Privacy Amendment Bill

First reading May 2024…. Deadline for submissions to select committee June 14, 2024.

The new Privacy Amendment Bill which we alerted marketers to in November 2022 has received its first reading in Parliament. The Bill proposes changes to the Privacy Act 2020, including new disclosure requirements on organisations that collect personal information from any source other than the individual concerned. 

Who is affected?

Any organisation that collects personal information about an individual from a source other than from the individual concerned. That means anyone buying, renting or exchanging personal data   will be affected by the proposed amendments. 

What is being changed?

The Bill introduces a new information privacy principle 3A (referred to as IPP 3A). It is closely based on the existing principle 3 requirements which govern the collection of information directly from an individual, and will require any agency collecting personal information from a source other than from the individual concerned to take reasonable steps to ensure that the individual is made aware of: 

• the fact the information has been collected.
• the purpose for which it is has been collected.
• the recipients of the information. 
• the name and address of the agency collecting and holding the information.
• whether the collection is authorised or required by law; and
• the individual’s rights of access to and correction of the information. 

The information set out above must be provided as soon as is reasonably practicable after the information has been collected. 

The Bill does include certain exceptions which excuse an organisation from complying with IPP 3A, including where: 

• the individual has previously been made aware of the organisation’s collection of the information.
• non-compliance would not prejudice the interests of the individual concerned.
• non-compliance is necessary to avoid prejudice to the maintenance of the law or enforcement of a law.
• compliance would prejudice the purposes of the collection. 
• compliance is not reasonably practicable in the circumstances; or
• the information will be used in a form that does not identify the individual or will be used for statistical or research purposes.
• The information is publicly available.

Importantly though, the Bill clarifies that IPP 3A does not apply to personal information collected before 1 June 2025. So organisations will have a brief period in which to reorganise their data collection and notification systems. 

Why is the change proposed?

Paulo Garcia the MP for New Lynn explained it to the house like this:

“There has been a loophole in our Privacy Act, which this Privacy Amendment Bill seeks to remedy, and that is in information privacy principle 3, when agencies acquire our personal information. That personal information would be our names and our addresses, and the purposes for the information being collected, and the rights of our access to and correction of that record, when directly requested of us by agencies, is already protected. However, there is that loophole which this bill seeks to amend, which is when other agencies take our information from what is already out in the digital world. What this bill seeks to do is to ensure that we are notified and made aware when our information is taken from outside in the digital world and not directly from us.”

The Office of the Privacy Commissioner has also noted that the proposed amendment is “about keeping up with international best practice”, perhaps referring to NZ legislation being regarded as ‘adequate’ when dealing with EU countries.

The bill appears to have the support of all political parties and is likely to be passed into legislation.

What does this mean in practice?

The proposed changes will mean organisations who collect personal information from other sources than the individual will need to update their privacy policies and ensure any automated systems are amended to include notifying individuals that their data has been collected.

Organisations will need to plan exactly how this information can be made available to individuals, particularly in situations where you do not have a direct relationship with the individual.

What’s next?

The Bill has just received its first reading, and this means that we all have an opportunity to have our say on the proposed amendments by making submissions to the Justice Select Committee sometime in the near future. Submissions are now being accepted with a deadline of 14 June: Click here to read the privacy amendment bill.

Please contact Keith Norris keith@marketing.org.nz if you have any discussion points you would like the MA to put forward.

Source: Marketing Association