New Zealand: OPC addresses model contract clauses for sending personal information overseas
The Office of the Privacy Commissioner ('OPC') released, on 19 November 2020, a blog post addressing the use of model contract clauses under the new information privacy principle ('IPP') 12 of the Privacy Act 2020 ('the Act'). In particular, the OPC highlighted that, under IPP 12, organisations will be responsible for ensuring that any personal information sent overseas is adequately protected with comparable privacy safeguards to those contained within the Act, and, therefore, will need to undertake the necessary due diligence before sending personal information outside New Zealand. As such, the OPC noted that organisations could adopt contractual safeguards to ensure the recipient organisation is aware of its responsibilities. Notably, the OPC outlined that IPP 12 will not apply to offshore cloud storage providers that are simply holding personal information or are subject to the Act in their own right.