The New Zealand Parliament passed, on 24 June 2020, the Privacy Bill ('the Bill') at its Third Reading. In particular, the Bill repeals and replaces the Privacy Act 1993 and introduces a number of key reforms, including mandatory data breach reporting requirements, new criminal offences with maximum fines of up to NZD 10,000 (approx. €5,740), and an obligation for New Zealand organisations to ensure that overseas entities have similar levels of privacy protection to those prescribed in New Zealand. Furthermore, the Bill requires organisations that carry out business in New Zealand to comply with the requirements of the Bill, regardless of where they are physically located, or where their servers are based. In addition, the Bill enhances the powers of the Office of the Privacy Commissioner of New Zealand ('OPCNZ') through the introduction of binding access determinations and compliance orders that can be issued for non-compliance. 

Privacy Commissioner, John Edward, noted, ''The Bill provides a modernised framework to better protect New Zealanders' privacy rights in today's environment […] I am grateful for the cross-party support of Parliament on this issue. It is an endorsement of the significance of privacy as a universal human right that the Bill was passed with the multi-party support of the House.'' 

The Bill will come into effect on 1 December 2020.   

You can read the Bill here, track the Bill's progress here, and read the OPCNZ's press release here. 

UPDATE (30 June 2020) 

Privacy Bill receives Royal Assent 

The Bill received, on 30 June 2020, Royal Assent. 

You can track the Bill's progress here.