The New Zealand Privacy Act 2020, which came into effect on December 1, 2020, is legislation designed to protect the privacy of individuals and regulate the handling of personal information. This law replaced the Privacy Act 1993, introducing several new provisions and enhancing individuals' control over their personal information. Keep reading to unravel the intricacies of this pivotal piece of legislation and align your business practices with the evolving norms of data privacy.
In this blog, we’ll cover
In accordance with the official pronouncements from the Ministry of Justice of New Zealand, the Privacy Act of 2020 serves two principal objectives:
- Providing a framework for protecting an individual’s right to privacy of personal information, including the right of an individual to access their personal information, while recognising that other rights and interests may at times also need to be taken into account; and
- Giving effect to internationally recognised privacy obligations and standards in relation to the privacy of personal information, including the OECD Guidelines and the International Covenant on Civil and Political Rights.
As you navigate the intricacies of the New Zealand Privacy Act 2020, it's imperative to be particularly mindful of its specific application regarding industries and geographical locations.
According to New Zealand Legislation, the Privacy Act applies to any person, organisation, or business (referred to in the legislation as an "agency"), whether it’s in the public sector or private sector, that collects and holds personal information about other people. This includes government departments and agencies, companies, social clubs, charities, societies, community groups and other types of organisations.
The Act requires you only collect personal information that’s necessary for a lawful purpose. Before you collect personal information, think about what information you need to achieve your purpose. You may find you don’t need to collect as much as you originally thought, or you may not need to collect any at all.
Generally, you should collect information directly from the person it’s about. By doing this, the person will know what information you've got and what you're doing with it.
If you're collecting personal information from someone, you need to let them know what you're doing. The best way to do this is usually with a clear privacy statement.
Being open with people about what you’re doing with their information means you won't take them by surprise, and they're less likely to object. Think about how and when it would be best to tell them. New Zealand Privacy Commissioner provides a handy tool to help you compose your privacy statement.
Make sure you collect personal information in a way that is lawful, fair, and not unreasonably intrusive
Make sure that you take reasonable steps to store and use personal information securely. Security includes taking steps to prevent unauthorised or inappropriate access by staff. Have clear policies and guidelines in place that set out acceptable staff behaviour. Depending on the sensitivity of the information, it may be necessary to set up systems that limit or keep track of who accesses it.
People have a right to access the personal information you hold about them. If someone asks for access to their personal information, you must respond within 20 working days of receiving the request. Your response should include a decision about whether you will be providing the requested information.
People can ask you to correct their personal information if they think it’s wrong. If you don’t think you need to correct the information, you must still record that the person asked you to correct the information, and note exactly what they thought was wrong. Attach that record to the person's file so that everything is together. Knowing what the person thinks will help anyone else who looks at the record to make better decisions.
A business or organisation may only disclose personal information to another organisation outside New Zealand if the receiving organisation:
misleads an agency by impersonating an individual, or falsely pretending to be an individual or to be acting under the authority of an individual, for the purpose of:
Identify all the personal information your organisation collects, processes, and stores. Evaluate the privacy risks associated with handling such information. Develop strategies to mitigate identified risks, ensuring the lawful and secure processing of personal information.
Draft clear, concise, and comprehensive privacy policies outlining how personal information will be handled. Implement procedures ensuring compliance with the policies and the Act. Communicate policies and procedures to all employees and relevant stakeholders.
Educate employees on the provisions of the Act and the importance of data privacy. Train them on adhering to internal privacy policies and procedures. Regularly update training programs to address evolving privacy risks and legal requirements.
Implement robust security measures, including encryption and firewalls, to protect personal information from unauthorised access, disclosure, alteration, and destruction. Conduct regular security audits and vulnerability assessments to identify and address potential security risks. Develop a comprehensive data breach response plan to efficiently address any security incidents.
Regularly review policies, procedures, and practices to ensure ongoing compliance with the Act. Address any identified areas of non-compliance immediately, implementing corrective actions to mitigate risks. Keep abreast of any amendments to the Act and adjust policies and practices accordingly to maintain compliance.
Using a short gap analysis questionnaire, we will identify each user's weakest areas of security, and gather results into their unique risk profile. This allows you to identify your staff’s individual security vulnerabilities, thus automating the remedy and addressing any security gaps in handling personal information.
Being 100% cloud-based with installation-free and simple configuration, uLearn facilitates easy deployment, allowing organisations to quickly implement robust cybersecurity training aligned with the Act with no upfront cost for hardware or infrastructure.
Don't hesitate to integrate security awareness training into your business practices! The investment in security awareness training is tremendously beneficial to bolster your employees' awareness of the Privacy Act.
If you fancy discovering more about the Privacy Act, we highly recommend you to try out our premium service for 14 days absolutely free or watch the preview video below. Alternatively, you can take a look at our blog to learn how usecure could help you navigate regulations and standards around the world.