Amendments to the Privacy Act 2020
September 20, 2024
The Privacy Amendment Bill 2023, which will come into force on 1 June 2025 after royal assent, will amend various aspects of the Privacy Act 2020.
Key purpose
The key purpose of the Bill is to improve transparency for individuals about the collection of their personal information and better enable individuals to exercise their privacy rights. The Bill addresses a current gap relating to the fact that there is no requirement for an organisation (public or private) to notify an individual when it collects personal information about the individual indirectly (i.e., from a source other than from the individual concerned). This means that an individual may not know that an organisation holds their personal information.
Notification obligation
The Bill achieves this purpose by introducing a new notification obligation on an organisation when it collects personal information indirectly. This new requirement will also update New Zealand’s privacy laws, so that they are in line with international best practice.
Specifically, the Bill introduces a new Information Privacy Principle (IPP 3A) relating to the indirect collection of personal information. It is closely based on the existing Information Privacy Principle 3, which deals with the direct collection of personal information.
Under the new principle, the collecting organisation will be required to notify an individual when collecting their information indirectly, and provide its name and address, the purposes for which the information is being collected, and specify that they have a right to access the information and correct it, if necessary.
Exceptions
The requirement is, however, subject to several practical exceptions, amongst which is one relevant to the research industry. Specifically, 4. (i) (ii) states that compliance with the new principle will not be necessary if the information:
(i) will not be used in a form in which the individual concerned is identified; or
(ii) will be used for statistical or research purposes and will not be published in a form that could reasonably be expected to identify the individual concerned.
