NZ Privacy Commissioner Drills Down on Indirect Data Collection Law
The New Zealand Privacy Commissioner Wednesday fleshed out the requirements of new information privacy principle (IPP) 3A, which requires that agencies notify people when collecting personal information about them from anywhere other than directly from the individuals themselves.
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
IPP 3A is one of several amendments to the country's Privacy Act 2020, which won't apply until May 1, 2026 (see Ref:2509230004]).
Under IPP 3A, an agency that collects someone's personal information indirectly is required to notify them unless a listed exception applies. The principle applies to all personal data agencies collected indirectly, from any source, the DPA said.
The notification must make the individual aware of the fact that the information has been collected and the purpose for its collection, the DPA said. It must list the intended recipients of the information, the name and address of the agency collecting the information and the agency holding it. IPP 3A also requires that if the collection is authorized or required by law, that law must be identified and people must be advised of their rights to access and correct their data.
The obligation to inform the individual rests with the agency that collects the data indirectly, it said. If multiple departments collect information indirectly, they all have an obligation under IPP 3A, except in some situations, where it's appropriate for one to notify people on behalf of the others.