The Privacy Act 2020 came into force on 1 December 2020, replacing the Privacy Act 1993. It has introduced new requirements for New Zealand businesses (including farms) and organisations to give greater protections for individuals.
If a business or organisation has a privacy breach that has caused serious harm to someone or could do so, then it must notify the Office of the Privacy Commissioner.
The onus is on the business or organisation, not individual employees.
There are 13 information privacy principles including collecting only the information you need, advising people what you are doing, storing information securely and giving people access to their personal information. There is more on these 13 principles here.
If you are an employer, it would be prudent to review your employment agreements to check whether there is a confidentiality clause that creates the obligation on both you and your employees both during the employment period and following.
We recommend that you be proactive, consider the information you hold and how you can store employment-related records safely. If you haven't done so already, you should develop a privacy statement for your employees and contractors, and encourage everyone to engage to consider their actions.