Material Applicability

The Privacy Act 2020 includes one material applicability factor:

• Location of Individual who Processes Data

Location of Individual who Processes Data

Privacy Act 2020 Art.4(1)(c):

(c) an individual (C) who is not ordinarily resident in New Zealand, in relation to any action taken by C in respect of—(i) personal information collected by C while present in New Zealand, regardless of where the information is subsequently held by C or where the individual to whom the information relates is, or was, located(ii) personal information held by C while present in New Zealand (but not collected by C while present in New Zealand), regardless of where the individual to whom the information relates is, or was, located

The Act applies to non-resident individuals who:

• Collect personal information while physically present in New Zealand
• Hold personal information while physically present in New Zealand, even if collected elsewhere

Territorial Applicability

The Privacy Act 2020 includes several territorial applicability factors:

• Processing by Local Establishment
• Doing Business in Jurisdiction
• Entity's Link or Presence in Jurisdiction

Processing by Local Establishment

Privacy Act 2020 Art.4(1)(a):

This Act (except section 212) applies to—(a) a New Zealand agency (A), in relation to any action taken by A (whether or not while A is, or was, present in New Zealand) in respect of personal information collected or held by A

Privacy Act 2020 Art.4(2):

For the purposes of subsection (1)(a) and (b), it does not matter—(a) where the personal information is, or was, collected by the agency; or(b) where the personal information is held by the agency; or(c) where the individual concerned is, or was, located

The Act applies to New Zealand agencies regardless of:

• Their physical location when processing data
• Where the personal information is collected or held
• Where the data subjects are located

Doing Business in Jurisdiction

Privacy Act 2020 Art.4(1)(b):

(b) an overseas agency (B), in relation to any action taken by B in the course of carrying on business in New Zealand in respect of personal information collected or held by B

Privacy Act 2020 Art.4(3):

For the purposes of subsection (1)(b), an agency may be treated as carrying on business in New Zealand without necessarily—(a) being a commercial operation; or(b) having a place of business in New Zealand; or(c) receiving any monetary payment for the supply of goods or services; or(d) intending to make a profit from its business in New Zealand

The Act applies to overseas agencies conducting business in New Zealand, with broad interpretation of "carrying on business" that does not require:

• Commercial operations
• Physical presence
• Monetary transactions
• Profit-making intention

Entity's Link or Presence in Jurisdiction

Privacy Act 2020 Art.4(5)(d):

(5) Section 212 applies to—(d) a person who is outside New Zealand if—(ii) any event necessary to the completion of any offence under section 212 occurs in New Zealand

The Act extends to persons outside New Zealand when events related to privacy offenses occur within New Zealand's territory.