Source document: https://docs-lawep.s3.us-east-2.amazonaws.com/1698841446904.pdf (New Zealand)
Privacy (Cross-border Information) Amendment Bill Government Bill As reported from the Justice and Electoral Committee Commentary Recommendation The Justice and Electoral Committee has examined the Privacy (Cross-border Information) Amendment Bill and recommends that it be passed with the amendments shown.

Introduction The bill amends the Privacy Act 1993.

The Act is silent on the cross- border enforcement of privacy laws.
The bill remedies this by • enabling foreign nationals located overseas to access and cor- rect personal information authorising the Privacy Commissioner to refer a complaint to an overseas privacy enforcement agency, if that complaint is within the jurisdiction of that authority enabling the Privacy Commissioner to prohibit the transfer of personal information outside New Zealand in cases where that information has been routed through New Zealand to avoid the privacy laws of the originating country.
• • 221—2 2 Privacy (Cross-border Information) Amendment Bill Commentary Transfer of personal information outside New Zealand Clause 8 of the bill as introduced inserts new Part 11A into the prin- cipal Act to impose new controls on the transfer of personal informa- tion received from overseas, where the information has been routed through New Zealand to avoid the originating country’s privacy laws.
Prohibition on transfer of personal information outside New Zealand New section 114B would authorise the Privacy Commissioner to pro- hibit the transfer of personal information from New Zealand to an- other State if the Commissioner was satisfied on reasonable grounds of three things: • the information would be received in New Zealand from an- other State and would be likely to be transferred to another State where the privacy protection is not comparable to that established by the Privacy Act the transfer would circumvent the laws of the State where the information originated the transfer would be likely to contravene the basic principles of national application set out in Part 2 of the OECD Guide- lines.
• • We heard concern that the way the basic principles of national ap- plication in the OECD Guidelines have been incorporated in the bill might result in future changes in the Guidelines being incorporated into the statutory framework of the Privacy Act without examination by Parliament.

To address this we recommend inserting new Schedule 5A to set out the basic principles of national application.
This would ensure that changes to the principles of national application in the OECD Guide- lines would not be incorporated into the Privacy Act automatically.

We recommend a consequential amendment to insert new clause 8A to allow the Governor-General to make regulations to amend new Schedule 5A.

This would allow the principles set out in new Sched- ule 5A to be amended to reflect any changes made by the OECD.
We note that amendments to new Schedule 5A would be subject to the Regulations (Disallowance) Act 1989.

To avoid unnecessary duplication, we recommend deleting new sec- tion 114B(1)(b), as the matters intended to be considered by the Com- Commentary Privacy (Cross-border Information) Amendment Bill 3 missioner within this subsection could be considered by the Commis- sioner under new section 114B(1)(a).
Commissioner’s power to obtain information We recommend inserting new section 114BA to make it explicit that when determining whether to prohibit a transfer of personal informa- tion, the Privacy Commissioner could use the investigative powers in Part 9 of the principal Act, in the same way as if the Commissioner were conducting an inquiry under section 13(1)(m) of the Act.

This would ensure that the Commissioner could hear or obtain informa- tion from any person he or she considered necessary.
Privacy (Cross-border Information) Amendment Bill Commentary 4 Appendix Committee process The Privacy (Cross-border Information) Amendment Bill was re- ferred to us on 1 April 2009.

The closing date for submissions was 14 May 2009.

We received and considered two submissions from interested groups and individuals.

We heard one submission.

We received advice from the Ministry of Justice.
Committee membership Chester Borrows (Chairperson) Jacinda Ardern Kanwaljit Singh Bakshi Simon Bridges Dr Kennedy Graham Hon Nathan Guy (from 24 June 2009) Hon David Parker Lynne Pillay Paul Quinn Dr Richard Worth (until 16 June 2009) Privacy (Cross-border Information) Amendment Bill Key to symbols used in reprinted bill As reported from a select committee text inserted unanimously text deleted unanimously Hon Simon Power Privacy (Cross-border Information) Amendment Bill Government Bill Contents Title Commencement Purpose Part 1 Amendments to Privacy Act 1993 Principal Act amended New section 34 substituted 34 Individuals may make information privacy requests Commissioner may authorise public sector agency to charge New section 72C inserted 72C Referral of complaint to overseas privacy enforcement authority New Part 11A inserted Part 11A Transfer of personal information outside New Zealand 114A Interpretation 114B Prohibition on transfer of personal information outside New Zealand 114BA Commissioner’s power to obtain information 114C Transfer prohibition notice 221—2 Page 2 2 2 3 3 3 3 3 3 4 4 5 6 6 1 cl 1 8A 8B Privacy (Cross-border Information) Amendment Bill 114D Commissioner may vary or cancel notice 114E Offence in relation to transfer prohibition notice 114F Appeals against transfer prohibition notice 114G Application of Human Rights Act 1993 New section 128A inserted 128A Power to amend Schedule 5A New Schedule 5A inserted Part 2 Consequential amendment to Adoption (Intercountry) Act 1997
 9 10 Principal Act amended Access to information Schedule New Schedule 5A inserted 7 7 8 9 9 9 9 9 10 10 The Parliament of New Zealand enacts as follows: Title This Act is the Privacy (Cross-border Information) Amend- ment Act 2008.
Commencement This Act comes into force on the day after the date on which 5 it receives the Royal assent.
Purpose The purpose of this Act is to— (a) (b) (c) (d) remove the current restrictions on who may make an information privacy request; and enable public sector agencies to charge for making per- sonal information available to overseas foreign nation- als; and provide for the referral of cross-border complaints to the appropriate privacy enforcement authority; and establish a mechanism for controlling the transfer of in- formation outside of New Zealand where the informa- tion has been routed through New Zealand to circum- 10 15 1 2 3 2 4 5 “34 6 (1) Privacy (Cross-border Information) Amendment Bill Part 1 cl 7 vent the privacy laws of the country from where the in- formation originated.
Part 1 Amendments to Privacy Act 1993 Principal Act amended This Part amends the Privacy Act 1993.
5 New section 34 substituted Section 34 is repealed and the following section substituted: Individuals may make information privacy requests An information privacy request may be made only by an indi- 10 vidual.” Commissioner may authorise public sector agency to charge Section 36 is amended by inserting the following subsection after subsection (1): “(1A) The Commissioner may authorise a public sector agency to impose a charge in respect of the matter referred to in section 35(1)(e) if the information privacy request is received from, or on behalf of, an individual who— “(a) “(b) is residing outside New Zealand; and is not a New Zealand citizen or a permanent resident of New Zealand.” 15 20 (2) (3) Section 36(2) is amended by inserting “or (1A)” after “sub- section (1)”.
Section 36(3) is amended by inserting “or (1A)” after “sub- 25 section (1)”.
7 New section 72C inserted The following section is inserted after section 72B: “72C Referral of complaint to overseas privacy enforcement authority 30 “(1) Where, on receiving a complaint under this Part, the Com- missioner considers that the complaint relates, in whole or in part, to a matter that is more properly within the jurisdiction of 3 Part 1 cl 8 Privacy (Cross-border Information) Amendment Bill an overseas privacy enforcement authority, the Commissioner may consult with that authority in order to determine the ap- propriate means of dealing with the complaint.
“(2) As soon as practicable after consulting with the overseas pri- “(3) “(4) vacy enforcement authority under subsection (1), the Com- 5 missioner must determine whether the complaint should be dealt with, in whole or in part, under this Act.
If the Commissioner determines that the complaint should be dealt with, in whole or in part, by the overseas privacy enforce- ment authority, and both the authority and the complainant 10 agree, the Commissioner may refer the complaint or, as the case requires, the appropriate part of the complaint, to the au- thority to be dealt with.
In this section, overseas privacy enforcement authority or authority means any overseas public body that is responsible 15 for enforcing legislation that protects personal information, and that has the power to conduct investigations and pursue enforcement proceedings.” 8 New Part 11A inserted The following Part is inserted after section 114: “Part 11A “Transfer of personal information outside New Zealand “114A Interpretation In this Part, unless the context otherwise requires,— “OECD Guidelines means the Organisation for Economic Co-operation and Development Guidelines Governing the Protection of Privacy and Transborder Flows of Personal Data “State includes any State, territory, province, or other part of a country “transfer prohibition notice means a notice given under sec- tion 114B prohibiting the transfer of personal information from New Zealand to another State.
20 25 30 4 Privacy (Cross-border Information) Amendment Bill Part 1 cl 8 “114B Prohibition on transfer of personal information outside New Zealand “(1) The Commissioner may prohibit a transfer of personal infor- mation from New Zealand to another State if he or she the Commissioner is satisfied, on reasonable grounds, that— “(a) 5 the information has been, or will be, received in New Zealand from another State and is likely to be trans- ferred to a third State where it will not be subject to a law providing comparable safeguards to this Act; and the transfer of the information may circumvent the pri- 10 vacy or data protection laws of the State from which it has been, or will be, received; and the transfer would be likely to lead to a contravention of the basic principles of national application set out in Part Two of the OECD Guidelines (as defined in sec- 15 tion 114A) and set out in Schedule 5A.
“(b) “(c) “(2) In determining whether or not to prohibit a transfer of personal information, the Commissioner must also consider, in addition to the matters set out in subsection (1) and section 14, the following: “(a) whether or not the transfer affects, or would be likely to 20 “(b) “(c) affect, any individual; and the general desirability of facilitating the free flow of information between New Zealand and other States; and any existing or developing international guidelines rele- 25 vant to transborder data flows, including (but not limited to)— “(i) “(ii) the OECD Guidelines: the European Union Directive 95/46/EC on the Protection of Individuals with Regard to the Pro- 30 cessing of Personal Data and on the Free Move- ment of Such Data.
“(3) Subsection (1) does not apply if the transfer of the informa- tion, or the information itself, is— “(a) “(b) required or authorised by or under any enactment; or required by any convention or other instrument impos- ing international obligations on New Zealand.
35 5 Part 1 cl 8 Privacy (Cross-border Information) Amendment Bill “114BA Commissioner’s power to obtain information “(1) To enable the Commissioner to determine whether to prohibit a transfer of personal information, the Commissioner may hear or obtain information from such persons as the Commissioner considers necessary, and for this purpose Part 9 applies as if 5 the Commissioner were carrying out an inquiry under section 13(1)(m).
In exercising his or her powers under subsection (1), the Commissioner may regulate his or her procedure in such man- ner as the Commissioner thinks fit.

“(2) 10 “114C Transfer prohibition notice “(1) A prohibition under section 114B(1) is to be effected by the service of a transfer prohibition notice on the agency propos- ing to transfer the personal information concerned.
“(2) A transfer prohibition notice must— state the name of the agency to whom it relates; and “(a) “(b) describe the personal information concerned; and “(c) state that the transfer of the personal information con- cerned from New Zealand to a specified State is prohib- ited either— “(i) “(ii) until the agency has taken any the steps stated in the notice to protect the interests of any indi- vidual or individuals affected by the transfer; and absolutely; or “(d) “(e) “(f) state the time when the notice takes effect; and state the ground for the prohibition; and state that the agency on whom the notice is served may lodge an appeal against the notice to the Human Rights Review Tribunal, and the time within which the appeal must be lodged.
“(4) “(3) The time when the notice takes effect under subsection (2)(d) must not be before the end of the period within which an appeal against the notice can be lodged.

If an appeal is brought, the notice does not take effect pending the determination or withdrawal of the appeal.
If the Commissioner, by reason of special circumstances, con- siders that the prohibition should take effect as a matter of ur- gency in relation to all or any part of the notice,— “(5) 15 20 25 30 35 6 Privacy (Cross-border Information) Amendment Bill Part 1 cl 8 “(a) “(b) “(c) subsections (3) and (4) do not apply; and the notice takes effect on the sixth working day after the date on which the notice is served; and the notice must include— “(i) a statement that the Commissioner considers that 5 the prohibition must take effect as a matter of urgency; and a statement of the reasons why the Commissioner has reached that conclusion.
“(ii) “Compare: Data Protection Act 1988 s 11 (Ire) 10 “114D Commissioner may vary or cancel notice “(1) If, at any time, the Commissioner considers that all or any of the provisions of a transfer prohibition notice served on an agency need not be complied with in order to avoid a contra- vention of basic principles of privacy or data protection, the 15 Commissioner may vary or cancel the transfer prohibition no- tice by serving notice to that effect on the agency concerned.
“(2) An agency on whom a transfer prohibition notice has been served may, at any time after the end of the period during which an appeal under section 114F(1)(a) can be lodged, 20 apply in writing to the Commissioner for the notice to be varied or cancelled under subsection (1).

his or her decision; and “(3) The Commissioner must, within 20 working days after the date on which an application under subsection (2) is received, notify the agency of— “(a) “(b) his or her reasons, if the application is refused.
If the Commissioner exercises his or her discretion under sub- section (1), the variation or cancellation of the transfer pro- hibition notice takes effect on the day after the date on which 30 notice of the Commissioner’s decision to vary or cancel the transfer prohibition notice is served.
“Compare: Data Protection Act 1998 s 41 (UK) “(4) 25 “114E Offence in relation to transfer prohibition notice Every person who, without reasonable excuse, fails or refuses 35 to comply with a transfer prohibition notice commits an of- 7 Part 1 cl 8 Privacy (Cross-border Information) Amendment Bill fence and is liable on summary conviction to a fine not ex- ceeding $10,000.
“114F Appeals against transfer prohibition notice “(1) An agency on whom a transfer prohibition notice is served may appeal to the Human Rights Review Tribunal— against the whole or any part of the notice; or “(a) if the notice contains a statement by the Commissioner “(b) in accordance with section 114C(5)(c), against the de- cision to include that statement in respect of all or any part of the notice; or against the decision of the Commissioner to vary the notice in accordance with section 114D(1); or against the refusal of an application under section 114D(2) to vary or cancel the notice.
“(d) “(c) 5 10 “(2) An appeal under subsection (1) must be lodged,— 15 “(a) “(b) in the case of an appeal under subsection (1)(a) or (b), within 15 working days from the date on which the transfer prohibition notice was served on the agency concerned: in the case of an appeal under subsection (1)(c) or (d), 20 within 15 working days from the date on which notice of the decision or refusal was served on the agency con- cerned.
“(3) The Tribunal must allow an appeal or substitute any other de- cision or notice that could have been made or served by the 25 Commissioner if it considers that— “(a) the decision or notice against which the appeal is brought is not in accordance with the law; or to the extent that the decision or notice involved an ex- ercise of discretion by the Commissioner, he or she the 30 Commissioner ought to have exercised his or her dis- cretion differently.
“(b) “(4) The Tribunal may review any determination of fact on which the decision or notice in question was based.
“(5) On any appeal under subsection (1)(b), the Tribunal may— 35 “(a) direct— 8 Privacy (Cross-border Information) Amendment Bill Part 2 cl 9 “(i) “(ii) that the notice in question must have effect as if it did not contain the statement that is mentioned in the notice; or that the inclusion of the statement must not have effect in relation to any part of the notice; and 5 “(b) make any modifications required to give effect to that direction.
“Compare: Data Protection Act 1998 ss 48, 49 (UK) “114G Application of Human Rights Act 1993 Section 87 and Part 4 of the Human Rights Act 1993 apply, 10 with all necessary modifications (if any), in relation to pro- ceedings under section 114F as if they were proceedings under that Act.” 8A New section 128A inserted The following section is inserted after section 128: 15 “128A Power to amend Schedule 5A The Governor-General may, by Order in Council,— “(a) amend Schedule 5A by making such amendments to the text of the basic principles of national application set out in that schedule as are required to bring that text 20 up to date: repeal Schedule 5A, and substitute a new schedule set- ting out, in an up-to-date form, the text of the basic prin- ciples of national application.” “(b) 8B New Schedule 5A inserted The Schedule 5A set out in the Schedule of this Act is inserted after Schedule 5.
Part 2 Related Consequential amendment to Adoption (Intercountry) Act 1997 9 Principal Act amended This Part amends the Adoption (Intercountry) Act 1997.

25 30 9 Part 2 cl 10 Privacy (Cross-border Information) Amendment Bill 10 Access to information Section 13(3) is repealed.
Schedule New Schedule 5A inserted Schedule 5A Basic principles of national application set out in Part Two of the OECD Guidelines s 8B s 114B(1)(c) Collection limitation principle There should be limits to the collection of personal data and any such data should be obtained by lawful and fair means and, where appro- priate, with the knowledge or consent of the data subject.
Data quality principle Personal data should be relevant to the purposes for which they are to be used, and, to the extent necessary for those purposes, should be accurate, complete and kept up-to-date.
5 10 Purpose specification principle The purposes for which personal data are collected should be speci- fied not later than at the time of data collection and the subsequent use limited to the fulfilment of those purposes or such others as are not incompatible with those purposes and as are specified on each occasion of change of purpose.
15 20 Use limitation principle Personal data should not be disclosed, made available or otherwise used for purposes other than those specified in accordance with [the Purpose specification principle above] except: with the consent of the data subject; or (a) by the authority of law.
(b) 25 10 Privacy (Cross-border Information) Amendment Bill Schedule Schedule 5A—continued Security safeguards principle Personal data should be protected by reasonable security safeguards against such risks as loss or unauthorised access, destruction, use, modification or disclosure of data.

Openness principle There should be a general policy of openness about developments, practices and policies with respect to personal data.
Means should be readily available of establishing the existence and nature of personal data, and the main purposes of their use, as well as the identity and usual residence of the data controller.
5 10 Individual participation principle An individual should have the right: (a) (b) (c) (d) 15 within a reasonable time; at a charge, if any, that is not excessive; in a reasonable manner; and in a form that is readily intelligible to him; to obtain from a data controller, or otherwise, confirmation of whether or not the data controller has data relating to him; to have communicated to him, data relating to him • • • • to be given reasons if a request made under subparagraphs (a) 20 and (b) is denied, and to be able to challenge such denial; and to challenge data relating to him and, if the challenge is successful to have the data erased, rectified, completed or amended.
Accountability principle A data controller should be accountable for complying with measures which give effect to the principles stated above.

25 11 Privacy (Cross-border Information) Amendment Bill Legislative history Introduction (Bill 221–1) First reading and referral to Justice and Electoral Committee 2 July 2008 1 April 2009 12 Published under the authority of the House of Representatives—2009 Wellington, New Zealand: 12