International data transfers under New Zealand’s new Privacy Act

In light of the aforementioned obligations, organizations aiming to transfer personal information outside New Zealand must conduct the following steps.

Step 1: Assess whether the foreign entity provides comparable privacy safeguards

In order to assess whether the foreign entity or person in question provides comparable privacy safeguards to those that apply under New Zealand’s Privacy Act, organizations must conduct due diligence by taking into consideration the following factors:

• The scope of privacy law of the foreign country and whether or not it covers the foreign person or entity in question and the personal information the data exporter has provided to it
• The security safeguards of the foreign person or entity in question and whether or not they are reasonable in the circumstances
• The accessibility of meaningful complaint mechanisms with a data protection authority for data subjects
• The existence of an independent data protection authority that oversees compliance and enforcement functions

Step 2: Enter into a contract with the data recipient ensuring comparable privacy safeguards

Where the foreign person or entity is not subject to comparable privacy standards to those in New Zealand’s Privacy Act, it must agree to be bound by such safeguards via contractual arrangements. The New Zealand’s Office of the Privacy Commissioner has provided a Model Agreement to be entered between a data discloser and data recipient in such a situation, that can be modified by parties.

Part 1 of the Model Agreement deals with relevant details such as names of data discloser and recipient, the identification of transferred information, whether the disclosure is ongoing or periodic, the permitted use or disclosure of personal information, specific security requirements, whether the transferred information includes sensitive personal information, the party responsible for privacy breach notification, local data protection laws, termination of the Agreement and its consequences, deletion of data, and other special terms.

Part 2 of the Model Agreement deals with more detailed obligations of the parties, that are summarised in the following table:

Step 3: Take express authorisation of the concerned data subject

Where the foreign person or entity neither provides comparable privacy safeguards to those in New Zealand’s Privacy Act nor agrees to be bound by any contractual clauses, an international data transfer can take place with the consent of the concerned data subject. In such a case, the data exporter must:

• Inform the data subject about the international data transfer and its purpose in a clear and easily understandable language
• Take reasonable steps to ensure that the data subject has been expressly informed of the international data transfer
• Inform the data subject that his/her personal information may not be protected in a way that provides comparable privacy safeguards to those that apply under New Zealand’s Privacy Act.

Step 4: Confirm whether the foreign entity or person is part of the binding scheme

If any of the above steps are not satisfied, the foreign person or entity in question must be a participant in a “prescribed binding scheme”, i.e. a list of countries issued by the Government of New Zealand that is deemed to be providing comparable privacy safeguards to those in New Zealand’s Privacy Act. No such scheme has been issued until now.

Exceptions

An organization aiming to transfer personal information outside New Zealand is not required to comply with the above steps in the following situations:

• If the organization transfers personal information to offshore cloud providers or other agents to store or process their data so long as the agent or cloud provider is not using that personal information for their own purposes. In such a case, the data exporter will be responsible to comply with the obligations under New Zealand’s Privacy Act.
• If the organization believes on reasonable grounds that the disclosure of personal information is necessary to avoid prejudice to the maintenance of the law or to prevent or lessen a serious threat.
• If it is not reasonably practicable in the circumstances to comply with the requirements, where the circumstances require the information to be disclosed urgently.
• Where the personal information is sent to a person or entity that is subject to New Zealand’s Privacy Act, where personal information is sent to the person concerned (including the person’s authorised representative), or where personal information is publicly available.

Ask for a DEMO today to understand how securiti.ai can help you comply with New Zealand’s Privacy Act 2020, GDPR, and a whole host of other global privacy laws and regulations, such as the CCPA, with ease.