Overseas entities increasingly conscious of privacy laws
Overseas entities increasingly conscious of privacy laws
August 15, 2013
Clever-thinking intellectual property firm James & Wells’ business and property lawyer, Owen Culliney, is finding that New Zealanders and those trading with New Zealand are becoming more aware of their rights and obligations under New Zealand’s privacy legislation.
He is increasingly being asked to provide advice on the collection of personal information from New Zealander’s by overseas agencies. The advice differs depending on the part of the world from which the information is being collected and the type of information being collected, however it is all governed by the Privacy Act.
“At a time when we are increasingly talking about the importance of people’s privacy, people in business as much as individuals want to know what their rights are, and that if they are collecting private information that they are doing it in the right way under current laws,” he says.
Recently he provided advice to a global gaming company, whose customer service line records calls for training and quality control purposes. It wanted to know if it could legally record calls from New Zealand customers.
Mr Culliney says this is governed by New Zealand’s privacy law, codified in one statute, The Privacy Act 1993. The Act covers the collection, disclosure and storage of personal information by ‘agencies’, meaning entities such as companies, or individual people that collect or store personal information.
The
rules
Personal information is basically any
information relating to a person and there are four key
elements that overseas agencies need to be aware of when
collecting personal information from New Zealanders. In
general, they need to know:
1. From whom information may
be collected
2. For what purpose it may be used
3. To
whom the information may be disclosed
4. How the
information must be
stored.
Collection
Agencies must,
unless they are not reasonably able to do so or doing so
would defeat the purpose for the collection, collect the
information from the individual concerned – rather than
through a third party – make the individual aware of the
fact that the collection is taking place, and tell them who
the intended recipients of the information are. It
specifically must not collect information for an unlawful
means or in a manner that would be unfair or intrude on the
personal affairs of the
individual.
Use
When collecting
personal information, unless it would be impractical to do
so or would defeat the purpose of the collection, the agency
must make the individual concerned aware of the purpose for
which the information is being collected. Then it must only
use the information for the purpose for which it was
collected, and destroy the information once it has been used
for that purpose.
Disclosure
When
collecting personal information, unless it would be
impractical to do so or would defeat the purpose of the
collection, an agency must make the individual concerned
aware of the persons to whom the information might be
disclosed. From that point, the agency may not disclose the
information to another person unless it believes on
reasonable grounds that the disclosure is:
1. One of the
purposes in connection with which the information was
collected
2. To the individual themselves
3. To a
person that the individual has authorised to receive it;
or
4. Directly related to the purposes in connection with
which the information was
obtained.
Storage
All personal
information collected must be stored (either by the agency
or its agent) using reasonable security safeguards so as to
protect it against loss, access, use, disclosure,
modification or other misuse.
“Depending on their business and the information they are trying to collect, there is much more that an overseas agency would need to know before collecting personal information from New Zealanders,” says Mr Culliney.
“The key point is that they get the right advice before they begin doing business here,” says Mr Culliney.
ENDS