EC affirms our privacy protections

In January this year the European Commission (EC) completed its review of the existing adequacy decisions of 11 countries and territories; of which New Zealand is one.
An adequacy decision, in brief, affirms that the EC has found that personal data transferred from the European Union to the country or territory, continues to benefit from adequate data protection safeguards, and that data can continue to flow freely to these jurisdictions.
Our Privacy Commissioner Michael Webster said: “This is good news for trade and ease-of-doing business in the digital age and helps ensure smooth cross-border data transfers. … Adequacy means that New Zealand is a good place for the world to do business; we have strong privacy protections in our legislation and are an empowered regulator.” He intimated that to remain one of the safest places to process personal information, we need to continue to strengthen our privacy and data protection laws.
In support of this his office recommended the following amendments to the Privacy Act 2020:
• A set of specific amendments to make the Privacy Act fit-for-purpose in the digital age.
• A civil penalty regime for major non-compliance alongside new privacy rights for New Zealanders to better protect themselves.
• Stronger requirements for automated decision making and agencies demonstrating how they meet privacy requirements.
In the words of the Commissioner, “Only a small number of countries have achieved EU adequacy status, and this recognition is important for New Zealand in a global business environment.”