The Ministry of Justice is consulting on regulations regarding overseas disclosure of personal information under the Privacy Act 2020 (Act). The consultation will inform the decision of which countries will receive priority consideration to be assessed as "prescribed countries" under the Act. The process of prescribing countries will occur slowly and incrementally so if you transfer information to another jurisdiction, now is a great time to explain why that country should receive priority assessment.
Why being a prescribed country matters
The new Information Privacy Principle 12 (IPP 12) governs the disclosure of personal information outside New Zealand. Generally, if information is to be disclosed overseas, the agency disclosing the information must have reasonable grounds to believe that the information will receive comparable protection to that provided by the Act (through either foreign legislation or contractual requirements). Alternatively, the agency must obtain authorisation to disclose after expressly informing the individual that the information may not receive comparable safeguards.
However, IPP 12 also allows a New Zealand agency to disclose personal information to a "prescribed country". Disclosure to a prescribed country will therefore be practically similar to disclosure that occurs within New Zealand, meaning that independent assessment as to the adequacy of that country's privacy regime will not be required.
In order to be named a prescribed country, the country must have privacy laws that, overall, provide comparable safeguards to those under the Act.
The consultation process
As part of the process of naming prescribed countries, the Ministry will be assessing countries to determine whether their privacy safeguards are comparable to those in the Act. As this will take some time, the Ministry is seeking input on which countries should be prioritised for that assessment. Submitters are encouraged to provide any thoughts on which countries should be prioritised for assessment.
The Ministry has released the criteria for prioritising countries for assessment, which include:
- the likelihood of meeting key privacy standards, as the Ministry does not want to prioritise countries that are unlikely to be prescribed;
- the size of the economic relationship, which will allow the Ministry to prioritise countries that will be the most beneficial for New Zealand businesses and stakeholders; and
- New Zealand business and stakeholder views, to assist the Ministry in understanding which countries would be most valuable to prioritise and why.
In applying these criteria, the Ministry will weigh up competing considerations to determine which countries should be prioritised (eg a country with strong privacy protections but that New Zealand rarely sends personal information to, as against a major economic partner whose privacy laws meet some but not all of the standards).
Once the consultation period has ended, the Ministry and MFAT will apply the criteria outlined above and propose one to two countries to be prioritised for assessment. Those countries will then be assessed by the Office of the Privacy Commissioner, which will then provide advice to the Ministry. The Minister of Justice will then decide whether the test in the Act is met and whether any limits or qualifications are required. Following that, regulations will be made prescribing the countries as providing comparable safeguards.
The current estimate is that initial regulations will be made in 2022. The Ministry has noted that it is not likely to have more than one to two countries prescribed annually.
How to take part
Consultation on which countries should be prioritised is open until 4 December 2020. In particular, the Ministry is seeking views on which countries would be most valuable to prioritise and why. This feedback will help inform the order in which countries are assessed. Further details about how to provide feedback can be found here.