On 1 December, the #Privacy Act 2020 of #NewZealand entered into force. It's very interesting to look at it in depth for several reasons:1) NZ has a decades long tradition of regulating privacy (1st law: 1993), hence it maintains a sense of originality 1/9 https://fpf.org/2020/12/08/a-deep-dive-into-new-zealands-new-privacy-law-extraterritorial-effect-cross-border-data-transfers-restrictions-and-new-powers-of-the-privacy-commissioner/

2) New Zealand obtained an adequacy decision from the European Commission in 2012, and 3) that adequacy is now up to reassessment; so what are the changes NZ thought would be sufficient to maintain #adequacy? 2/9

We made a deep dive into the law and hope you will find it interesting. Here are some appetizer highlights. First: the law is ambivalent towards the @NZPrivacy. It gives the Commissioner broad powers to specify the law through Codes of Practice, 3/9

…to ban cross-border transfers, to issue detailed #compliance notices that require organizations to act or stop what they’re doing, to issue #fines. But at the same time, the fines are quite limited, they can go up to 10k NZ$ 4/

Second, the law comes with new rules regarding extraterritoriality: it now applies to entities outside NZ doing business in NZ. It also comes with a new set of rules on cross-border data transfers, which give quite a bit of flexibility 5/9
#datatransfers #schremsII

Interestingly, the cross-border rules speak of “comparable” laws or safeguards to the one in NZ - a bit more approachable than the #GDPR “essentially equivalence”; NZ also clearly states cross-border data restrictions don’t apply to orgs reached by the extraterritorial effect 6/9

Other things to note: the updated law did not add rights to #portability or #erasure; the only data subject rights specifically recognized remain access and correction; there are also no specific rules for objection to automated decision-making 7/9
#DSAR #AccessRequests

The Private Right of Action in court remains very limited: only for breaching access rights and only against a public authority; however, people can bring individual or representative claims to the Human Rights Tribunal following a decision of the #Privacy Commissioner 8/9

Thanks to @HoplandCaroline & @hunter_dorwart 4 joining me in this travel adventure to New Zealand #PrivacyLand! I know we’ve just scratched the surface, we are looking fwd to understanding more of this system in the future. Check out our overview: https://fpf.org/2020/12/08/a-deep-dive-into-new-zealands-new-privacy-law-extraterritorial-effect-cross-border-data-transfers-restrictions-and-new-powers-of-the-privacy-commissioner/ 9/9

Oh, and Congratulations for a new cool law to enforce and good luck to the one and only John Edwards! @JCE_PC