Privacy Act 2020 — Information Privacy Principle 12, disclosure of personal information outside New Zealand

IPP 12 was new in the 2020 Act and it is a belief-based test rather than a filing or an approval: an agency may disclose personal information to a foreign person or entity only if it believes on reasonable grounds that at least one condition is met — the recipient carries on business in New Zealand and is therefore itself subject to the Act; or is subject to privacy laws that overall provide comparable safeguards; or is required, for example by agreement between the agencies, to protect the information in a way that overall provides comparable safeguards; or is subject to the laws of a country, or a participant in a binding scheme, that regulations have PRESCRIBED as providing comparable safeguards. The Privacy Commissioner publishes model clauses for the agreement route, which is what most businesses use. Marked 'check' on one point worth confirming before relying on it: the prescribed-country route depends on regulations actually being made, and the Ministry of Justice was still consulting on which countries to prescribe — do not assume a destination is prescribed without checking. Note also that IPP 12 governs DISCLOSURE, and sending information to an agent that holds it solely on your behalf is treated differently under the Act.