The Privacy Act 2020 was passed on 30 June 2020 and comes into force on 1 December 2020. It will repeal and replace the current Privacy Act 1993, and will update the law to reflect the continually-evolving needs of the digital age. 

Some of the key changes are:

•      Overseas agencies: The legislation will apply to any person or organisation (known as 'agencies' in the Act) located overseas who are 'carrying on business' in New Zealand

•      Mandatory reporting of privacy breaches: If an agency believes a privacy breach has caused, or is likely to cause, serious harm, then it must notify the Privacy Commissioner and affected individuals

•      Compliance notices: The Commissioner can issue a compliance notice to an agency that has failed to adequately respond and remedy a privacy breach requiring them to do something or stop doing something

•      Storing information overseas: An agency will remain responsible for information sent overseas or stored on overseas servers

•      Criminal offences and penalties: It is a criminal offence to mislead an agency to obtain someone else's personal information, or destroy evidence where the Commissioner has requested it, and

•      Penalties: The maximum fine for a privacy breach has increased from $2,000 to $10,000.

We recommend you review your privacy policies before the new legislation comes into force. You must also have clear procedures in place to ensure you and your organisation can comply with these additional privacy obligations.