Privacy Bill

  • not the latest version

Hon Andrew Little

Privacy Bill

Government Bill

34—2

Contents

Commentary
Key
1Title
2Commencement
Part 1
Preliminary provisions
Subpart 1—Preliminary matters
3Purpose of this Act
3AApplication of this Act
4Transitional, savings, and related provisions
5Act binds the Crown
Subpart 2—Interpretation and related matters
6Interpretation
7Personal information held by agency if held by officer, employee, or member of agency
8Personal information treated as being held by another agency in certain circumstances
9Actions of, and disclosure of information to, staff of agency, etc
Part 2
Privacy Commissioner
Subpart 1—Appointment of Privacy Commissioner
10Privacy Commissioner
11Deputy Privacy Commissioner
12Holding of other offices
13Superannuation or retiring allowances
Subpart 2—Functions of Privacy Commissioner
14Functions of Commissioner
15Commissioner to monitor operation of Act
16Responsible Minister must present to House of Representatives copy of report under section 15 on operation of Act to House of Representatives
17Duty to act independently
18Commissioner to have regard to certain matters
Part 3
Information privacy principles, public register privacy principles and codes of practice
Subpart 1—Information privacy principles
19Information privacy principles
20Application of IPPs to personal information held overseas
20Application of IPPs subject to overseas laws
21Application of IPPs to public registers
22Relationships between IPPs and other law
23Exemptions relating to IPPs 1 to 4 and 12 13
24Exemption for personal information relating to personal or domestic affairs
25Exemption for intelligence and security agencies
26Certain personal information exempt from IPPs 6 and 7
27Commissioner may authorise collection, use, storage, or disclosure of personal information otherwise in breach of IPP 2, 9, 10, or 11 2 or IPPs 9 to 12
28Enforceability of IPPs
Subpart 2—Public register privacy principles
29Interpretation
30Public register privacy principles
31Compliance with PRPPs
32Relationship between PRPPs and other laws
33Enforceability of PRPPs
34Power to amend Schedule 2 by Order in Council
Subpart 3—Codes of practice
35Codes of practice in relation to IPPs
36Codes of practice in relation to public registers
37Relationship between codes and other law
38Issue of code of practice
39Urgent issue of code of practice
40Notification, availability, and commencement of codes of practice
41Application of Legislation Act 2012 to codes of practice
42Amendment and revocation of codes of practice
43Effect of codes of practice
Part 4
Access to and correction of personal information
Subpart 1—Access to personal information
44Interpretation
45Individuals may make access IPP 6 request
46Urgency
47Assistance
48Transfer of access IPP 6 request
49Decision on access request under IPP 6(1)(a)
50Decision on access request under IPP 6(1)(b)
50Responding to IPP 6 request
50ADecision to grant access to personal information
50BDecision to refuse access to personal information
50CDecision to neither confirm nor deny personal information is held
51Extension of time limits
52Protection, etc, of individual as reason for refusing request under IPP 6(1)(b) access to personal information
53Evaluative material as reason for refusing request under IPP 6(1)(b) access to personal information
54Security, defence, international relations as reason for refusing request under IPP 6(1)(b) access to personal information
55Trade secret as reason for refusing request under IPP 6(1)(b) access to personal information
56Administrative reasons for refusing request under IPP 6(1)(b)
57Other reasons for refusing request under IPP 6(1)(b) access to personal information
58Agency may impose conditions instead of refusing access to information under section 57 to personal information
59Requestor to be informed of certain matters if response given under section 49(2)(c) or 50(2)(c)
60Requestor to be informed of certain matters if request under IPP 6(1)(b) refused
61Withholding personal information requested under IPP 6(1)(b) contained in document
62Ways personal information in document may be made available
63Responsibilities of agency before giving access to personal information
Subpart 2—Correction of personal information
64Interpretation
65Individuals may make correction requests
66Urgency
67Assistance
68Transfer of correction request
69Decision on request under IPP 7(1)(a)
69Decision on request to correct personal information
70Decision on request under IPP 7(2)(b)
70Decision on request to attach statement of correction
71Extension of time limits
Subpart 3—Charges
72Charges
72Charges
73Commissioner may authorise public sector agency to impose charge
Part 5
Complaints, investigations, and proceedings
74Interpretation
75Interference with privacy of individual
Subpart 1—Complaints
76Types of cComplaints
77Who may make complaint
78Form of complaint
79Procedure on receipt of complaint
80Commissioner may decide not to investigate complaint
81Commissioner may decide to defer taking action on complaint
82Referral of complaint to another person
83Referral of complaint to overseas privacy enforcement authority
84Exploring possibility of settlement and assurance before investigating complaint
84AReferral of complaint to Director without conducting investigation
Subpart 2—Investigations by Commissioner
85Application of this subpart
86Commencing investigation
87Exploring possibility of settlement and assurance during investigation
88Conducting investigation
89Commissioner may regulate own procedure
89AExploring possibility of settlement and assurance during investigation
89BReferral of complaint to Director without completing investigation
90Compulsory conferences of parties to complaint
91Power to summon persons
92Power to require information and documents
93Disclosure of information may be required despite obligation of secrecy
94Protection and privileges of persons required to provide information, etc
95Disclosed information privileged
96Procedure after completion of investigation relating to breach of IPP 6 access to personal information
96AAccess direction
97Procedure after completion of investigation relating to charging
98Procedure after completion of investigation relating to public register
99Procedure after completion of other investigations
100Special procedure relating to intelligence and security agency
101Commissioner to report breach of duty or misconduct
Subpart 3—Proceedings before Human Rights Review Tribunal
Proceedings in relation to complaints or investigations
102Director may commence proceedings in Tribunal
103Aggrieved individual may commence proceedings in Tribunal
104Right of Director to appear in proceedings commenced under section 103
105Apology not admissible except for assessment of remedies
106Onus of proof
107Remedies in respect of interference with privacy
108Damages
Access orders
109Enforcement of access direction made by Commissioner under section 96(5)(a) after investigation of IPP 6 breach
Appeals against access direction made after investigation of IPP 6 breach
110Appeal to Tribunal against access direction of Commissioner under section 96(5)(a)
111Time for lodging appeal
112Interim order suspending Commissioner’s direction pending appeal
113Appeal may be determined on papers
114Determination of appeal
Miscellaneous
114AProceedings involving access to personal information
115Costs
116Certain provisions of Human Rights Act 1993 to apply
Part 6
Notifiable privacy breaches and compliance notices
Subpart 1—Notifiable privacy breaches
117Interpretation
117AAssessment of likelihood of serious harm being caused by privacy breach
118Agency to notify Commissioner of notifiable privacy breach
119Agency to notify affected individual or give public notice of notifiable privacy breach
120Exceptions to obligations to notify affected individual or give public notice of notifiable privacy breachExceptions to or delay in complying with requirement to notify affected individuals or give public notice of notifiable privacy breach
121Requirements for notification
122Offence to fail to notify Commissioner
122ALiability of principals
123Publication of identity of agencies in certain circumstances
Subpart 2—Compliance notices
124Compliance notices
125Issuing compliance notice
126Form and service of compliance notice
127Agency response to compliance notice
128Commissioner may vary or cancel compliance notice
129Commissioner’s power to obtain information
129APublication of details of compliance notice
Proceedings
130Enforcement of compliance notice
131Appeal against compliance notice or Commissioner’s decision under section 128 to vary or cancel notice
132Interim order suspending compliance notice pending appeal
133Remedies, costs, and enforcement
134Application of Human Rights Act 1993
135Commissioner may be represented in proceedings
Part 7
Sharing, accessing, and matching personal information
Subpart 1—Information sharing
136Purpose of this subpart
137Relationship between subpart 1 and other law relating to information disclosure
138Interpretation
139Information sharing between agencies
140Information sharing within agencies
141Parties to information sharing agreement
142Agreement may apply to classes of agencies
143Lead agency
144Form and content of information sharing agreement
145Governor-General may approve information sharing agreement by Order in Council
146Requirements for Order in Council
147Further provisions about Order in Council
148Status of Order in Council
149Matters to which relevant Minister must have regard before recommending Order in Council
150Consultation on proposed information sharing agreement
151Commissioner may prepare and publish report on approved information sharing agreement
152Requirement to give notice of adverse action
153When requirement to give notice of adverse action applies
154Responsibilities of lead agency
155Report of lead agency
156Commissioner may specify frequency of reporting by lead agency
157Amendment of approved information sharing agreement
158Review of operation of approved information sharing agreement
159Report on findings of review
160Relevant Minister must present to House of Representatives copy of report under section 159(1) and report setting out Government’s response to House of Representatives
161Power to amend Schedule 3 by Order in Council
Subpart 2—Identity information
162Purpose of this subpart
163Relationship between this subpart and other law relating to information disclosure
164Interpretation
165Access by agencies to identity information
166Manner and form of access
167Annual reporting requirement
168Power to amend Schedule 4 by Order in Council
Subpart 3—Law enforcement information
169Purpose of this subpart
170Relationship between this subpart and other law relating to information disclosure
171Interpretation
172Access by accessing agencies to law enforcement information
173Power to amend Schedule 5 by Order in Council
Subpart 4—Authorised information matching programmes
174Purpose of this subpart
175Application of this subpart
176Relationship between this subpart and other law relating to information disclosure
177Interpretation
178Information matching agreements
179Use of results of authorised information matching programme
180Extension of time limit
181Notice of adverse action proposed
182Reporting requirements
183Reports on authorised information matching programmes
184Reports on information matching provisions
185Responsible Minister must present to House of Representatives copy of report under section 184 and report setting out Government’s response to House of Representatives
186Avoidance of controls on information matching through use of exceptions to information privacy principles
187Avoidance of controls on information matching through use of official information statutes
188Power to amend Schedule 6 by Order in Council
189Power to amend Schedule 7 by Order in Council
190Amendments to other enactments related to this subpart
191Expiry of section 190 and Schedule 8
Part 8
Transfer Prohibiting onward transfer of personal information outside received in New Zealand from overseas
192Interpretation
193Prohibition on transfer of personal information outside New Zealand
194Commissioner’s power to obtain information
195Transfer prohibition notice
196Commissioner may vary or cancel transfer prohibition notice
197Offence in relation to transfer prohibition notice
198Appeals against transfer prohibition notice
199Application of Human Rights Act 1993
200Power to amend Schedule 9 by Order in Council
Part 9
Miscellaneous provisions
General
201Privacy officers
202Commissioner may require agency to supply information
203Inquiries
204Powers relating to declaratory judgments
205Protection against certain actions
206Commissioner and staff to maintain secrecy
207Commissioner may share information with overseas privacy enforcement authority
208Consultation
209Exclusion of public interest immunity
210Adverse comment
Liability and offences
211Liability of employers and principals
212Offences
Regulations
212ARegulations: prescribed binding schemes
212BRegulations: prescribed countries
213RegulationsOther regulations
Repeal, revocation, and consequential amendments
214Repeal and revocation
215Consequential amendments
216Expiry of section 215 and Schedule 10
Schedule 1
Transitional, savings, and related provisions
Schedule 2
Public registers
Schedule 3
Approved information sharing agreements
Schedule 4
Identity information
Schedule 5
Law enforcement information
Schedule 6
Information matching provisions
Schedule 7
Information matching rules
Schedule 8
Amendments to other enactments related to subpart 4 of Part 7
Schedule 9
Basic principles of national application set out in Part Two of the OECD Guidelines
Schedule 10
Consequential amendments
Legislative history

The Parliament of New Zealand enacts as follows: