The Privacy Act 2020 (Act) and its Information Privacy Principles (IPPs) govern how agencies collect, use, disclose, store, retain and give access to personal information. The Act gives the Privacy Commissioner the power to issue codes of practice that modify the operation of the Act in relation to specific industries, agencies, activities or types of personal information. The following codes are currently in place:

• Credit Reporting Privacy Code;
• Health Information Privacy Code;
• Justice Sector Unique Identifier Code;
• Superannuation Schemes Unique Identifier Code;
• Telecommunications Information Privacy Code; and
• Civil Defence National Emergencies (Information Sharing) Code.

The Privacy Commissioner is well into the process of introducing a new code to regulate the collection of biometric information which is expected to come into force in 2025. The exposure draft of the Biometrics Processing Privacy Code (Code) was issued in April 2024 followed by an updated draft Code and draft guidance in December 2024. The draft Code sets out rules governing the purpose, sourcing, collection, storage, accessibility, retention, disclosure and limitations on the use of biometric information.

Enforcement is through the Privacy Commissioner who has the power to investigate any action which appears to interfere with the privacy of an individual and can do so either on a complaint made to the Privacy Commissioner or on the Privacy Commissioner’s own initiative. The Privacy Commissioner can also issue compliance notices requiring agencies to do or refrain from doing something in order to comply with the Act.

Under the Act, an agency can be any person or body of persons, whether corporate or unincorporated, and whether in the public sector or in the private sector.

The Act has an extraterritorial scope — it applies to any actions taken by an overseas organisation in the course of carrying on business in New Zealand, regardless of where the information is or was collected or held and where the person to whom the information relates is located. An organisation may still be treated as carrying on business in New Zealand regardless of whether or not it has a physical place of business in New Zealand, charges any monetary payment for goods or services within New Zealand, or makes a profit from its business in New Zealand. For organisations subject to the Act (whether New Zealand agencies or overseas agencies), it is irrelevant where the personal information was collected, where it is held, or where the individual is or was located (i.e. the Act can extend to personal information collected overseas about foreign data subjects).

In September 2024, the Statutes Amendment Bill (SA Bill) was introduced into Parliament and proposes a variety of minor and technical amendments to the Act including clarifications around principal agency's liability, more discretion for the Privacy Commissioner to decide to investigate a complaint and the limited application of the Act to domestic affairs. The SA Bill passed its first reading in October 2024 and the Select Committee is due to report back in April 2025.

In September 2023, the New Zealand government released the Privacy Amendment Bill (PA Bill), which, if passed, will amend the Privacy Act. The PA Bill looks set to proceed following the release of the Select Committee report in late 2024. The main amendments to the Act will be the introduction of a new IPP 3A, requiring organisations that collect personal information 'indirectly' (i.e. not directly from the relevant individual) to provide the individual with information about the processing of their data. Currently, under IPP 3, the Act requires organisations who collect personal information directly from the individual to ensure the individual is aware of certain details, such as the fact of collection, the purposes for which the information will be used, the intended recipients and the individual's right to request access to and correction of their personal information.

IPP 3A will require agencies collecting personal information from a source other than from the individual concerned to take reasonable steps to ensure that the individual is aware of the same information.

The PA Bill includes certain exceptions to complying with IPP 3A including where the individual has previously been made aware of the organisation's collection of their personal information, or compliance with IPP 3A is not reasonably practicable in the circumstances.

The PA Bill is set to come into force on 1 June 2025 and the PA Bill clarifies that IPP 3A will not have retrospective effect.

In September 2023, the Privacy Commissioner issued (non–binding) guidance on the application of the Act's IPPs to the use of AI tools in New Zealand (the Guidance). The Guidance is consistent with key themes from developing international regulations (e.g. the importance of transparency and explainability; accuracy; robustness and security; accountability; and human values and fairness). The Privacy Commissioner has recommended, among other things, that while not mandatory under the Act, it is generally best practice to undertake a Privacy Impact Assessment at the outset of an AI project. The Guidance also recognises an important element which is unique to New Zealand – the need to consider te ao Māori perspectives on privacy (broadly, te ao Māori is the Māori worldview including tikanga Māori - Māori customs and protocols). Specific concerns identified in the Guidance include:

• bias from systems developed overseas that do not work accurately for Māori;
• collection of Māori information without work to build relationships of trust, leading to inaccurate representation of Māori taonga that fail to uphold tapu and tikanga; and
• exclusion from processes and decisions of building and adopting AI tools that affect Māori whānau, hapū, and iwi, including use of these tools by the public sector.