On September 21, 2023, the Office of the Privacy Commissioner (OPC) published guidance on Artificial Intelligence and the Information Privacy Principles. The guidance is directed at any New Zealander that uses artificial intelligence (AI) tools and is designed to help them comply with the Privacy Act 2020 (the Act).

The guidance encourages users to consider the Information Privacy Principles (IPPs) at every stage of AI tool implementation, from data collection and model training to user input and action-taking. The guidance explains how AI relates to the 13 IPPs in the Act, looking at how AI tools work, offering practical examples, and setting out a range of questions to consider regarding privacy obligations.

In particular, the guidance expects that agencies using AI tools should:

• have senior leadership approve AI use only after fully considering risks and mitigations;
• review the necessity and proportionality of using a generative AI tool, given the potential privacy impacts, and consider a different approach;
• conduct a privacy impact assessment prior to using AI tools;
• communicate to people how, when, and why the tool is being used, so as to be transparent;
• consult with Māori regarding risks and impacts to the taonga of their information;
• establish procedures in order to facilitate accuracy and access to the information by individuals;
• reduce risks of inaccuracy and bias by making sure that there is human review before acting on AI outputs; and
• prevent the AI tool from retaining or disclosing personal information.

You can read the press release here and the guidance here.