The Government is changing the Privacy Act 2020 (the Act) to improve transparency about the collection of personal information and to better enable people to exercise their privacy rights.
The Privacy Amendment Bill will introduce a new information privacy principle 3A (IPP 3A) relating to indirect collection of personal information. Under the new IPP 3A, an agency that collects personal information from a source other than the individual themselves must take reasonable steps to ensure that the individual is aware of specified matters. These new steps are closely based on existing requirements for direct collection of information (IPP 3).
The Bill also makes several technical amendments to address some minor issues that have arisen since the Act came into force.
The Office of the Privacy Commissioner(external link) is developing guidance for businesses and agencies on complying with new IPP 3A. They are interested in hearing about specific areas where guidance would be most helpful – agencies can contact the OPC at: guidance@privacy.org.nz to be included in this engagement.
The collection of information from sources other than the individual concerned was highlighted as a gap in our privacy system by the European Union during its assessment of New Zealand’s EU “adequacy status”.
EU adequacy means New Zealand businesses can receive information from the European Union without implementing individual contractual agreements, and places New Zealand in a small cohort of jurisdictions recognised for protecting individual privacy. The bill is designed to support New Zealand to retain its adequacy status into the future.
The Bill was introduced to Parliament in September 2023 and received its first reading in May 2024. The Justice Committee received 55 submissions.
Although the Bill proposes that amendments related to IPP 3A (in Part 1) will come into force on 1 June 2025, the Minister of Justice has announced he intends to extend the commencement date for Part 1 of the Bill to maintain a minimum 6-month implementation period for agencies to prepare to comply with IPP 3A. Technical amendments to part 2 of the Act will come into force the day after Royal Assent.
Read the Privacy Amendment Bill(external link) (New Zealand Legislation website)
Follow progress of the Privacy Amendment Bill(external link) (Justice Committee website)
Cabinet paper: Privacy Amendment Bill 2023: Approval for introduction [PDF, 606 KB]
Regulatory Impact Statement: Broadening notification in the Privacy Act 2020 [PDF, 1.8 MB]
Departmental Report: Initial Briefing - Privacy Amendment Bill(external link)
Consistency with the New Zealand Bill of Rights Act 1990: Privacy Amendment Bill [PDF, 2.7 MB]