Securiti launches Gencore AI, a holistic solution to build Safe Enterprise AI with proprietary data - easily

View
Contact Us See a demo

International data transfers under New Zealand’s new Privacy Act

data transfers under New Zealand Privacy Act banner
Author

Muhammad Faisal Sattar

Lead Data Privacy Analyst at Securiti

FIP, CIPT, CIPM, CIPP/Asia

Listen to the content

From 1 December 2020, an organization that is subject to New Zealand’s new Privacy Act 2020 can transfer personal information outside New Zealand only if:

  • The organization has reasonable grounds to believe that the foreign person or entity in question is subject to comparable privacy safeguards to those that apply under New Zealand’s Privacy Act, or agrees to be bound by such comparable privacy safeguards, or
  • The concerned data subjects have expressly authorised the disclosure of their personal information after having been informed that the foreign person or entity may not be required to protect their personal information in a way that provides comparable privacy safeguards to those that apply under New Zealand’s Privacy Act.

In light of the aforementioned obligations, organizations aiming to transfer personal information outside New Zealand must conduct the following steps.

Step 1: Assess whether the foreign entity provides comparable privacy safeguards

In order to assess whether the foreign entity or person in question provides comparable privacy safeguards to those that apply under New Zealand’s Privacy Act, organizations must conduct due diligence by taking into consideration the following factors:

  • The scope of privacy law of the foreign country and whether or not it covers the foreign person or entity in question and the personal information the data exporter has provided to it
  • The security safeguards of the foreign person or entity in question and whether or not they are reasonable in the circumstances
  • The accessibility of meaningful complaint mechanisms with a data protection authority for data subjects
  • The existence of an independent data protection authority that oversees compliance and enforcement functions

Step 2: Enter into a contract with the data recipient ensuring comparable privacy safeguards

Where the foreign person or entity is not subject to comparable privacy standards to those in New Zealand’s Privacy Act, it must agree to be bound by such safeguards via contractual arrangements. The New Zealand’s Office of the Privacy Commissioner has provided a Model Agreement to be entered between a data discloser and data recipient in such a situation, that can be modified by parties.

Part 1 of the Model Agreement deals with relevant details such as names of data discloser and recipient, the identification of transferred information, whether the disclosure is ongoing or periodic, the permitted use or disclosure of personal information, specific security requirements, whether the transferred information includes sensitive personal information, the party responsible for privacy breach notification, local data protection laws, termination of the Agreement and its consequences, deletion of data, and other special terms.

Part 2 of the Model Agreement deals with more detailed obligations of the parties, that are summarised in the following table:

CLAUSE OBLIGATIONS OF THE PARTIES
What safeguards must the recipient have in place?
  1. The recipient will collect personal information only as reasonably for lawful purposes
  2. The recipient will implement best practice safeguards to prevent privacy breaches
  3. The recipient will ensure the accuracy of the collected personal information
  4. The recipient will destroy or delete personal information once it is no longer reasonably required
  5. The recipient will ensure additional precautions for sensitive personal information
  6. The recipient will maintain a privacy officer responsible for monitoring and ensuring compliance
  7. The discloser will suspend any further disclosure of transferred information to the recipient if the recipient is in breach of this Agreement until the recipient has corrected the breach.
What if the recipient shares information with others?
  1. The recipient will use all reasonable endeavours to prevent any unauthorised use or disclosure of personal information when it transfers personal information to third parties acting as agents to the recipient
  2. The recipient will enter into a binding agreement with a third-party when personal information is transferred to the third-party for the purposes of that third-party
What happens if there is a privacy breach?
  1. Parties can choose as to who notifies the affected individuals
  2. The recipient will notify the discloser if it learns of a privacy breach
  3. The recipient may be required to notify under local data laws
What happens if an individual asks to see or correct their personal information?
  1. The recipient agrees that each individual has rights of access and correction
  2. The recipient will take reasonable steps to ensure the exercise of rights of data access and correction
  3. The recipient must respond to data subjects’ access and correction requests as soon as reasonably practicable and no later than 30 days after receiving the request
What about complying with laws?
  1. The discloser undertakes to comply with its own laws
  2. The recipient will ensure that the treatment of the transferred personal information is consistent with the local data law
  3. The recipient will notify the discloser about any use or disclosure compelled by law
  4. The recipient is not aware of any local laws that would undermine the Agreement
What can individuals do if there is a breach?
  1. Individuals can claim monetary compensation, restraining orders from continuing or repeating an interference with privacy, or a specific order with a view to remedying the interference with privacy
  2. Individuals will not be entitled to any damages or relief beyond what could be reasonably expected to be granted under New Zealand’s Privacy Act in the same circumstances
  3. Individuals will have these remedial rights even if they are not a party to this Agreement
  4. The discloser can bring a claim on behalf of one or more individuals
When does this agreement start and end?
  1. The Agreement ends when a party ends it. Parties can terminate the Agreement by giving 30 day notice to the other party
  2. Data discloser can terminate the Agreement if data transfer suspension continues for more than 30 days, the recipient has persistently or materially breached the Agreement, or the discloser reasonably considers that the recipient is subject to laws that have a material adverse effect on the data intended to be protected under this Agreement
  3. Data recipient can terminate the Agreement if the discloser has persistently or materially breached the Agreement
  4. The terms of the Agreement continue to apply to the transferred data until the recipient has securely and permanently deleted or destroyed all of the transferred data
Anything else?
  1. The parties submit to the non-exclusive jurisdiction of the New Zealand courts
  2. Each party will keep this Agreement confidential

 

Step 3: Take express authorisation of the concerned data subject

Where the foreign person or entity neither provides comparable privacy safeguards to those in New Zealand’s Privacy Act nor agrees to be bound by any contractual clauses, an international data transfer can take place with the consent of the concerned data subject. In such a case, the data exporter must:

  • Inform the data subject about the international data transfer and its purpose in a clear and easily understandable language
  • Take reasonable steps to ensure that the data subject has been expressly informed of the international data transfer
  • Inform the data subject that his/her personal information may not be protected in a way that provides comparable privacy safeguards to those that apply under New Zealand’s Privacy Act.

Step 4: Confirm whether the foreign entity or person is part of the binding scheme

If any of the above steps are not satisfied, the foreign person or entity in question must be a participant in a “prescribed binding scheme”, i.e. a list of countries issued by the Government of New Zealand that is deemed to be providing comparable privacy safeguards to those in New Zealand’s Privacy Act. No such scheme has been issued until now.

Exceptions

An organization aiming to transfer personal information outside New Zealand is not required to comply with the above steps in the following situations:

  • If the organization transfers personal information to offshore cloud providers or other agents to store or process their data so long as the agent or cloud provider is not using that personal information for their own purposes. In such a case, the data exporter will be responsible to comply with the obligations under New Zealand’s Privacy Act.
  • If the organization believes on reasonable grounds that the disclosure of personal information is necessary to avoid prejudice to the maintenance of the law or to prevent or lessen a serious threat.
  • If it is not reasonably practicable in the circumstances to comply with the requirements, where the circumstances require the information to be disclosed urgently.
  • Where the personal information is sent to a person or entity that is subject to New Zealand’s Privacy Act, where personal information is sent to the person concerned (including the person’s authorised representative), or where personal information is publicly available.

Ask for a DEMO today to understand how securiti.ai can help you comply with New Zealand’s Privacy Act 2020, GDPR, and a whole host of other global privacy laws and regulations, such as the CCPA, with ease.

Frequently Asked Questions (FAQs)

New Zealand is not part of the European Union (EU) or the European Economic Area (EEA), which are subject to the General Data Protection Regulation (GDPR). However, New Zealand's privacy laws have been recognized as providing an adequate level of data protection by the European Commission, allowing data transfers from the EU to New Zealand without the need for additional safeguards.

An international data transfer occurs when personal data is transmitted from one country or jurisdiction to another. This transfer can be within the same organization, to a third-party service provider, or between entities in different countries. International data transfers are subject to data protection regulations and may require specific safeguards to ensure data privacy and security.

Join Our Newsletter

Get all the latest information, law updates and more delivered to your inbox

Share

More Stories that May Interest You

New Zealand Privacy Act compliance checklist banner View More

December 3, 2020

Compliance Checklist for New Zealand’s new Privacy Act

On 1 December 2020, New Zealand’s new Privacy Act 2020 came into effect. Our experts at Securiti have compiled the following list of compliance...

New Zealand’s New Privacy Act banner View More

July 8, 2020

Understanding New Zealand’s Privacy Act 2020: Key Changes and Compliance Strategies

Table of contents Privacy Bill Summary Key Changes Frequently Asked Questions (FAQs) The Privacy Act 2020 was passed by the New Zealand Government in...

What's
New