Our lawyers keep up with the latest trends and issues in New Zealand law and business, and regularly publish articles and reports on current topics.

Email me when new articles are published

Privacy Bill Update: Select Committee Report is out

Written by David Alizade, PARTNER on March 15th, 2019.    

JR Banner - privacy-658-431

Select Committee Report is out

March 2019

On 13 March 2019 the Justice Select Committee released its report on the proposed Privacy Bill which will repeal and replace the Privacy Act 1993.  The Privacy Commissioner previously lobbied for a number of changes to the Bill but unfortunately the Committee did not give him everything on his wish list.  Below is a summary of the key changes the Select Committee has proposed to the Bill and the changes that did not make the cut.


The key changes proposed by the Committee are:
  • Mandatory reporting: Agencies are required to notify the Commissioner and affected individuals about any privacy breach that has caused, or is likely to cause, serious harm to the affected individuals.

  • Overseas agencies: The Act will apply to all personal information collected and held by overseas organisations doing business in NZ – regardless of whether they have a physical presence in NZ.

  • Cross-border transfers: New cross-border disclosure principle which regulates the transfer of personal information outside of NZ.

  • Information collected: Tighter controls on the information that can be collected – agencies cannot require a person’s identifying information unless it is necessary for the lawful purpose for which they are collecting the information.

  • News media exemption: The news media exemption will be widened to apply to all forms of media (including bloggers) who are under the oversight of the Broadcasting Standards Authority or the New Zealand Media Council.

  • Children: Extra controls around the collection of personal information from children and young people.

  • Enforcement: The Commissioner is given a new ability to enforce compliance by issuing compliance notices which can be enforced by the Human Rights Review Tribunal.

  • New offences: Two new criminal offences are created for:

    • misleading an agency to obtain someone else’s personal information; and

    • destroying a document that contains personal information knowing it has been requested.

  • Fines increased: Fines for breaches are increased from up to $2k to up to $10k – however this is a long way off the civil penalties of up to $1m the Commissioner was after.

  • Public registers: The privacy principles on public registers are to be repealed as they are outdated.


The Committee did not include the following key changes recommended by the Commissioner:

  • Data portability principle (the right to uplift your personal information when you change providers).

  • Right to erasure (also known as the right to be forgotten).

  • Civil penalties for privacy breaches or non-compliance.  The Commissioner had sought fines of up to $100k for individuals and up to $1m for non-individuals.


The Bill is expected to come into force on 1 March 2020.


For further information or to discuss how privacy laws may impact on your business, please call or email one of the Jackson Russell business lawyers listed.  We will be providing further guidance to our clients when the Bill is passed.

Click here to view the Justice Select Committee’s report.


Disclaimer: The information contained in this publication is of a general nature and is not intended as legal advice.  It is important that you seek legal advice that is specific to your circumstances.

All rights reserved © Jackson Russell 2019


David Alizade Publications2
David Alizade,
Topics: All, Business , Privacy

Level 13, 41 Shortland Street, Auckland 1010, New Zealand

PO Box 3451, Auckland 1140, New Zealand

+64 9 303 3849

Linkedin Circle-26