Source document: https://docs-lawep.s3.us-east-2.amazonaws.com/1698841535902.pdf (New Zealand)
Privacy (Cross­border Information) Amendment Bill Government Bill Explanatory note General policy statement This Bill amends the Privacy Act 1993.

The amendments dealing with cross­border data transfers will substantially reduce the likeli­ hood of New Zealand being used as an intermediary for the avoid­ ance of other States’ privacy laws.

For example, the amendments will ensure that personal data originating overseas and sent to New Zealand is subject to our privacy protection.
The Bill’s transfer pro­ hibition notice mechanism will ensure foreign personal data cannot be sent, via New Zealand, to jurisdictions without adequate privacy protection.

These amendments will enable New Zealanders and New Zealand companies to assure their trade partners that New Zealand law will ensure their privacy is protected.

The Bill also contains complementary amendments facilitating the cross­border enforcement of privacy laws.
This will better protect New Zealanders engaged in international transactions.

The amend­ ments recognise that concurrent or consecutive investigations in two jurisdictions are possible.

The amendments will implement aspects of the OECD framework for co­operation between privacy enforce­ ment authorities.

221—1 2 Privacy (Cross­border Information) Amendment Bill Explanatory note Clause by clause analysis Clause 1 is the Title clause.
Clause 2 provides that the Bill comes into force on the day after the date on which it receives the Royal assent.

Clause 3 sets out the purpose of the Bill.

Part 1 Amendments to Privacy Act 1993 Clause 4 provides that Part 1 amends the Privacy Act 1993.

Clause 5 repeals section 34 and substitutes a new section 34.
The new section removes the existing requirement that, in order to make an information privacy request, an individual must be a New Zealand citizen, permanent resident, or in New Zealand at the time the request is made.
Clause 6 amends section 36 to enable the Privacy Commissioner to authorise a public sector agency to impose a reasonable charge for making personal information available to an individual residing out­ side New Zealand who is neither a New Zealand citizen nor a per­ manent resident of New Zealand.
Clause 7 inserts new section 72C, which provides for the referral of a complaint to an overseas privacy enforcement authority where the complaint is within the jurisdiction of that authority and both the authority and complainant agree to the referral being made.

Clause 8 inserts new Part 11A into the principal Act, which relates to the transfer of personal information outside New Zealand.

New section 114A deﬁnes certain terms used in the new Part.
New section 114B provides that the Privacy Commissioner may pro­ hibit a transfer of personal information from New Zealand to another State if he or she is satisﬁed that— • the personal information will be transferred to a jurisdiction where it will not be subject to a law providing comparable safeguards to the principal Act; and the proposed transfer may circumvent the laws of the State from where the information originated; and the transfer would be likely to breach the basic principles of national application set out in Part Two of the Organisation for Economic Co­operation and Development Guidelines Gov­ • • Explanatory note Privacy (Cross­border Information) Amendment Bill 3 erning the Protection of Privacy and Transborder Flows of Per­ sonal Data (OECD Guidelines).
In exercising his or her discretion in accordance with this new sec­ tion, the Commissioner must consider the following: • whether or not the proposed transfer of personal information affects, or would be likely to affect, any individual; and the desirability of facilitating the free ﬂow of information be­ tween New Zealand and other States; and any existing or developing international guidelines relevant to transborder data ﬂows (including the OECD Guidelines and the European Union Directive 95/46/EC on the Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data).
• • New section 114C authorises the Commissioner to prohibit a transfer of personal information by serving a transfer prohibition notice on the agency proposing to transfer that personal information.
New section 114D provides that the Commissioner may vary or can­ cel all or any part of a transfer prohibition notice, on the Commis­ sioner’s own initiative or on an application by the agency on whom the notice is served, if he or she considers that the notice need not be complied with in order to avoid a contravention of basic principles of privacy and data protection.
New section 114E creates an offence in relation to a failure or refusal to comply with a transfer prohibition notice served by the Commis­ sioner.
New section 114F provides that an agency on whom a transfer pro­ hibition notice is served may appeal to the Human Rights Review Tribunal against— • • the whole or any part of the notice; or a decision of the Commissioner that the transfer prohibition notice should come into effect urgently; or a decision of the Commissioner to vary a transfer prohibition notice; or a refusal by the Commissioner to vary or cancel a transfer pro­ hibition notice.
• • 4 Privacy (Cross­border Information) Amendment Bill Explanatory note New section 114G provides that Part 4 of the Human Rights Act 1993 applies to appeal proceedings in the Human Rights Review Tribunal under new section 114F.

Part 2 Related amendment to Adoption (Intercountry) Act 1997 Clause 9 provides that Part 2 amends the Adoption (Intercountry) Act 1997.

Clause 10 repeals section 13(3) as a result of the amendment in clause 5.
Section 13(3) provides that, despite section 34 of the Privacy Act 1993, a person who is adopted in accordance with the Convention on Protection of Children and Co­operation in Respect of Intercoun­ try Adoption (1993) may make a request for personal information even though they may not be a New Zealand citizen, permanent resi­ dent, or an individual who is in New Zealand.
This provision is no longer necessary because new section 34 removes these procedural requirements and provides that any individual may make an informa­ tion privacy request.
Hon Lianne Dalziel Privacy (Cross­border Information) Amendment Bill Government Bill Contents Title Commencement Purpose Part 1 Amendments to Privacy Act 1993 Principal Act amended New section 34 substituted 34 Individuals may make information privacy requests Commissioner may authorise public sector agency to charge New section 72C inserted 72C Referral of complaint to overseas privacy enforcement authority New Part 11A inserted Part 11A Transfer of personal information outside New Zealand 114A Interpretation 114B Prohibition on transfer of personal information outside New Zealand 114C Transfer prohibition notice 114D Commissioner may vary or cancel notice 221—1 Page 2 2 2 3 3 3 3 3 3 4 4 4 5 6 1 cl 1 Privacy (Cross­border Information) Amendment Bill 114E Offence in relation to transfer prohibition notice 114F Appeals against transfer prohibition notice 114G Application of Human Rights Act 1993 Part 2 Related amendment to Adoption (Intercountry) Act 1997 9 10 Principal Act amended Access to information 7 7 8 9 9 The Parliament of New Zealand enacts as follows: Title This Act is the Privacy (Cross­border Information) Amend­ ment Act 2008.
Commencement This Act comes into force on the day after the date on which it receives the Royal assent.
5 Purpose The purpose of this Act is to— (a) (b) (c) (d) remove the current restrictions on who may make an 10 information privacy request; and enable public sector agencies to charge for making per­ sonal information available to overseas foreign nation­ als; and provide for the referral of cross­border complaints to the 15 appropriate privacy enforcement authority; and establish a mechanism for controlling the transfer of in­ formation outside of New Zealand where the informa­ tion has been routed through New Zealand to circum­ vent the privacy laws of the country from where the in­ 20 formation originated.
1 2 3 2 Privacy (Cross­border Information) Amendment Bill Part 1 cl 7 Part 1 Amendments to Privacy Act 1993 Principal Act amended This Part amends the Privacy Act 1993.
New section 34 substituted Section 34 is repealed and the following section substituted: Individuals may make information privacy requests An information privacy request may be made only by an indi­ vidual.” Commissioner may authorise public sector agency to charge Section 36 is amended by inserting the following subsection after subsection (1): 5 10 4 5 “34 6 (1) “(1A) The Commissioner may authorise a public sector agency to impose a charge in respect of the matter referred to in section 15 35(1)(e) if the information privacy request is received from, or on behalf of, an individual who— “(a) “(b) is residing outside New Zealand; and is not a New Zealand citizen or a permanent resident of New Zealand.” (2) (3) Section 36(2) is amended by inserting “or (1A)” after “subsec­ tion (1)”.
Section 36(3) is amended by inserting “or (1A)” after “subsec­ tion (1)”.
7 New section 72C inserted The following section is inserted after section 72B: “72C Referral of complaint to overseas privacy enforcement authority “(1) Where, on receiving a complaint under this Part, the Com­ missioner considers that the complaint relates, in whole or in 30 part, to a matter that is more properly within the jurisdiction of an overseas privacy enforcement authority, the Commissioner may consult with that authority in order to determine the ap­ propriate means of dealing with the complaint.
3 20 25 Part 1 cl 8 Privacy (Cross­border Information) Amendment Bill “(3) “(2) As soon as practicable after consulting with the overseas pri­ vacy enforcement authority under subsection (1), the Com­ missioner must determine whether the complaint should be dealt with, in whole or in part, under this Act.
If the Commissioner determines that the complaint should be 5 dealt with, in whole or in part, by the overseas privacy enforce­ ment authority, and both the authority and the complainant agree, the Commissioner may refer the complaint or, as the case requires, the appropriate part of the complaint, to the au­ thority to be dealt with.
In this section, overseas privacy enforcement authority or authority means any overseas public body that is responsi­ ble for enforcing legislation that protects personal information, and that has the power to conduct investigations and pursue enforcement proceedings.” “(4) 10 15 8 New Part 11A inserted The following Part is inserted after section 114: “Part 11A “Transfer of personal information outside New Zealand 20 “114A Interpretation In this Part, unless the context otherwise requires,— “OECD Guidelines means the Organisation for Economic Co­operation and Development Guidelines Governing the Protection of Privacy and Transborder Flows of Personal Data 25 “State includes any State, territory, province, or other part of a country “transfer prohibition notice means a notice given under sec­ tion 114B prohibiting the transfer of personal information from New Zealand to another State.
30 “114B Prohibition on transfer of personal information outside New Zealand “(1) The Commissioner may prohibit a transfer of personal infor­ mation from New Zealand to another State if he or she is sat­ isﬁed, on reasonable grounds, that— 35 4 Privacy (Cross­border Information) Amendment Bill Part 1 cl 8 “(a) “(b) “(c) the information has been, or will be, received in New Zealand from another State and is likely to be trans­ ferred to a third State where it will not be subject to a law providing comparable safeguards to this Act; and the transfer of the information may circumvent the pri­ 5 vacy or data protection laws of the State from which it has been, or will be, received; and the transfer would be likely to lead to a contravention of the basic principles of national application set out in Part Two of the OECD Guidelines (as deﬁned in sec­ 10 tion 114A).
“(2) In determining whether or not to prohibit a transfer of personal information, the Commissioner must also consider, in addition to the matters set out in subsection (1) and section 14, the following: “(a) whether or not the transfer affects, or would be likely to 15 “(b) “(c) affect, any individual; and the general desirability of facilitating the free ﬂow of information between New Zealand and other States; and any existing or developing international guidelines rele­ 20 vant to transborder data ﬂows, including (but not limited to)— “(i) “(ii) the OECD Guidelines: the European Union Directive 95/46/EC on the Protection of Individuals with Regard to the Pro­ 25 cessing of Personal Data and on the Free Move­ ment of Such Data.
“(3) Subsection (1) does not apply if the transfer of the informa­ tion, or the information itself, is— “(a) “(b) required or authorised by or under any enactment; or required by any convention or other instrument impos­ ing international obligations on New Zealand.

30 “114C Transfer prohibition notice “(1) A prohibition under section 114B(1) is to be effected by the service of a transfer prohibition notice on the agency propos­ 35 ing to transfer the personal information concerned.
“(2) A transfer prohibition notice must— “(a) state the name of the agency to whom it relates; and 5 Part 1 cl 8 Privacy (Cross­border Information) Amendment Bill “(b) describe the personal information concerned; and “(c) absolutely; or state that the transfer of the personal information con­ cerned from New Zealand to a speciﬁed State is prohib­ ited either— “(i) “(ii) until the agency has taken any steps stated in the notice to protect the interests of any individual or individuals affected by the transfer; and state the time when the notice takes effect; and state the ground for the prohibition; and state that the agency on whom the notice is served may lodge an appeal against the notice to the Human Rights Review Tribunal, and the time within which the appeal must be lodged.
“(d) “(e) “(f) 5 10 “(5) “(4) “(3) The time when the notice takes effect under subsection 15 (2)(d) must not be before the end of the period within which an appeal against the notice can be lodged.

If an appeal is brought, the notice does not take effect pending the determination or withdrawal of the appeal.
If the Commissioner, by reason of special circumstances, con­ 20 siders that the prohibition should take effect as a matter of ur­ gency in relation to all or any part of the notice,— subsections (3) and (4) do not apply; and “(a) the notice takes effect on the sixth working day after the “(b) date on which the notice is served; and the notice must include— “(i) “(c) 25 a statement that the Commissioner considers that the prohibition must take effect as a matter of urgency; and a statement of the reasons why the Commissioner 30 has reached that conclusion.
“(ii) “Compare: Data Protection Act 1988 s 11 (Ire) “114D Commissioner may vary or cancel notice “(1) If, at any time, the Commissioner considers that all or any of the provisions of a transfer prohibition notice served on an 35 agency need not be complied with in order to avoid a contra­ vention of basic principles of privacy or data protection, the 6 Privacy (Cross­border Information) Amendment Bill Part 1 cl 8 Commissioner may vary or cancel the transfer prohibition no­ tice by serving notice to that effect on the agency concerned.
“(2) An agency on whom a transfer prohibition notice has been served may, at any time after the end of the period during which an appeal under section 114F(1)(a) can be lodged, ap­ 5 ply in writing to the Commissioner for the notice to be varied or cancelled under subsection (1).
his or her decision; and “(3) The Commissioner must, within 20 working days after the date on which an application under subsection (2) is received, notify the agency of— “(a) “(b) his or her reasons, if the application is refused.
If the Commissioner exercises his or her discretion under sub­ section (1), the variation or cancellation of the transfer pro­ hibition notice takes effect on the day after the date on which 15 notice of the Commissioner’s decision to vary or cancel the transfer prohibition notice is served.
“Compare: Data Protection Act 1998 s 41 (UK) “(4) 10 “114E Offence in relation to transfer prohibition notice Every person who, without reasonable excuse, fails or refuses 20 to comply with a transfer prohibition notice commits an of­ fence and is liable on summary conviction to a ﬁne not ex­ ceeding $10,000.
“114F Appeals against transfer prohibition notice “(1) An agency on whom a transfer prohibition notice is served 25 may appeal to the Human Rights Review Tribunal— against the whole or any part of the notice; or “(a) if the notice contains a statement by the Commissioner “(b) in accordance with section 114C(5)(c), against the de­ cision to include that statement in respect of all or any 30 part of the notice; or against the decision of the Commissioner to vary the notice in accordance with section 114D(1); or against the refusal of an application under section 114D(2) to vary or cancel the notice.
“(d) “(c) 35 “(2) An appeal under subsection (1) must be lodged,— 7 Part 1 cl 8 Privacy (Cross­border Information) Amendment Bill “(a) “(b) in the case of an appeal under subsection (1)(a) or (b), within 15 working days from the date on which the transfer prohibition notice was served on the agency concerned: in the case of an appeal under subsection (1)(c) or (d), 5 within 15 working days from the date on which notice of the decision or refusal was served on the agency con­ cerned.
“(3) The Tribunal must allow an appeal or substitute any other de­ cision or notice that could have been made or served by the 10 Commissioner if it considers that— “(a) the decision or notice against which the appeal is brought is not in accordance with the law; or to the extent that the decision or notice involved an exer­ cise of discretion by the Commissioner, he or she ought 15 to have exercised his or her discretion differently.
“(b) “(4) The Tribunal may review any determination of fact on which the decision or notice in question was based.

“(5) On any appeal under subsection (1)(b), the Tribunal may— “(a) direct— “(i) that the notice in question must have effect as if it did not contain the statement that is mentioned in the notice; or that the inclusion of the statement must not have effect in relation to any part of the notice; and “(ii) 20 25 “(b) make any modiﬁcations required to give effect to that direction.
“Compare: Data Protection Act 1998 ss 48, 49 (UK) “114G Application of Human Rights Act 1993 Section 87 and Part 4 of the Human Rights Act 1993 apply, 30 with all necessary modiﬁcations (if any), in relation to pro­ ceedings under section 114F as if they were proceedings under that Act.” 8 Privacy (Cross­border Information) Amendment Bill Part 2 cl 10 Part 2 Related amendment to Adoption (Intercountry) Act 1997 Principal Act amended This Part amends the Adoption (Intercountry) Act 1997.
5 Access to information Section 13(3) is repealed.

9 10 12 Wellington, New Zealand: Published under the authority of the New Zealand Government—2008 9