Mandatory reporting: Agencies are required to notify the Commissioner and affected individuals about any privacy breach that has caused, or is likely to cause, serious harm to the affected individuals.

Overseas agencies: The Act will apply to all personal information collected and held by overseas organisations doing business in NZ – regardless of whether they have a physical presence in NZ.

Cross-border transfers: New cross-border disclosure principle which regulates the transfer of personal information outside of NZ.

Information collected: Tighter controls on the information that can be collected – agencies cannot require a person’s identifying information unless it is necessary for the lawful purpose for which they are collecting the information.

News media exemption: The news media exemption will be widened to apply to all forms of media (including bloggers) who are under the oversight of the Broadcasting Standards Authority or the New Zealand Media Council.

Children: Extra controls around the collection of personal information from children and young people.

Enforcement: The Commissioner is given a new ability to enforce compliance by issuing compliance notices which can be enforced by the Human Rights Review Tribunal.

New offences: Two new criminal offences are created for:

• misleading an agency to obtain someone else’s personal information; and

• destroying a document that contains personal information knowing it has been requested.

Fines increased: Fines for breaches are increased from up to $2k to up to $10k – however this is a long way off the civil penalties of up to $1m the Commissioner was after.

Public registers: The privacy principles on public registers are to be repealed as they are outdated.