New Zealand

New Zealand’s Privacy Act of 1993

Regulates the collection, use and dissemination of personal information in both public and private sectors.

Grants individuals the right to have access to their personally identifiable information held by any agency.

Creates 12 “Information Privacy Principles” based on the 1980 Organization of Economic and Cooperation Development (OECD) and the information privacy principles in Australia’s Privacy Act of 1988.

Authority concerning data protection rights is granted to the Office of the Privacy Commissioner, an independent oversight authority that was created in 1991 as part of the Privacy Commissioner Act.

Employers must obtain the consent of the employees and have the appropriate policies in place for such monitoring. Otherwise, any workplace monitoring must be done in accordance with the Privacy Act of 1993.

It has been widely reported by commentators in New Zealand that it is widely accepted for employers to monitor employees’ email sent from work computers.

The New Zealand Privacy Commissioner has provided a “how-to-guide” for employers and gives the following steps for conducting workplace monitoring:

Determine legitimate justification for monitoring.

• Develop a draft policy setting out why monitoring will take place and when it will occur (e.g., on a regular basis, only on suspicion that something inappropriate has happened, etc.).
• Circulate the draft policy to employees and discuss it with them or their union.
• Remind everyone why monitoring is necessary.
• Listen to feedback.
• Make any necessary adjustment to the policy and issue it.

The Employment Court was unsympathetic to the claims by three employees who were fired for exchanging offensive emails. In Clarke v. Attorney General [1997] ERNZ 600.

Under the Privacy Act, employers may undertake monitoring in the workplace under certain conditions: there must be a lawful purpose and the information collected must be necessary to achieve that purpose. Employers must ensure that unfair or reasonably intrusive means are not used during monitoring.

Covert monitoring in the workplace is permitted if open monitoring would prejudice the purpose for which emails are to be monitored. In such cases, employee consent is not required

There are no provisions in the Privacy Act related to data registration.

Part 11A regulates the transfer of personal information outside of New Zealand. The law authorizes the Commissioner to prohibit the transfer of personal information outside of New Zealand to a country where the data will not be protected or where its processing would violate the privacy principles under the Act.