15 Jul 2020, 09:00

The Office of the Privacy Commissioner is seeking public submissions on the proposed repeal and replacement of New Zealand’s six privacy codes of practice under the Privacy Act 2020.

The new Privacy Act 2020 is set to come into force on 1 December. It makes several key reforms to New Zealand’s privacy law, including amendments to the information privacy principles. As a result, the six codes of practice made under the Privacy Act 1993 require replacement:

• Health Information Privacy Code
• Justice Sector Unique Identifier Code
• Credit Reporting Privacy Code
• Superannuation Schemes Unique Identifier Code
• Telecommunications Information Privacy Code
• Civil Defence National Emergencies (Information Sharing) Code.

Summary of changes to codes

The proposed changes are limited to align each code with the new Privacy Act. No substantive new policies are to be implemented.

Cross-border disclosures

Organisations have new legal obligations when disclosing personal information overseas. Organisations that disclose personal information overseas need to make sure the country the information will go to has comparable privacy protections to New Zealand, unless an exemption applies. Most of the codes issued under the new Act will now include a rule relating to this new principle 12.

Changes to collection rules

The collection rules in most of the codes have been updated to reflect changes to principles 1-4 in the Act. These updates include changes to:

• rule 1 - clarify that identifying information should not be collected by organisations if that information is not required for the lawful purpose of collection;
• rule 2 - allow organisations to go to third parties directly, rather than the individual themselves, where that would prevent or lessen a serious threat to the life or health of the individual concerned or any other individual; and
• rule 4 - make explicit that the circumstances of collection, and whether this is fair and not unreasonably intrusive, includes circumstances where personal information is being collected from children and young

Unique identifiers

The information privacy principle relating to unique identifiers has been updated and renumbered principle 13. Codes that include rules for unique identifiers have been amended to include:

• an exception for statistical or research purposes;
• a clarification that agencies do not assign unique identifiers for the purposes of the code when they simply record a unique identifier used by another agency for the sole purpose of communicating with that other agency; and
• new requirements to take any steps that are, in the circumstances, reasonable to ensure that the risk of misuse of a unique identifier by any person is

Minor drafting changes

We modernised the language in the codes to reflect the drafting style in the new Privacy Act. 

Submissions: 

Address submissions to the Office of the Privacy Commissioner at privacy.code@privacy.org.nz. (If you do not have access to email, submissions may be posted to Codes Reissue Submissions, Office of the Privacy Commissioner, PO Box 466, Auckland 1140).

Timeframes for submissions on the codes are as follows:

Health Information Privacy Code and Justice Sector Unique Identifier Code

Open: 15 July 2020 /Close: 12 August 2020

Credit Reporting Privacy Code and Superannuation Schemes Unique Identifier Code

Open: 22 July 2020 / Close: 19 August 2020

Telecommunications Information Privacy Code and Civil Defence National Emergencies (Information Sharing) Code

Open: 29 July 2020 / Close: 26 August 2020

Information papers setting out specific changes made to each code can be obtained by clicking on the links above, once submissions for that code have opened.

More information

Submissions may be published on the website of the Office of the Privacy Commissioner or be released on request. If you would like the Commissioner to keep your submission, or part of your submission, confidential, please indicate the reasons with your submission. The Commissioner will consider your request in accordance with the Official Information Act 1982.

If you would like to present your submissions in person, please let us know when you provide written submissions to the Commissioner.

For enquiries relating to submissions, email linda.williams@privacy.org.nz or call 09 302 8658.