Applicability of Data Protection Law in New Zealand: Location of Individual Who Processes Data

The "Location of Individual Who Processes Data" factor addresses the applicability of data protection laws to individuals who process personal data while physically present in New Zealand, regardless of their usual residence or the data subject's location.

Text of Relevant Provisions

Referenced Provision(s):

"This Act (except section 212) applies to— (c) an individual (C) who is not ordinarily resident in New Zealand, in relation to any action taken by C in respect of— (i) personal information collected by C while present in New Zealand, regardless of where the information is subsequently held by C or where the individual to whom the information relates is, or was, located:""This Act (except section 212) applies to— (c) an individual (C) who is not ordinarily resident in New Zealand, in relation to any action taken by C in respect of— (ii) personal information held by C while present in New Zealand (but not collected by C while present in New Zealand), regardless of where the individual to whom the information relates is, or was, located." Original (Language):(This Act (except section 212) applies to— (c) an individual (C) who is not ordinarily resident in New Zealand, in relation to any action taken by C in respect of— (i) personal information collected by C while present in New Zealand, regardless of where the information is subsequently held by C or where the individual to whom the information relates is, or was, located: (ii) personal information held by C while present in New Zealand (but not collected by C while present in New Zealand), regardless of where the individual to whom the information relates is, or was, located.)*

Analysis of Provisions

The Location of Individual Who Processes Data factor in the Privacy Act 2020 establishes that the Act applies to actions involving personal information based on the location of the data processing activities rather than the residency of the data processor or the data subject.

Key points of the provisions include:

• Collection of Personal Information: Under Article 4(1)(c)(i), the Act applies to personal information collected by an individual while present in New Zealand, irrespective of the subsequent location of the information or the location of the individual to whom the information relates.
• Holding of Personal Information: Article 4(1)(c)(ii) extends the Act's applicability to personal information held by an individual while present in New Zealand, even if the information was not collected while in New Zealand.

These provisions ensure that any individual processing personal information in New Zealand, even if they are not ordinarily resident there, is subject to the Privacy Act for their actions related to that information. This approach helps to address cross-border data processing and provides a level of protection for personal data handled within New Zealand's jurisdiction.

Implications

For businesses and individuals:

• Applicability: The Privacy Act 2020 applies to data processing activities performed by individuals who are physically present in New Zealand, regardless of their usual place of residence or where the data is ultimately stored.
• Compliance: Individuals who process data while in New Zealand, even temporarily, must comply with the Privacy Act's requirements regarding data handling and protection.

Examples:

• Applicable: An international consultant who processes personal data of clients while working in New Zealand must adhere to the Privacy Act for those activities.
• Not Applicable: A data processor who is based outside New Zealand and processes personal data remotely, without being physically present in New Zealand, would not be subject to this provision of the Privacy Act.

This factor emphasizes New Zealand's commitment to data protection by ensuring that the physical presence of data processors in the jurisdiction triggers compliance obligations, enhancing the protection of personal data within its territory.