, loss or damage to affected individuals) to the New Zealand Privacy Commissioner and affected individuals. In contrast, under the Privacy Act 1993 data breach notification is not mandatory, though nonbinding guidance from the Privacy Commissioner encourages businesses to report breaches to the Privacy Commissioner and affected individuals.

  • Cross-Border Data Transfers. The Privacy Bill imposes restrictions on cross-border transfers of personal information. Specifically, agencies will be required to take reasonable steps to ensure that personal information transferred outside New Zealand is protected by comparable privacy standards to the Privacy Bill.

  • Enforcement. The Privacy Bill enhances the powers of the Privacy Commissioner by shortening the timeframes in which an agency must comply with investigations and increasing penalties for non-compliance with the law from $2,000 to $10,000 NZD. The Privacy Bill also allows for class actions in certain circumstances and introduces potential criminal penalties for certain violations of the law.

The Privacy Bill is projected to come into force on December 1, 2020.


Copyright © 2020, Hunton Andrews Kurth LLP. All Rights Reserved.National Law Review, Volume X, Number 192



About this Author

In today’s digital economy, companies face unprecedented challenges in managing privacy and cybersecurity risks associated with the collection, use and disclosure of personal information about their customers and employees. The complex framework of global legal requirements impacting the collection, use and disclosure of personal information makes it imperative that modern businesses have a sophisticated understanding of the issues if they want to effectively compete in today’s economy.

Hunton Andrews Kurth LLP’s privacy and cybersecurity practice helps companies manage data and...

212 309 1223 direct