Email this page

Send this page to a friend.

This page is printer friendly.

Media release: "Privacy Bill helps trade and enhances personal rights"

2 July 2008

Privacy Commissioner Marie Shroff today welcomed the introduction of the Privacy (Cross-border Information) Amendment Bill, saying it would have benefits for New Zealand’s trading opportunities and enhance personal rights.

"The Bill will have two main impacts: first, it will help ensure New Zealand law meets the expectations of our trading partners and second, it will remove an anomaly so that people living overseas can access their personal information held in New Zealand.

"New Zealand business is operating in a global data processing economy and our data protection law needs to be recognised as stacking up internationally, said Ms Shroff. "It is important that our privacy law keeps pace in order to facilitate international trading opportunities. These changes should help to secure a finding from the European Union that New Zealand law offers an adequate standard of data protection."

The Bill will also give the Privacy Commissioner the ability to cooperate with overseas privacy authorities when dealing with, or transferring, privacy complaints. This reflects a priority area in the privacy work of both APEC and OECD.

"I see these measures as important and necessary steps to update the Privacy Act and improve access to personal information. I expect this Bill to be the first part of a more extensive modernisation of the Privacy Act. It is complementary to the thorough privacy review currently being carried out by the Law Commission" said Ms Shroff.

For more information see www.privacy.org.nz or contact: 

Annabel Fordham tel 04 474 7590 or 021 509 735 or enquiries@privacy.org.nz

The Bill by clause as introduced to the House:

Privacy (Cross-border Information) Amendment Bill 221-1 (2008)

Explanatory note


General policy statement

This Bill amends the Privacy Act 1993. The amendments dealing with cross-border data transfers will substantially reduce the likelihood of New Zealand being used as an intermediary for the avoidance of other States’ privacy laws. For example, the amendments will ensure that personal data originating overseas and sent to New Zealand is subject to our privacy protection. The Bill’s transfer prohibition notice mechanism will ensure foreign personal data cannot be sent, via New Zealand, to jurisdictions without adequate privacy protection. These amendments will enable New Zealanders and New Zealand companies to assure their trade partners that New Zealand law will ensure their privacy is protected.

The Bill also contains complementary amendments facilitating the cross-border enforcement of privacy laws. This will better protect New Zealanders engaged in international transactions. The amendments recognise that concurrent or consecutive investigations in two jurisdictions are possible. The amendments will implement aspects of the OECD framework for co-operation between privacy enforcement authorities.

Clause by clause analysis


Clause 1 is the Title clause.
Clause 2 provides that the Bill comes into force on the day after the date on which it receives the Royal assent.
Clause 3 sets out the purpose of the Bill.


Part 1
Amendments to Privacy Act 1993


Clause 4 provides that Part 1 amends the Privacy Act 1993.
Clause 5 repeals section 34 and substitutes a new section 34. The new section removes the existing requirement that, in order to make an information privacy request, an individual must be a New Zealand citizen, permanent resident, or in New Zealand at the time the request is made.
Clause 6 amends section 36 to enable the Privacy Commissioner to authorise a public sector agency to impose a reasonable charge for making personal information available to an individual residing outside New Zealand who is neither a New Zealand citizen nor a permanent resident of New Zealand.
Clause 7 inserts new section 72C, which provides for the referral of a complaint to an overseas privacy enforcement authority where the complaint is within the jurisdiction of that authority and both the authority and complainant agree to the referral being made.
Clause 8 inserts new Part 11A into the principal Act, which relates to the transfer of personal information outside New Zealand.
New section 114A defines certain terms used in the new Part.
New section 114B provides that the Privacy Commissioner may prohibit a transfer of personal information from New Zealand to another State if he or she is satisfied that—

  • the personal information will be transferred to a jurisdiction where it will not be subject to a law providing comparable safeguards to the principal Act; and
  • the proposed transfer may circumvent the laws of the State from where the information originated; and
  • the transfer would be likely to breach the basic principles of national application set out in Part Two of the Organisation for Economic Co-operation and Development Guidelines Governing the Protection of Privacy and Transborder Flows of Personal Data (OECD Guidelines).


In exercising his or her discretion in accordance with this new section, the Commissioner must consider the following:

  • whether or not the proposed transfer of personal information affects, or would be likely to affect, any individual; and
  • the desirability of facilitating the free flow of information between New Zealand and other States; and
  • any existing or developing international guidelines relevant to transborder data flows (including the OECD Guidelines and the European Union Directive 95/46/EC on the Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data).
     

New section 114C authorises the Commissioner to prohibit a transfer of personal information by serving a transfer prohibition notice on the agency proposing to transfer that personal information.
New section 114D provides that the Commissioner may vary or cancel all or any part of a transfer prohibition notice, on the Commissioner's own initiative or on an application by the agency on whom the notice is served, if he or she considers that the notice need not be complied with in order to avoid a contravention of basic principles of privacy and data protection.
New section 114E creates an offence in relation to a failure or refusal to comply with a transfer prohibition notice served by the Commissioner.
New section 114F provides that an agency on whom a transfer prohibition notice is served may appeal to the Human Rights Review Tribunal against—

  • the whole or any part of the notice; or
  • a decision of the Commissioner that the transfer prohibition notice should come into effect urgently; or
  • a decision of the Commissioner to vary a transfer prohibition notice; or
  • a refusal by the Commissioner to vary or cancel a transfer prohibition notice.

New section 114G provides that Part 4 of the Human Rights Act 1993 applies to appeal proceedings in the Human Rights Review Tribunal under new section 114F.

Part 2

Related amendment to Adoption (Intercountry) Act 1997

Clause 9 provides that Part 2 amends the Adoption (Intercountry) Act 1997.
Clause 10 repeals section 13(3) as a result of the amendment in clause 5. Section 13(3) provides that, despite section 34 of the Privacy Act 1993, a person who is adopted in accordance with the Convention on Protection of Children and Co-operation in Respect of Intercountry Adoption (1993) may make a request for personal information even though they may not be a New Zealand citizen, permanent resident, or an individual who is in New Zealand. This provision is no longer necessary because new section 34 removes these procedural requirements and provides that any individual may make an information privacy request.