Data protection
The Privacy Act 2020 modernised New Zealand's regime: mandatory notification of privacy breaches likely to cause serious harm, compliance notices, and a new principle governing disclosure of personal information overseas. The Privacy Commissioner handles individual complaints directly, and the Human Rights Review Tribunal can award damages.
Key points
| Access | Principle 6 gives a right of access, normally answered within 20 working days |
|---|---|
| Correction | Principle 7; a statement of correction can be attached if the agency refuses |
| Overseas disclosure | IPP12 restricts sending personal information abroad without comparable safeguards |
| Breach notification | Mandatory where serious harm is likely |
| Compliance notices | The Commissioner can require an agency to act |
| Damages | Awarded by the Human Rights Review Tribunal for interference with privacy |
| Biometrics | A biometric processing code has been developed |
| Access directions | The Commissioner can direct that information be released |
| Tribunal | The Human Rights Review Tribunal awards damages, including for humiliation |
| Cross-border | Disclosure overseas requires comparable protection |
In practice
- Ask the Commissioner for an access direction where an agency refuses to release your information.
- Expect delay at the Tribunal; settlement through the Commissioner is usually faster.
Cost and coverage
Free; the Tribunal process is also low-cost for individuals.
Recent changes
New Zealand's regime is notable for how accessible it is to ordinary complainants, with the Commissioner investigating individual cases rather than only systemic ones.
Where to go
- Office of the Privacy Commissioner — online complaints and AboutMe request tool.
- Human Rights Review Tribunal for damages claims.
- Community Law Centres for assistance.
Worth knowing
The Commissioner's AboutMe tool generates and sends access requests for you — one of the simplest ways anywhere to start a privacy request. The power to issue access directions is unusual and effective: it converts a refused request into an enforceable order without going to court.
The general article: Data protection · Compare with another country
Privacy
The Privacy Act 2020 replaced the 1993 Act and introduced mandatory breach notification and compliance notices. Separately, the courts recognised a tort of public disclosure of private facts in Hosking v Runting in 2004, and a tort of intrusion into seclusion in C v Holland in 2012.
Key points
| Statute | Privacy Act 2020, with thirteen information privacy principles |
|---|---|
| Regulator | Privacy Commissioner, free complaints, can issue compliance notices |
| Torts | Public disclosure of private facts, and intrusion into seclusion |
| Tribunal | Human Rights Review Tribunal awards damages, including for humiliation |
| Online harm | Harmful Digital Communications Act 2015, with Netsafe as approved agency |
| Highly offensive test | Publication must be highly offensive to a reasonable person |
| Legitimate public concern | A defence to the disclosure tort |
| Damages | The Tribunal awards for humiliation, loss of dignity and injury to feelings |
In practice
- Quantify the humiliation and distress in your evidence: that is the head of damage the Tribunal awards.
Where to go
- Office of the Privacy Commissioner.
- Netsafe for online harm.
- Community Law Centres.
Worth knowing
The Human Rights Review Tribunal has a long waiting list. Where the harm is ongoing, the Netsafe route under the Harmful Digital Communications Act is usually much faster. Awards for humiliation and injury to feelings are the main remedy, and they are modest. The value of the process is usually the order, not the money.
Image rights
The Harmful Digital Communications Act gives a fast civil route through an approved agency, with the District Court behind it.
The Harmful Digital Communications Act 2015 created ten communication principles, an approved agency — Netsafe — to negotiate removal, and District Court orders where negotiation fails. Posting an intimate visual recording without consent is a specific offence, and the Films, Videos, and Publications Classification Act covers objectionable material.
Key points
| Statute | Harmful Digital Communications Act 2015 |
|---|---|
| Approved agency | Netsafe: free, informal, usually the quickest route |
| Court orders | District Court can order take-down, correction and identity disclosure |
| Offence | Posting a harmful digital communication with intent to cause harm |
| Intimate recordings | Specific offences in the Crimes Act |
| Privacy Act | An identifiable image is personal information |
| Orders against platforms | The District Court can order a host to take down content |
| Identity disclosure | The court can require disclosure of an anonymous poster |
| Safe harbour | Hosts that follow the notice procedure are protected |
In practice
- Use the safe harbour notice: hosts must act or lose their protection.
Where to go
- Netsafe, free helpline.
- New Zealand Police.
- Community Law Centres.
Worth knowing
Netsafe cannot compel anyone, but a very large share of cases resolve at that stage; the court route opens only after the agency has been given a chance. The safe harbour notice puts the host to a choice: remove the content or become liable for it. It is the most effective lever available.
The general article: Image rights · Compare with another country
Speech and online harassment
The Harmful Digital Communications Act gives ordinary people a fast, low-cost route to removal.
The Harmful Digital Communications Act 2015 established ten communication principles and a two-stage process: Netsafe, the approved agency, attempts resolution first, and the District Court can then make orders including takedown, cease-and-desist and correction. It also created offences of causing harm by posting a digital communication and of posting intimate visual recordings.
Key points
| Communication principles | Ten principles covering disclosure of sensitive facts, harassment, denigration and falsehoods |
|---|---|
| Netsafe | Approved agency handling complaints before any court step |
| District Court orders | Takedown, cease and desist, correction, right of reply, release of identity |
| Offences | Causing harm by digital communication; posting intimate visual recordings |
| Defamation | Governed separately by the Defamation Act 1992 |
| Safe harbour | Online content hosts protected if they follow the statutory notice process |
| Timeframe | Netsafe complaints are handled in days rather than months |
| Harmful Digital Communications Act | Ten communication principles and a two-stage process |
| Defamation Act 1992 | Truth and honest opinion are the main defences |
In practice
- Complain to Netsafe first: the District Court will ask whether you did.
- Use the safe harbour notice procedure to obtain removal from a host.
Cost and coverage
Netsafe's service is free; District Court applications carry modest fees.
Recent changes
The Act is widely cited internationally as a model for accessible remedies against online abuse, precisely because it does not require a lawyer.
Where to go
- Netsafe — 0508 638 723, free advice and complaint handling.
- District Court for orders where Netsafe cannot resolve the matter.
- Police for threats and criminal harassment.
Worth knowing
Netsafe is the first step by design: the court will normally expect you to have gone there first, and most cases are resolved without ever reaching a judge. The two-stage process is compulsory in practice. Netsafe cannot compel anyone, but the court expects the agency stage to have been attempted.
The general article: Speech and online harassment · Compare with another country
Copyright
Still life plus fifty years — New Zealand did not extend its term, because the trade-agreement provision requiring it was suspended.
The Copyright Act 1994 protects most works for the author's life plus fifty years. New Zealand had agreed to extend the term to seventy years under the original Trans-Pacific Partnership, but that provision was suspended when the agreement was renegotiated as the CPTPP, so the shorter term remains. Fair dealing covers research, private study, criticism, review and news reporting.
Key points
| Statute | Copyright Act 1994 |
|---|---|
| Term | Life plus 50 years for most works — shorter than most comparable countries |
| Fair dealing | Research, private study, criticism, review, news reporting |
| No parody exception | Parody and satire are not listed exceptions |
| Format shifting | A limited exception exists for sound recordings |
| Review | A long-running review of the Act has been under way |
| Act under review | A long-running review has not yet produced legislation |
| Internet infringement regime | A notice process exists for file sharing |
| Crown copyright | Much government material is released under open licences |
In practice
- Check the term carefully: fifty years here means works are free earlier than abroad.
Where to go
- Ministry of Business, Innovation and Employment.
- Copyright Licensing New Zealand and APRA AMCOS.
- Disputes Tribunal for small claims.
Worth knowing
The shorter term means works enter the public domain in New Zealand earlier than elsewhere. That does not make them free to use in other countries: publishing online exposes you to the longer terms abroad. Publishing online exposes you to the longer terms of other countries. A work free in New Zealand may still be protected where your readers are.
The general article: Copyright · Compare with another country
Identity theft
Crimes Act offences on forgery and obtaining by deception, with CERT NZ and IDCARE NZ coordinating support.
There is no standalone identity theft offence: prosecutions proceed under obtaining by deception, forgery and computer misuse provisions of the Crimes Act 1961. CERT NZ receives reports of cyber incidents and works with IDCARE, which provides free case management to New Zealanders, and credit bureaus offer suppression of your file.
New Zealand prosecutes identity misuse through the Crimes Act offences of forgery, using a forged document and obtaining by deception. Support is well organised: CERT NZ receives reports of cyber incidents and routes them, and IDCARE provides free case management for individuals, working through the practical steps with each organisation involved. The combination of a reporting body and a case-management service is the country's strength here.
Key points
| Offences | Obtaining by deception, forgery, accessing a computer system for dishonest purpose |
|---|---|
| Reporting | CERT NZ for cyber incidents; Police for the fraud itself |
| Support | IDCARE provides free response plans in New Zealand |
| Credit suppression | Centrix, Equifax and Illion can suppress or flag your file |
| Documents | Report stolen passports to the Department of Internal Affairs |
| Privacy | Report the underlying breach to the Privacy Commissioner |
| RealMe | Check and secure the government login service |
| Passport cancellation | Report a stolen passport to Internal Affairs immediately |
| Bureau suppression | Must be requested at each bureau separately |
In practice
- Call your bank, then report to Police and CERT NZ.
- Contact IDCARE for a free response plan.
- Ask each credit bureau to suppress your file so new credit cannot be granted.
- Cancel and replace compromised identity documents.
- Secure your RealMe login: it gives access to a wide range of government services.
Where to go
- CERT NZ.
- IDCARE New Zealand.
- Netsafe.
Worth knowing
Credit file suppression has to be requested at each bureau separately: doing only one leaves the others open. File suppression is not shared between bureaus. Doing only one leaves the others open to a new application.
Frequently asked questions
What does IDCARE do?
It provides free, individual case management for people whose identity has been misused: a case manager works out which organisations are affected, what evidence each needs and in what order to approach them. It operates in New Zealand and Australia and is the single most useful call after your bank.
The general article: Identity theft · Compare with another country
Online shopping
The Consumer Guarantees Act gives automatic rights when goods are faulty — but there is no right to change your mind.
The Consumer Guarantees Act requires goods to be of acceptable quality, fit for purpose and as described, with remedies of repair, replacement or refund depending on the seriousness of the failure. The Fair Trading Act prohibits misleading conduct, including by overseas sellers targeting New Zealand consumers.
Key points
| Cooling-off | No general right to change your mind |
|---|---|
| Acceptable quality | Goods must last a reasonable time given price and description |
| Serious failure | The consumer may reject the goods and choose a refund or replacement |
| Services | Must be carried out with reasonable care and skill |
| Fair Trading Act | Covers misleading conduct and unfair contract terms |
| Chargeback | Available through card schemes |
| Disputes Tribunal | Low-cost forum with no lawyers |
| Consumer Guarantees Act | Statutory guarantees that cannot be contracted out of for consumer sales |
| No general cooling-off | Except for specific contract types such as uninvited direct sales |
In practice
- Use the Disputes Tribunal: it is cheap, quick and designed for people without lawyers.
- State the guarantee you say has been breached; the Tribunal works from the Act.
Cost and coverage
Disputes Tribunal fees are low and based on the claim amount.
Recent changes
The Commerce Commission has actively pursued overseas online sellers whose terms misrepresent New Zealand consumers' rights.
Where to go
- Consumer Protection (MBIE) and Consumer NZ.
- Commerce Commission for misleading conduct.
- Disputes Tribunal for claims up to the statutory limit.
Worth knowing
The Disputes Tribunal hears cases without lawyers and issues binding decisions — the standard route once a retailer refuses a legitimate claim. The Disputes Tribunal is the most effective consumer forum in the country. Filing costs a small fee and lawyers are not permitted.
The general article: Online shopping · Compare with another country
Romance scams
A national cyber security agency that takes reports, and a banking code that shares responsibility.
Reports go to the national cyber security agency, which triages and refers on, and to the police for criminal matters. The banking sector operates a code that sets expectations on fraud prevention and on how customer claims are handled. A free, independent banking ombudsman scheme resolves disputes.
CERT NZ receives reports of cyber incidents and scams and routes them to the agencies that can act, and the banking industry's code of practice sets out shared responsibility between banks and customers for unauthorised transactions. A voluntary reimbursement framework for scam losses has been developed with the banks, with a confirmation-of-payee service introduced to catch mismatched account names.
Key points
| Reporting | National cyber security agency, with triage and referral |
|---|---|
| Police | Separate criminal report |
| Banking code | Sets expectations on prevention and on handling claims |
| Dispute resolution | Free and independent banking ombudsman scheme |
| Suspicious texts | Forward free to the national short code |
| Consumer protection | Commerce Commission for misleading conduct |
| Cryptocurrency | Effectively unrecoverable |
In practice
- Report to the cyber security agency first: it can act on the infrastructure behind the scam.
- Use the banking ombudsman if the bank refuses — it is free and independent.
- Forward scam texts to the national short code; it is free and leads to numbers being blocked.
- Keep every message and transaction reference before blocking the account.
Cost and coverage
Reporting and the ombudsman scheme are free.
Where to go
- National cyber security agency reporting form.
- Police, for criminal reporting.
- Banking ombudsman scheme, free and independent.
Worth knowing
Reporting to the cyber security agency is not just symbolic: it is what gets fraudulent sites and numbers taken down, which protects the next person approached.
Frequently asked questions
Is there confirmation of payee in New Zealand?
Yes — banks have introduced an account-name checking service so that you are warned if the name you type does not match the account you are paying. It is one of the most effective single measures against invoice and impersonation fraud. Take the warning seriously; do not override it on the strength of a phone call.
Sources
- Netsafe — free advice and reporting for online harm and scams
- CERT NZ, via the National Cyber Security Centre — national incident reporting
- Banking Ombudsman Scheme — free and independent dispute resolution
- Financial Markets Authority — warnings and alerts — unregistered platforms and scam websites
The general article: Romance scams · Compare with another country
General sources
- govt.nz — official government information
- New Zealand Legislation — acts and regulations