New ZealandPrivacy Act 2020, Information Privacy Principle 3A (Indirect-Collection Notice)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://www.legislation.govt.nz/act/public/2020/0031/latest/LMS23223.htmlIn force since .
A comprehensive regime rule binding public and private bodies.
- Private right of action
- No
- Enforcement body
- Office of the Privacy Commissioner
- Audit expectation
- none
What it requires
- If you collect personal information about an individual other than from that individual, including by scraping it from a third-party source, take reasonable steps to make the individual aware, as soon as practicable after collection, of the fact of collection, its purpose, the intended recipients, your identity, any legal authority for the collection, and their access and correction rights.
- This duty does not apply to personal information collected before , or where the individual has already been made aware of these matters by other means.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Information privacy principle 3A requires an agency that collects personal information other than from the individual to take reasonable steps to make the individual aware of the collection, its purpose, the recipients, the agency's identity, the authorising law and the access and correction rights. It is a notice to the individual and requires no log or record; the section cited is section 22 alone, which states no territorial clause.
- Kind
- None
- As of
What this law does
If an agency collects personal information about an individual from a source other than that individual, such as a third-party dataset or a scrape of another site, it must take reasonable steps to make the individual aware, as soon as practicable, of the fact and purpose of collection, the intended recipients, the collecting and holding agency's identity, any legal authority for the collection, and the individual's access and correction rights.
The duty does not apply where the individual has already been made aware of these matters by any means, or to personal information collected before .
When LexLint raises it
When your app profile says your app crawls the web or processes personal data.
Back to the example · Lint your app
Page updated .