25.05.2020

The new Privacy Act: What will this mean for your Business?

The long awaited reform to New Zealand privacy law is currently making its way through the final stages in Parliament, and is expected to become law on 1 November 2020. The Privacy Bill (which when enacted will become the Privacy Act 2020) will replace the Privacy Act 1993. While large parts of the current Act remain, there are significant changes designed to improve New Zealand organisations’ privacy compliance. Now is a good time to consider whether changes are required to your privacy policy and employment agreements to ensure you do not incur the wrath of the Office of the Privacy Commissioner.

Key changes

The Privacy Act 2020 will introduce some important changes. The key changes include:

  • A mandatory requirement for businesses to report serious breaches of privacy that pose a risk of harm, loss, or damage to the individual to the Privacy Commissioner (this requirement follows the position of the Australian and European Privacy Laws);
  • Strengthening cross-border data protection by requiring New Zealand agencies to ensure that all personal information shared with an overseas entity is protected;
  • Extension of the Privacy Act to all agencies carrying out business in New Zealand (whether they have a physical presence in New Zealand or not);
  • Introduction of new criminal offences with a fine of up to $10,000 if a business misleads an agency or attempts to destroy documents with personal information; and
  • Strengthening the Privacy Commissioner’s power to gather information from an agency by reducing timeframes and increasing penalties from $2,000 to $10,000.

Stronger enforcement and compliance

The Privacy Act 2020 will introduce a number of new enforcement and compliance provisions that will give the Privacy Commissioner greater power to ensure that the statute is adhered to.

Importantly, the Privacy Commissioner will have the power to serve businesses with compliance notices in response to a breach of the Act, and to instruct the business to release personal information held by that business to the affected individual. The Privacy Commissioner will be assisted by the Human Rights Review Tribunal to enforce compliance notices. If the business fails to report a privacy breach to the Privacy Commissioner, it could face a fine of up to $10,000 (being a notable increase from the previous $2,000 maximum limit). While the new Act does raise the penalty amount, the regime is considered to be at a low level compared to other jurisdictions’ regimes, such as Canada (where the penalty for not reporting a privacy breach could be as high as NZ$120,000 or even higher in some cases).

Another important change is the strengthening of the Privacy Commissioner’s power to carry out investigations into breaches of privacy complaints by having shorter time frames in place within which a business is required to respond and provide the requested information. Where a business fails to provide the requested information, it could be liable to a fine of $10,000.

Advice for businesses and agencies

Overall, the changes that the Privacy Act 2020 introduces are likely to have an impact on the operation of your business. While the Act is not yet in force, it is important that your business starts taking preparatory steps to ensure that its privacy policies and employment agreements are up to date. As a preliminary step, we recommend that you:

  • Review your privacy policy and employment agreement to see if it complies with the Act (this includes reviewing your business’s privacy statement and making changes where necessary); and
  • Check your current systems to ensure that all personal information is held safely and securely (this includes employee, employer, and any customer or other third-party information that is held by your organisation).

Businesses should view privacy protection as a cultural norm. If you have any questions or want to discuss how the new Privacy Act 2020 is likely to impact your business, please contact one of the members of our Employment Law Team.

Disclaimer:  The information contained in this article is current at the date of publishing and is of a general nature.  It should be used as a guide only and not as a substitute for obtaining legal advice.  Specific legal advice should be sought where required.

 

Do you need expert legal advice?
Contact the expert team at Hesketh Henry.
Kerry
Media contact - Kerry Browne
Please contact Kerry with any media enquiries and with any questions related to marketing or sponsorships on +64 9 375 8747 or via email.

Related Articles / Insights & Opinion

Privacy Commissioner to consult on Privacy Rules for Biometric Information
With the increasing use of facial recognition technology (FRT), retinal scans, and voice recognition by an array of different agencies, privacy concerns about its collection and use are set to be form...
24.11.2023 Posted in Business Advice
Fern forest NZ
Bioenergy in New Zealand: Fuels for the Future?
The energy transition from combustion fuels to low carbon alternatives is viewed as critical in the race to cut global CO2 emissions and reach climate targets.  We look at some of the opportunities p...
14.11.2023 Posted in Business Advice & Climate Change & Forestry
Will Wide BW
A well drafted will is a craft
The New Zealand do-it-yourself “DIY” attitude and way of life is not limited to home improvements, but sometimes also extends to wills.  Recently we had a DIY $5.99 fill in the blanks will acros...
07.11.2023 Posted in Private Wealth
rsz large pillars
Health and Safety: The Consequences of Dishonesty
Siddhartha Gautama said that lies are like huge, gaudy vessels, the rafters of which are rotten and worm-eaten, and that those who embark in them are fated to be shipwrecked.  Two remarkable health a...
03.11.2023 Posted in Employment & Health & Safety
Properly sequencing your Construction Adjudications: Henry Construction Projects Ltd v Alu-Fix (UK) Ltd
According to the UK’s Technology and Construction Court (TCC) (in Henry Construction Projects Ltd v Alu-Fix (UK) Ltd [2023] EWHC 2010) valid payment claims must be paid before the underlying merits ...
30.10.2023 Posted in Construction & Disputes
Key change to rules on distribution of surplus assets under the new Incorporated Societies Act 2022
On 5 October 2023, the new Incorporated Societies Act 2022 (2022 Act) came fully into force, replacing the Incorporated Societies Act 1908 (1908 Act). One of the key requirements under the 2022 Act is...
18.10.2023 Posted in Business Advice
Construction Framework Wide BW
Major milestone passed – NZS3910:2023 expected in time to fill Christmas stockings
As the most widely adopted standard form construction contract in NZ, NZS 3910 was more than ready for updated conditions given the changes in the industry since its last review in 2013.  After almos...
09.10.2023 Posted in Construction
SEND AN ENQUIRY
Send us an enquiry

For expert legal advice, please complete the form below or call us on (09) 375 8700.