“We have been following this potential change since the Ministry of Justice consulted on it last year. While we consider that the new IPP is likely to impose an additional administrative burden on some agencies, we appreciate that the change will bring us in line with some of New Zealand’s major trading partners, including Australia and the EU,” said Campbell Featherstone, a partner at Dentons Kensington Swan in Wellington.

He added: “We think that if the change is required in order to held New Zealand maintain its ‘adequacy status’ for the purposes of the GDPR, then the administrative burden is a price worth paying. Agencies whose collection practices will require them to make additional disclosures under the new IPP will need to think not only about what they are saying, but also how they communicate to the individuals from whom they indirectly collect information with whom they may not have a pre-existing relationship.”

The addition of IPP 3A is the most notable amendment under the Privacy Amendment Bill. Other changes include amendments to agencies’ responsibilities when responding to correction requests from data subjects regarding their personal information and to provisions about the personal information of minors.

If the bill is enacted, the amendments will enter into force on June 1, 2025. 

- Espie Angelica A. de Leon