The Statutes Amendment Bill has been introduced on September 23, 2024, as an omnibus Bill that proposes a number of small but relevant updates to the Privacy Act 2020 (among 41 other Acts). We summarise some of the proposed amendments we consider relevant for businesses who regularly deal with personal information. 

Key Proposed Amendments

Clarifying Access to Information Requests

The Bill repeals agencies’ option to respond to an information request that the personal information requested is not readily retrievable. Instead, the Bill makes this a new ground for agencies to refuse access (which was a ground available to agencies under the Privacy Act 1993). One key outcome of this change is that it gives individuals the right to complain to the Privacy Commissioner if their access request is refused on such grounds. 

This change can benefit businesses by limiting their obligation to provide access to information that is ‘readily retrievable,’ such as information held in a customer or employee file. Potentially with this clarification, businesses may be able to limit their response to ‘all information about me’ type of access requests on this ground. So instead of searching extensively through various records, files, and email correspondence to find every trace of personal information about an individual, it would be possible to respond with just what is readily retrievable.

However, agencies cannot refuse access on this ground if the information is not readily retrievable because of improper record keeping processes or inadequate IT systems. This includes information held by third party service providers, such as a cloud service provider. Agencies must ensure that retrieving personal data quickly and efficiently is a core element of their relationship with third-party providers, ideally supported by clear contractual obligations requiring service providers to ensure information is readily retrievable and assist agencies in responding to access requests. The change highlights the need for agencies to strengthen their data management and ensure that their processes for handling access requests are fully aligned with privacy obligations.

Agency Liability for Service Providers’ actions in the event of a notifiable privacy breach

Another set of key amendments clarifies agencies’ liability when a notifiable privacy breach occurs. The amendments provide that:

• if a person holding information for or on behalf of an agency (such as a representative or a party responsible for safe custody and processing) becomes aware of a breach, that knowledge is deemed to be known by the primary agency; and 
• anything done by such persons relating to the primary agency’s obligation to notify the Privacy Commissioner and affected individuals of a notifiable privacy breach is deemed to be done by the primary agency,

and such persons are not liable in processes or proceedings relating to the primary agency’s failure to notify the Privacy Commissioner and affected individuals of a notifiable privacy breach.

This amendment is a clarification bridge between section 11 of the Act, which treats information held for or on behalf of an agency as being held by the agency, and sections 120 and 121, which treat the knowledge and actions of officers, employees, agents, etc. as knowledge of the agency.

Although this amendment doesn’t change common interpretation and practical application of the Act, it provides welcome clarity. This is particularly important where agencies use service providers, such as data processors or cloud storage companies, to handle personal information. If a service provider becomes aware of a breach, the agency itself is treated as having that knowledge, and if the service provider does anything that causes the agency to fail its notification obligations, the service provider is not liable to the affected individual (they may be liable to the agency if there are appropriate contractual measures dealing with these situations). 

The amendments serve as a good reminder for agencies to maintain strong oversight over their third-party providers and ensure that service providers have mechanisms in place to detect and report breaches in a timely manner.

International Data Transfers to prescribed countries

The Bill also proposes changes to IPP 12, which governs the disclosure of personal information to overseas entities. The new provision clarifies that an agency can only disclose information to an overseas agency in a ‘prescribed country’, provided no specific restrictions or limitations exist for that country. 

This is an ironic amendment, considering no ‘prescribed countries’ have been specified in regulations despite the calls from the industry and previous aspirations to publish such regulations since 2021.

Other amendments

Other notable Privacy Act amendments in the Bill include:

• clarifying the limited application of the Act to individuals’ domestic affairs by specifying that individuals can hold personal information for personal or domestic purposes, even if the information was unsolicited or created by the individual, reducing ambiguity for individuals who may handle unsolicited data or generate their own information; and
• giving the Privacy Commissioner more discretion to decide when not to investigate a complaint.

Our Comments

The amendments proposed in the Bill continue to refine and clarify the Privacy Act. That said, the amendments regarding agencies and agents (e.g., service providers) highlight once again that the unique terminology used in the New Zealand Privacy Act remains difficult to easily understand. It may aid New Zealand public and businesses if we were to adopt more globally recognised privacy terms, such as "controller" and "processor,".

The introduction of the Bill and proposed amendments are good reminders for all entities operating in New Zealand to ensure that their internal processes and contractual arrangements with service providers are up to scratch, to benefit from the ability to refuse access requests to information that is not ‘readily retrievable’ and manage their risks from service provider knowledge and actions relating to breaches. Clarifications place emphasis on the importance of entities maintaining strong oversight of their external relationships, so are a reminder to reassess privacy practices and contractual arrangements to manage risks appropriately.

Next steps

Assuming this Bill passes its First Reading in Parliament, it will advance to the Select Committee stage. This will give the public the opportunity to make a submission (either oral and/or written). Any person may provide feedback about whether they think this Bill should progress and become law - we’d be happy to assist clients who wish to make a submission.

Find out more

If you have any questions or wish to discuss these proposed changes, you can talk directly with the experts. Our privacy law specialists are available and have extensive experience in dealing with the privacy matters of organisations. Feel free to get in touch with Hayley Miller, Campbell Featherstone, Güneş Haksever, or Ashleigh Ooi to discuss. 

This article was written by Partner Hayley Miller, and Senior Associate Güneş Haksever in our Commercial, Technology and Privacy team.