New ZealandPrivacy Act 2020, Compliance Notices and Offences
Privacy Act 2020 (NZ), No 31, ss. 123, 126, 130, 212
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://www.legislation.govt.nz/act/public/2020/0031/latest/LMS23223.htmlIn force since .
An enforcement supervision rule binding public and private bodies.
- Enforcement body
- Office of the Privacy Commissioner; Human Rights Review Tribunal
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Comply with a compliance notice issued by the Commissioner to remedy a breach of the Act, an interference with privacy, or a breach of a code of practice, or face enforcement proceedings before the Human Rights Review Tribunal.
- Do not obstruct, hinder, or resist the Commissioner, make a false or misleading statement, falsely claim authority under the Act, impersonate an individual to obtain or alter their personal information, or destroy a document to defeat a request; each is an offence carrying a fine of up to $10,000.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Under s. 212(1) and (2), a person who obstructs the Commissioner, fails to comply with a lawful requirement, makes a false or misleading statement, falsely claims authority under the Act, impersonates an individual, or destroys a document to defeat an access request commits an offence and is liable on conviction to a fine not exceeding $10,000 for each subsection.
Penalty structure
Fine on conviction under s. 212(1) or (2) for each listed offence (obstruction, false statement, false claim of authority, impersonation, or destruction of a document to defeat an access request).
- Rule
- Fixed only
- As of
- Currency
- NZD
- Fixed cap
- 10,000
What it makes you log
Who may demand the log
Regulator
Logging duty
Section 123 lets the Commissioner issue a compliance notice, section 126 requires the agency to comply with it, section 130 lets the Commissioner take enforcement proceedings, and section 212 makes it an offence to obstruct the Commissioner, refuse a lawful requirement, mislead, impersonate an individual or destroy a document containing personal information knowing an access request has been made about it. The Commissioner's power to require information, which section 212(1)(b) backs with an offence, can be exercised at the Commissioner's discretion, but the sections name no log or record that an agency must make or keep. The sections cited state no territorial clause (section 4(5) governs section 212).
- Kind
- None
- As of
What this law does
The Privacy Commissioner may issue a compliance notice requiring an agency to remedy a breach of the Act, an interference with privacy, or a breach of a code of practice, and an agency issued with one must take steps to comply as soon as practicable; if the agency has not remedied the breach after the appeal period, the Commissioner may take enforcement proceedings in the Human Rights Review Tribunal.
Separately, section 212 makes it an offence, on conviction carrying a fine of up to $10,000, to obstruct or mislead the Commissioner, make a false statement, falsely claim authority under the Act, impersonate an individual to obtain or alter their personal information, or destroy a document to defeat an access request.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .