New Zealand: Adopted Privacy Bill including cross-border data transfer regulation (Bill No.34-3)

On 23 June 2020, the New Zealand Parliament adopted the Privacy Bill (No. 24-3), which includes provisions addressing cross-border transfer of information. Part 8 of the Act prohibits the onward transfer of personal information received in New Zealand from overseas. The Privacy Commissioner is granted authority to prohibit such transfers to a third country if certain conditions are met, such as a lack of comparable safeguards in the receiving country and potential contravention of basic principles outlined in the OECD Guidelines and Schedule 8 of the Act. Agencies can transfer personal information overseas if the recipient is subject to privacy laws or contractual obligations providing safeguards comparable to the New Zealand Privacy Act. If such protections are not in place, the individuals have to provide informed consent for their data to be transferred.