New ZealandPrivacy Act 2020, Information Privacy Principle 12 (Disclosure Outside New Zealand)
Privacy Act 2020 (NZ), No 31, s. 22 (IPP 12)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://www.legislation.govt.nz/act/public/2020/0031/latest/LMS23223.htmlIn force since .
A cross border transfer rule binding public and private bodies.
- Private right of action
- No
- Enforcement body
- Office of the Privacy Commissioner
- Audit expectation
- none
What it requires
- Before disclosing personal information to an overseas recipient, confirm one of information privacy principle 12's safeguards applies: the individual's informed authorisation, the recipient being subject to this Act or a comparably safeguarded overseas law, the recipient's participation in a prescribed binding scheme, the recipient being subject to a prescribed country's laws, or another reasonable basis to believe the recipient will protect the information comparably.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Information privacy principle 12 allows disclosure to a foreign person or entity only on one of six listed bases, among them the individual's authorisation after being expressly informed or the agency's reasonable belief that the recipient is bound to comparable safeguards. It is a condition on disclosure, and an agency can satisfy it without a record; the principle requires none, and the section cited states no territorial clause.
- Kind
- None
- As of
What this law does
An agency may disclose personal information to a foreign person or entity only where the individual authorised the disclosure knowing the recipient may not provide comparable safeguards, or the agency reasonably believes the recipient is itself subject to the Privacy Act 2020, subject to comparable overseas privacy laws, a participant in a prescribed binding scheme, subject to a prescribed country's laws, or otherwise contractually bound to provide comparable safeguards.
The condition does not apply where reliance is on the law-enforcement or research-and-statistics disclosure grounds of information privacy principle 11 and compliance is not reasonably practicable.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .