The Office of the Privacy Commissioner ('OPC') announced, on 1 December 2020, the entry into effect of the Privacy Act 2020. In particular, the OPC highlighted that the Act provides New Zealanders with stronger privacy protections through a modernised approach to privacy and reflects changes in the wider economy. Furthermore, the OPC outlined the key reforms in the Act, which include:

• mandatory data breach reporting obligations for breaches that cause, or are likely to cause, serious harm;
• new criminal offences for misleading an agency in order to access someone else's personal information, punishable with fines of up to NZD 10,000 (approx. €5,870);
• compliance notices which can be issued by the OPC to businesses or organisations to either require them to do something, or cease doing something;
• enforceable access directions which can be issued by the OPC to direct a business or organisation to confirm whether they hold personal information about an individual and to provide the individual with access to that information;
• a new information privacy principle 12, under which an organisation or business may only disclose personal information to an agency outside of New Zealand if the receiving agency is subject to similar safeguards to those in the Act; and
• expanded extraterritorial scope, encompassing overseas businesses or organisations that 'carry on business' in New Zealand even if they do not have a physical presence in the country.

You can read the press release here and the Act here.