The Privacy Act 2020 updates New Zealand’s more than 20-year-old legislation to reflect the digital and globally connected world we live in. There are some important changes for businesses and individuals, more about which can be found here. Key changes include:
- You can only collect identifying information if it is necessary (eg names or phone numbers).
- Personal information may only be disclosed to organisations in other countries where there are similar protections to those in the New Zealand Privacy Act.
- Businesses and organisations must take reasonable steps to protect unique identifiers from being misused.
- A privacy breach that has caused serious harm to someone (or is likely to do so), will need to be notified to the Office of the Privacy Commissioner, and the affected individual as soon as possible.
- An overseas business or organisation may be treated as carrying on business in New Zealand for the purposes of its privacy obligations, even if not physically in New Zealand.
The new Act comes into force on 1 December 2020.