Proposed Privacy Act amendments – What you need to know about indirect personal data collection

A new Privacy Amendment Bill was recently introduced to Parliament.  The Bill proposes to insert a new Information Privacy Principle (IPP) 3A into the Privacy Act 2020, which would impose additional obligations on those who indirectly collect personal information about individuals. 

The key purpose of the change, according to the explanatory note in the Bill, is “to improve transparency for individuals about the collection of their personal information and better enable individuals to exercise their privacy rights”. 

Privacy legislation refers to those who collect personal information about individuals as “agencies” and we use that terminology in this article. 

What changes are proposed?

Privacy legislation (in particular the existing IPP 3) already obliges agencies who collect personal information directly from an individual to notify certain things to that individual.  The proposed IPP 3A would extend this requirement so that agencies which collect personal information indirectly would also be subject to similar obligations. 

The new IPP 3A would apply to:

  • all agencies (including natural persons and public and private organisations) which collect personal information about an individual from sources other than directly from the individual concerned,
  • but only in respect of personal information collected on and after 1 June 2025 (i.e. it would not apply retrospectively).

An agency to which the proposed IPP 3A applies will need to ensure that the individual about whom information is collected is made aware of:

  • the fact that the information has been collected;
  • the purpose for which the information has been collected;
  • the intended recipients of the information;
  • the name and address of the agency that has collected the information and any agency holding the information;
  • if the collection of the information is authorised or required by or under law, the particular law under which the collection of the information is authorised or required; and
  • the individual’s right to access and correct information.

What exceptions are available? 

There are a number of exceptions available which permit non-compliance with IPP 3A.  Most importantly, an agency does not need to take the above steps if the individual concerned has previously been made aware of the matters noted above.  For example, the exception may apply if an agency indirectly collects information about an individual from a third party, and that third party has previously notified the individual (in an adequate manner) that his or her information will be disclosed to the agency and also as to the matters noted above. 

There are also some further exceptions, some of which are similar to those that apply in respect to IPP 3, and some which are additional grounds available for IPP 3A only.  For example, an agency does not need to comply with IPP 3A if the agency believes on reasonable grounds that: 

  • the information being collected indirectly is publicly available;
  • compliance would reveal a trade secret; or
  • informing the individual concerned of the matters specified in IPP 3A would cause a serious threat to public health or safety, or to the health or safety of another individual.

What does this mean for you?

If the Bill is passed into law, agencies will need to consider their information collection processes.  This could include considering what steps can be taken to make individuals aware that their personal information is being collected indirectly.  If information is collected through an intermediary, a key question will be does the individual concerned know? 

The proposed changes may also lead agencies to review their contractual arrangements with such third parties to ensure privacy obligations are considered.  Privacy policies would need to be reviewed to ensure they clearly state what indirect sources are being used to collect personal information and to whom personal information will be disclosed.  

If you have any questions or wish to find out more information about these proposed changes, please contact our Business Advice Team or your usual contact at Hesketh Henry. 


Disclaimer:  The information contained in this article is current at the date of publishing and is of a general nature.  It should be used as a guide only and not as a substitute for obtaining legal advice.  Specific legal advice should be sought where required.

Do you need expert legal advice?
Contact the expert team at Hesketh Henry.
Media contact - Kerry Browne
Please contact Kerry with any media enquiries and with any questions related to marketing or sponsorships on +64 9 375 8747 or via email.

Related Articles / Insights & Opinion

Computer Hand Wide
Privacy Commissioner releases draft biometrics privacy code
Biometrics is a trending issue and with the development of technology there are consistently more ways biometric data can be used, from replacing a password to identifying repeat shoplifters in a shop...
03.05.2024 Posted in Business Advice
Building Permit
Build-to-Rent (BTR) Basics
If the term Build-to-Rent is new to you, you are probably not alone.  Unlike countries such as the USA, UK and Australia where BTR is well established, the BTR sector is still emerging in New Zealand...
26.04.2024 Posted in Property
Insurance Contract Law – Parliament finally gets to consider long-awaited reforms
The Government’s Contracts of Insurance Bill was introduced on 30 April 2024.  We are currently reviewing that Bill and a new article is coming soon. In February 2022, the Ministry of Business, Inn...
24.04.2024 Posted in Insurance
Tower Troubles – Body Corporate 366567 (Harbour Oaks) v Auckland Council
Standing 40 storeys tall with 406 units, the Gore Street building in downtown Auckland (formerly known as “Harbour Oaks”) is presently the subject of New Zealand’s largest claim for residential ...
18.04.2024 Posted in Construction & Disputes
Construction Framework Wide BW
OIO Spotlight:  Government issues new directive on foreign investment for build-to-rent housing developments
Earlier this year, the coalition Government announced that it would be introducing a new streamlined consent pathway for build-to-rent developments by way of amendments to the Overseas Investment Act ...
16.04.2024 Posted in Business Advice & Property
Incorporated societies’ reregistration deadline – April 2026 may be closer than you think
The Incorporated Societies Act 2022 (2022 Act) came fully into force on 5 October 2023, meaning incorporated societies can now apply for reregistration under the 2022 Act.  Approximately 24,000 exist...
16.04.2024 Posted in Business Advice
iStock  Construction dpi
Call me? Care is required when calling on a bond
In the recent High Court decision Hawkins Ltd v Elizabeth Properties Ltd, Hawkins was successful in preventing EPL from calling on a $3m bond pending determination of a dispute principally over the ap...
Send us an enquiry

For expert legal advice, please complete the form below or call us on (09) 375 8700.