The Privacy Act 2020 of New Zealand establishes a broad scope of applicability for New Zealand agencies. Article 4(1)(a) states that the Act applies to "a New Zealand agency (A), in relation to any action taken by A (whether or not while A is, or was, present in New Zealand) in respect of personal information collected or held by A". This provision ensures that the Act covers all actions taken by New Zealand agencies regarding personal information, regardless of their physical location at the time of the action.

Furthermore, Article 4(2)(a) expands this scope by clarifying that "it does not matter where the personal information is, or was, collected by the agency". This means that the Act applies to New Zealand agencies even when they collect or process data outside of New Zealand's territorial boundaries.

The law also extends its reach to cover specific offenses. Article 4(5)(a) states that "Section 212 applies to a New Zealand agency", ensuring that New Zealand agencies are subject to the Act's enforcement provisions, including penalties for non-compliance.

Implications

The broad applicability of the Privacy Act 2020 to New Zealand agencies has significant implications for businesses and organizations:

1. Extraterritorial reach: New Zealand agencies must comply with the Act even when operating or collecting data abroad. This means they cannot circumvent their obligations by moving data processing activities offshore.
2. Consistent data protection standards: Regardless of where they operate, New Zealand agencies are required to maintain the same level of data protection as mandated by the Act. This ensures a uniform approach to data protection for all personal information handled by these entities.
3. Global operations: New Zealand companies with international operations must ensure compliance with the Act across all their activities, potentially necessitating a global privacy strategy.
4. Data transfers: While the Act does not explicitly mention data transfers in the provided provisions, the broad scope suggests that New Zealand agencies must consider the Act's requirements when transferring data internationally.
5. Accountability: New Zealand agencies remain accountable under the Act for their data processing activities, regardless of where these activities occur or where the data subjects are located.