New ZealandPrivacy Act 2020, Information Privacy Principles and Extraterritorial Reach
Privacy Act 2020 (NZ), No 31, ss. 4, 22 (IPP 1, 2, 13)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://www.legislation.govt.nz/act/public/2020/0031/latest/LMS23223.htmlIn force since .
A comprehensive regime rule binding public and private bodies.
- Private right of action
- No
- Enforcement body
- Office of the Privacy Commissioner
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting
- Audit expectation
- none
What it requires
- Do not collect personal information unless it is for a lawful purpose connected with a function or activity of your organisation and the collection is necessary for that purpose.NIST Privacy FrameworkCT.PO-P1
- Collect personal information directly from the individual concerned unless an exception applies, such as the individual's authorisation, the source being a publicly available publication, or non-compliance not prejudicing the individual's interests.NIST Privacy FrameworkGV.PO-P1
- Comply with the Information Privacy Principles as an overseas organisation if you are carrying on business in New Zealand in relation to personal information you collect or hold, even without a New Zealand place of business, staff, or profit motive.
- Do not assign a unique identifier to an individual unless it is necessary to carry out your organisation's functions efficiently, and do not assign the same identifier already assigned by another agency except in limited circumstances.NIST Privacy FrameworkCT.DP-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.DP-P1Data are processed to limit observability and linkability (e.g., data actions take place on local devices, privacy-preserving cryptography).
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Information privacy principle 1 confines collection to a lawful and necessary purpose, principle 2 requires collection from the individual concerned with listed exceptions, and principle 13 limits the assignment of unique identifiers. They limit what is collected, from whom and which identifier is assigned, and none requires an agency to make, keep or produce a log or record. Section 4 sets the reach of the Act: a New Zealand agency for its actions wherever taken, an overseas agency for actions in the course of carrying on business in New Zealand, and a person not ordinarily resident for information collected or held while present in New Zealand. Principles 4 and 11, named in the row's title but not its citation, were not part of what the row cites.
- Kind
- None
- As of
What this law does
Binds a New Zealand agency for any action taken anywhere in respect of personal information it collects or holds, and an overseas agency for any action taken in the course of carrying on business in New Zealand, which section 4(3) confirms does not require a commercial operation, a New Zealand place of business, payment, or a profit motive.
Information privacy principle 1 confines collection to what is necessary for a lawful purpose connected with the agency's function, information privacy principle 2 requires collection directly from the individual concerned subject to listed exceptions including that the source is a publicly available publication, and information privacy principle 13 limits an agency's assignment of unique identifiers to what is necessary to carry out its functions.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .