New ZealandPrivacy Act 2020, Reach Over Scraped Personal Information
Privacy Act 2020 (NZ), No 31, ss. 4, 7, 22 (IPP 1, 2)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://www.legislation.govt.nz/act/public/2020/0031/latest/LMS23223.htmlIn force since .
A personal data rule binding public and private bodies.
- Private right of action
- No
- Enforcement body
- Office of the Privacy Commissioner
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location
- Audit expectation
- none
What it requires
- Do not collect personal information, including personal information scraped from a public website, unless it is for a lawful purpose connected with a function or activity of your organisation and the collection is necessary for that purpose.
- Collecting personal information other than directly from the individual, including by scraping, is excused from the source-of-collection principle where the source is a publicly available publication, but the information remains subject to every other duty the Act imposes.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 1.6System requirements (e.g., “the system shall respect the privacy of its users”) are elicited from and understood by relevant AI actors. Design decisions take socio-technical implications into account to address AI risks.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Section 22 sets information privacy principles 1 and 2: personal information may be collected only for a lawful purpose connected with the agency's function, and must be collected from the individual concerned unless an exception applies, including that the information is publicly available. Neither principle, nor the application and interpretation sections 4 and 7, imposes a duty to create, keep, produce or review a log or record. Section 4(1) applies the Act to a New Zealand agency, to an overseas agency in the course of carrying on business in New Zealand, and to an individual present in New Zealand. The Act's other principles and its notification and access provisions are not cited by this row.
- Kind
- None
- As of
What this law does
The Privacy Act 2020's definition of personal information carries no exception for information that is publicly accessible, so an agency, including an overseas agency carrying on business in New Zealand, that scrapes personal information from a public website, including for AI training, must still collect it only for a lawful purpose connected with a function of the agency and only where necessary for that purpose under information privacy principle 1.
Information privacy principle 2 ordinarily requires collection directly from the individual concerned, but excuses that where the information is a publicly available publication, so a scrape drawing on such a publication does not by itself breach the source-of-collection principle even though the information remains personal information for every other purpose of the Act.
When LexLint raises it
When your app profile says your app crawls the web, trains models or processes biometric data.
Back to the example · Lint your app
Page updated .