Overseas entities increasingly conscious of privacy laws
August 15, 2013
Clever-thinking intellectual property firm James & Wells’ business and property lawyer, Owen Culliney, is finding that New Zealanders and those trading with New Zealand
are becoming more aware of their rights and obligations under New Zealand’s privacy legislation.
He is increasingly being asked to provide advice on the collection of personal information from New Zealander’s by
overseas agencies. The advice differs depending on the part of the world from which the information is being collected
and the type of information being collected, however it is all governed by the Privacy Act.
“At a time when we are increasingly talking about the importance of people’s privacy, people in business as much as
individuals want to know what their rights are, and that if they are collecting private information that they are doing
it in the right way under current laws,” he says.
Recently he provided advice to a global gaming company, whose customer service line records calls for training and
quality control purposes. It wanted to know if it could legally record calls from New Zealand customers.
Mr Culliney says this is governed by New Zealand’s privacy law, codified in one statute, The Privacy Act 1993. The Act
covers the collection, disclosure and storage of personal information by ‘agencies’, meaning entities such as companies,
or individual people that collect or store personal information.
The rules
Personal information is basically any information relating to a person and there are four key elements that overseas
agencies need to be aware of when collecting personal information from New Zealanders. In general, they need to know:
1. From whom information may be collected
2. For what purpose it may be used
3. To whom the information may be disclosed
4. How the information must be stored.
Collection
Agencies must, unless they are not reasonably able to do so or doing so would defeat the purpose for the collection,
collect the information from the individual concerned – rather than through a third party – make the individual aware of
the fact that the collection is taking place, and tell them who the intended recipients of the information are. It
specifically must not collect information for an unlawful means or in a manner that would be unfair or intrude on the
personal affairs of the individual.
Use
When collecting personal information, unless it would be impractical to do so or would defeat the purpose of the
collection, the agency must make the individual concerned aware of the purpose for which the information is being
collected. Then it must only use the information for the purpose for which it was collected, and destroy the information
once it has been used for that purpose.
Disclosure
When collecting personal information, unless it would be impractical to do so or would defeat the purpose of the
collection, an agency must make the individual concerned aware of the persons to whom the information might be
disclosed. From that point, the agency may not disclose the information to another person unless it believes on
reasonable grounds that the disclosure is:
1. One of the purposes in connection with which the information was collected
2. To the individual themselves
3. To a person that the individual has authorised to receive it; or
4. Directly related to the purposes in connection with which the information was obtained.
Storage
All personal information collected must be stored (either by the agency or its agent) using reasonable security
safeguards so as to protect it against loss, access, use, disclosure, modification or other misuse.
“Depending on their business and the information they are trying to collect, there is much more that an overseas agency
would need to know before collecting personal information from New Zealanders,” says Mr Culliney.
“The key point is that they get the right advice before they begin doing business here,” says Mr Culliney.
ENDS