Whilst many will find the new Act still lacks teeth, in particular by international standards considering fines will not exceed $10,000 per breach, it also imposes more stringent obligations on businesses and gives new enforcement powers to the Privacy Commissioner and the Human Rights Review Tribunal.<\/p>\n
Non-compliant businesses will be exposed. Now is a good time to prepare; 1 December is less than four months away.<\/p>\n
Turning your mind to these issues may reveal weaknesses and areas of risk in the way your business handles personal information. There is a good chance many businesses will need to amend their internal data and privacy policy and systems. Here are the most important changes introduced by the new Act and what business can do to prepare:<\/p>\n
Businesses will be required to notify a privacy breach that causes serious harm or is likely to cause serious harm to the individuals affected and to the Privacy Commissioner. It will be an offence not to do so (with a fine of up to $10,000).<\/p>\n
The Commissioner will be able to issue notices to businesses which are considered to breach the new Act and require them to remedy the breach. If a business fails to comply with a notice the Commissioner will be able to take enforcement proceedings in the Human Rights Review Tribunal (which could end up with the Tribunal imposing a fine of up to $10,000).<\/p>\n
Steps businesses can take:<\/strong>\u00a0If you don\u2019t have a privacy policy, prepare one. Make sure it includes the following:<\/p>\n Again, whilst the financial liabilities are low, the reputational impact of a privacy breach in a small county like New Zealand should not be underestimated.<\/p>\n The Commissioner will be given broader powers to investigate complaints. The Commissioner may summon and examine on oath any person, and may require information and documents from any person. Complaints about access to personal information will be adjudicated by the Commissioner (rather than the Human Rights Review Tribunal) with binding access determinations (which can still be appealed to the Tribunal).<\/p>\n Steps businesses should take:<\/strong>\u00a0Set out clear processes and make sure your Privacy Officer and other key staff are adequately trained to deal with complaints and investigations and interact with any aggrieved parties, the Privacy Commissioner and the media.<\/p>\n Businesses in New Zealand may only transfer personal information overseas to foreign countries which have privacy laws providing comparable safeguards to those available in New Zealand. This includes ensuring that an overseas service provider (such as a cloud service provider) complies with New Zealand privacy laws.<\/p>\n Steps businesses should take:<\/strong>\u00a0Make sure you understand what data you collect, how it\u2019s used, which third parties hold it and where. Check your agreement(s) with cloud service providers.<\/p>\n Whilst not truly transformative, the Privacy Act 2020 is a big step forward for New Zealand privacy laws. It is still not as stringent as the now well-known European Union\u2019s General Data Protection Regulation (the \u2018GDPR\u2019 and its fines of up to 20 million euros) to which many New Zealand businesses have already adapted.<\/p>\n Still, businesses will need to pay attention to the new requirements of the Privacy Act 2020 and the risks they introduce. They should be prepared by educating themselves, training their staff and reviewing and updating their processes and internal policies. Transparency, ease of access and security when collecting, using, storing, and disclosing information are paramount.<\/p>\n James & Wells can help. If you need advice, please get in touch.<\/p>\n","protected":false},"excerpt":{"rendered":" On 1 December 2020, the Privacy Act 2020 will repeal and replace the Privacy Act 1993. As the Privacy Commissioner put it \u201cthe new Privacy Act provides a modernised framework to better protect New Zealanders\u2019 privacy rights in today\u2019s environment\u201d. Whilst many will find the new Act still lacks teeth, in particular by international standards…<\/p>\n","protected":false},"author":8,"featured_media":3004,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"content-type":"","footnotes":""},"categories":[253],"class_list":["post-3415","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-intl","insight-resource-articles-intl"],"acf":[],"yoast_head":"\n\n
3. Complaints to and investigations and decisions by the Commissioner\u00a0(Part 5 \u2013 ss 70-96)<\/h6>\n
4.\u00a0 Increased obligations when storing information outside of New Zealand\u00a0(Part 8 \u2013 ss 192-200)<\/h6>\n
Conclusion<\/h6>\n