New Zealand

New Zealand's Privacy Act 2020 is the comprehensive personal-data regime, binding any New Zealand agency and any overseas agency carrying on business in New Zealand through thirteen information privacy principles covering lawful collection, use, disclosure, and correction of personal information, with no distinct exemption for information sourced from a publicly available publication.

The Act carries no General Data Protection Regulation (GDPR)-style sensitive-category tier; "biometric information" is defined only for the government-to-government identity-information-sharing scheme in Part 7, not as a general private-sector duty, and "sensitive" appears only as a factor in assessing whether a privacy breach is serious.

A Privacy Amendment Act 2025 addition, information privacy principle 3A, took effect on 1 May 2026 and requires an agency that collects personal information about someone other than from that person to take reasonable steps to make them aware of the collection. Information privacy principle 12 conditions any disclosure of personal information to an overseas recipient on one of several safeguards.

An agency must notify the Privacy Commissioner, and ordinarily the affected individual, of any notifiable privacy breach likely to cause serious harm, and the Commissioner can issue a compliance notice enforceable in the Human Rights Review Tribunal, alongside a set of standalone offences carrying fines of up to $10,000.

New Zealand has no scraping-specific statute, so general law governs each dimension separately.

Open-web crawling of a public, unauthenticated page is not itself addressed by any provision; the Crimes Act 1961's computer-misuse offence in section 252 reaches a person who intentionally accesses a computer system without authorisation, knowing or reckless as to the lack of authorisation, and section 252(2) states that this offence does not apply where a person who is authorised to access a computer system uses that access for a different purpose than the one for which it was given, so a crawler using its own account credentials for automated collection faces contract exposure rather than a computer-misuse charge.

No reported New Zealand decision has tested whether continuing to crawl after a cease-and-desist notice, after a robots.txt disallow, or after a technical block converts otherwise-public access into unauthorised access under this section, and no New Zealand statute or reported case assigns robots.txt any legal weight.

Terms of service actively agreed to, for example by creating an account, form a binding electronic contract under the Contract and Commercial Law Act 2017, section 211, which denies an electronic communication no legal effect solely because of its electronic form, but no reported New Zealand decision addresses whether terms shown only by a website link, rather than actively accepted, are incorporated; the Chief Justice and two Supreme Court judges have written that there is surprisingly little authority on how online contract terms are incorporated and enforced at all, so browsewrap enforceability is unsettled.

New Zealand recognises no distinct trespass-to-chattels tort or hot-news misappropriation doctrine, leaving only the general law of contract and the tort of passing off to reach that ground.

The Copyright Act 1994 permits fair dealing for criticism, review, and news reporting (s. 42) and for research or private study (s. 43), but carries no text-and-data-mining exception, so commercial mining of scraped copyrighted text infringes the owner's exclusive right to copy the work under section 16 and no opt-out mechanism arises because no exception exists to opt back into; its definition of literary work extends to a table or compilation, so a scraped compilation can attract copyright if its selection or arrangement is original, but the Act creates no separate sui generis database right of the European kind.

The Privacy Act 2020's definition of personal information carries no exception for information that is publicly accessible, so scraping personal information from a public New Zealand website remains subject to the Information Privacy Principles for any agency the Act reaches, including an overseas agency carrying on business in New Zealand.

The Government's 2025 Public Service AI Framework and the Ministry for Regulation's Responsible AI in Action guidance set expectations for public agencies acquiring or deploying artificial intelligence but do not address AI-training data specifically and are administrative guidance rather than legislation, so New Zealand has no AI-training-specific law.

New Zealand has no NIS2- or Cyber Resilience Act-style general cybersecurity statute, no enacted connected-device or software-product security law binding a manufacturer or distributor, and no standalone "reasonable security" or information-security-programme statute of general private-sector application; each of those research dimensions is a researched absence.

The one enacted instrument reaching product or system security, the Telecommunications (Interception Capability and Security) Act 2013 (TICSA), is a sector regime whose Part 3 (ss.45 to 59, "Network security") binds a network operator and is filed as a row of its own.

Part 3 applies only to a network operator, defined at section 3 as a person who owns, controls, or operates a public telecommunications network, or who supplies (whether by wholesale or retail) another person with the capability to provide a telecommunications service; the Act's own "service provider" definition, by contrast, expressly excludes a network operator, so an ordinary retail telecommunications reseller with no infrastructure of its own sits outside Part 3 as well.

A network operator must engage with the Director of the Government Communications Security Bureau (GCSB) in good faith as soon as practicable after becoming aware of a network security risk (section 46) and must notify the Director before procuring, acquiring, or architecturally changing equipment, systems, or services within a defined "area of specified security interest" (network operations centres, lawful-interception equipment, aggregated customer data or credential stores, and any area later prescribed by Order in Council) (sections 47 and 48).

Failure to comply, where it gives rise to a significant network security risk, can be referred to the Minister for a binding direction (sections 54 to 57) or, on application by a surveillance agency to the High Court, produce a compliance order (section 92) and a pecuniary penalty capped at NZD 500,000, plus NZD 50,000 per day of a continuing contravention of a compliance order (section 98); only a surveillance agency, not a private plaintiff, may apply (section 91).

New Zealand's financial-sector cyber posture rests on the Reserve Bank: the Reserve Bank of New Zealand's 2021 cyber resilience guidance is expressly principle-based and non-binding, and its FMI Standard 17C, a standard with legal force under the Financial Market Infrastructures Act 2021, together with the Reserve Bank's outsourcing policy BS11, bind only registered banks, licensed non-bank deposit takers, licensed insurers, and designated financial market infrastructures.

CERT NZ, now folded into the National Cyber Security Centre, operates a coordinated vulnerability disclosure channel and accepts incident reports, but reporting to it is voluntary for a private entity; the Protective Security Requirements framework binds public service departments to report incidents, a government duty rather than one on a private developer or vendor, and is not filed here for that reason.

New Zealand's breach-notification duty for personal information is this jurisdiction's own privacy-topic row, Privacy Act 2020 Information Privacy Principle 11A and the Notifiable Privacy Breaches provisions, and is not repeated here; Information Privacy Principle 5's reasonable-security-safeguards duty sits inside that same comprehensive regime and stays there under the standing seam rule for a controller security-of-processing article.

New Zealand's unauthorised-computer-access offence, Crimes Act 1961 section 252, is an offence committed by an intruder and is this jurisdiction's scraping-topic row, not a security-topic one. Part 3 of the Telecommunications (Interception Capability and Security) Act 2013 requires a network operator to engage with the Director of the Government Communications Security Bureau as soon as practicable after becoming aware of any network security risk.

The Reserve Bank of New Zealand states that registered banks, non-bank deposit takers and insurers are required to report material cyber incidents to it as soon as practicable, but within 72 hours.

New Zealand has no social-media minimum-age statute, app-store age-verification law, or age-appropriate design code in force.

The Films, Videos, and Publications Classification Act 1993 is New Zealand's content-classification regime, and its definition of publication reaches digital content stored on a disc, a computer file, or any thing capable of being reproduced by a computer or other electronic device, while distribute expressly includes providing access to a publication by means of a public data network, so the Act binds an online supplier on the same terms as a physical one.

The Act classifies a publication as objectionable, meaning its unrestricted availability would be injurious to the public good, in which case supply to any person is banned outright, or as restricted, meaning it may not be supplied, exhibited, or displayed otherwise than in accordance with the age or other limits fixed by its classification, most often an age threshold.

Separately, a person who supplies or exhibits to anyone under 18 a publication that would itself be classified objectionable for a person of that age, knowing or with reasonable cause to believe this, commits an offence, whether or not the publication is objectionable for an adult. Nothing in the Act names a specific verification method a supplier must use to confirm a recipient's age.

New Zealand has no press-publisher neighbouring right of the European kind, no compelled platform-to-publisher bargaining code, no codified hot-news or misappropriation doctrine, and no statute or reported decision addressing whether linking to or framing a news article is a communication to the public.

Reproducing a headline or snippet of a news article falls to the Copyright Act 1994's general fair-dealing exception for reporting current events (s. 42), which permits fair dealing with a work for that purpose, accompanied by a sufficient acknowledgement where the reporting is not by sound recording, film, or communication work; the exception turns on the fairness and purpose of the specific dealing rather than granting a blanket allowance for aggregation.

The Act carries no text-and-data-mining exception, so an aggregator's automated indexing or AI training on news content must fit within the criticism, review, or news-reporting fair-dealing purposes or a comparable exception, or else infringe.

Section 27 removes copyright from Bills, Acts, regulations, parliamentary debates, select committee reports, and court and tribunal judgments, so a service reproducing or aggregating those specific categories of government material does so free of copyright restriction, though this does not extend to a private publisher's own news reporting.