In light of the aforementioned obligations, organizations aiming to transfer personal information outside New Zealand must conduct the following steps.
Step 1: Assess whether the foreign entity provides comparable privacy safeguards
In order to assess whether the foreign entity or person in question provides comparable privacy safeguards to those that apply under New Zealand’s Privacy Act, organizations must conduct due diligence by taking into consideration the following factors:
- The scope of privacy law of the foreign country and whether or not it covers the foreign person or entity in question and the personal information the data exporter has provided to it
- The security safeguards of the foreign person or entity in question and whether or not they are reasonable in the circumstances
- The accessibility of meaningful complaint mechanisms with a data protection authority for data subjects
- The existence of an independent data protection authority that oversees compliance and enforcement functions
Step 2: Enter into a contract with the data recipient ensuring comparable privacy safeguards
Where the foreign person or entity is not subject to comparable privacy standards to those in New Zealand’s Privacy Act, it must agree to be bound by such safeguards via contractual arrangements. The New Zealand’s Office of the Privacy Commissioner has provided a Model Agreement to be entered between a data discloser and data recipient in such a situation, that can be modified by parties.
Part 1 of the Model Agreement deals with relevant details such as names of data discloser and recipient, the identification of transferred information, whether the disclosure is ongoing or periodic, the permitted use or disclosure of personal information, specific security requirements, whether the transferred information includes sensitive personal information, the party responsible for privacy breach notification, local data protection laws, termination of the Agreement and its consequences, deletion of data, and other special terms.
Part 2 of the Model Agreement deals with more detailed obligations of the parties, that are summarised in the following table:
| CLAUSE |
OBLIGATIONS OF THE PARTIES |
| What safeguards must the recipient have in place? |
- The recipient will collect personal information only as reasonably for lawful purposes
- The recipient will implement best practice safeguards to prevent privacy breaches
- The recipient will ensure the accuracy of the collected personal information
- The recipient will destroy or delete personal information once it is no longer reasonably required
- The recipient will ensure additional precautions for sensitive personal information
- The recipient will maintain a privacy officer responsible for monitoring and ensuring compliance
- The discloser will suspend any further disclosure of transferred information to the recipient if the recipient is in breach of this Agreement until the recipient has corrected the breach.
|
| What if the recipient shares information with others? |
- The recipient will use all reasonable endeavours to prevent any unauthorised use or disclosure of personal information when it transfers personal information to third parties acting as agents to the recipient
- The recipient will enter into a binding agreement with a third-party when personal information is transferred to the third-party for the purposes of that third-party
|
| What happens if there is a privacy breach? |
- Parties can choose as to who notifies the affected individuals
- The recipient will notify the discloser if it learns of a privacy breach
- The recipient may be required to notify under local data laws
|
| What happens if an individual asks to see or correct their personal information? |
- The recipient agrees that each individual has rights of access and correction
- The recipient will take reasonable steps to ensure the exercise of rights of data access and correction
- The recipient must respond to data subjects’ access and correction requests as soon as reasonably practicable and no later than 30 days after receiving the request
|
| What about complying with laws? |
- The discloser undertakes to comply with its own laws
- The recipient will ensure that the treatment of the transferred personal information is consistent with the local data law
- The recipient will notify the discloser about any use or disclosure compelled by law
- The recipient is not aware of any local laws that would undermine the Agreement
|
| What can individuals do if there is a breach? |
- Individuals can claim monetary compensation, restraining orders from continuing or repeating an interference with privacy, or a specific order with a view to remedying the interference with privacy
- Individuals will not be entitled to any damages or relief beyond what could be reasonably expected to be granted under New Zealand’s Privacy Act in the same circumstances
- Individuals will have these remedial rights even if they are not a party to this Agreement
- The discloser can bring a claim on behalf of one or more individuals
|
| When does this agreement start and end? |
- The Agreement ends when a party ends it. Parties can terminate the Agreement by giving 30 day notice to the other party
- Data discloser can terminate the Agreement if data transfer suspension continues for more than 30 days, the recipient has persistently or materially breached the Agreement, or the discloser reasonably considers that the recipient is subject to laws that have a material adverse effect on the data intended to be protected under this Agreement
- Data recipient can terminate the Agreement if the discloser has persistently or materially breached the Agreement
- The terms of the Agreement continue to apply to the transferred data until the recipient has securely and permanently deleted or destroyed all of the transferred data
|
| Anything else? |
- The parties submit to the non-exclusive jurisdiction of the New Zealand courts
- Each party will keep this Agreement confidential
|
Step 3: Take express authorisation of the concerned data subject
Where the foreign person or entity neither provides comparable privacy safeguards to those in New Zealand’s Privacy Act nor agrees to be bound by any contractual clauses, an international data transfer can take place with the consent of the concerned data subject. In such a case, the data exporter must:
- Inform the data subject about the international data transfer and its purpose in a clear and easily understandable language
- Take reasonable steps to ensure that the data subject has been expressly informed of the international data transfer
- Inform the data subject that his/her personal information may not be protected in a way that provides comparable privacy safeguards to those that apply under New Zealand’s Privacy Act.
Step 4: Confirm whether the foreign entity or person is part of the binding scheme
If any of the above steps are not satisfied, the foreign person or entity in question must be a participant in a “prescribed binding scheme”, i.e. a list of countries issued by the Government of New Zealand that is deemed to be providing comparable privacy safeguards to those in New Zealand’s Privacy Act. No such scheme has been issued until now.
Exceptions
An organization aiming to transfer personal information outside New Zealand is not required to comply with the above steps in the following situations:
- If the organization transfers personal information to offshore cloud providers or other agents to store or process their data so long as the agent or cloud provider is not using that personal information for their own purposes. In such a case, the data exporter will be responsible to comply with the obligations under New Zealand’s Privacy Act.
- If the organization believes on reasonable grounds that the disclosure of personal information is necessary to avoid prejudice to the maintenance of the law or to prevent or lessen a serious threat.
- If it is not reasonably practicable in the circumstances to comply with the requirements, where the circumstances require the information to be disclosed urgently.
- Where the personal information is sent to a person or entity that is subject to New Zealand’s Privacy Act, where personal information is sent to the person concerned (including the person’s authorised representative), or where personal information is publicly available.
Ask for a DEMO today to understand how securiti.ai can help you comply with New Zealand’s Privacy Act 2020, GDPR, and a whole host of other global privacy laws and regulations, such as the CCPA, with ease.
