HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"L 28/12
EN
Official Journal of the European Union
30.1.2013
DECISIONS
COMMISSION IMPLEMENTING DECISION
of 19 December 2012
pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate
protection of personal data by New Zealand
(notified under document C(2012) 9557)
(Text with EEA relevance)
(2013/65/EU)
THE EUROPEAN COMMISSION,
unjustifiably discriminate against or between third
countries where like conditions prevail, nor constitute a
disguised barrier to trade, regard being had to the
Having regard to the Treaty on the Functioning of the European
Union’s present international commitments.
Union,
Having regard to Directive 95/46/EC of the European
(5)
New Zealand is a former British colony. It became an
Parliament and of the Council of 24 October 1995 on the
independent Dominion in 1907, but did not formally
protection of individuals with regard to the processing of
sever its constitutional ties with Great Britain until
personal data and on the free movement of such data ( 1 ), and
1947. New Zealand is a unitary State and does not
in particular Article 25(6) thereof,
have a written constitution in the conventional sense
of an entrenched constitutive document. The country is
a constitutional monarchy and parliamentary democracy
After consulting the European Data Protection Supervisor
on the Westminster model, with the Queen of New
Zealand as the Head of State.
Whereas:
(6) New
Zealand
operates
on
the
principle
of
Parliamentary
sovereignty. Nevertheless, by convention there are a
(1) Pursuant
to
Directive
95/46/EC,
Member
States
are
required to provide that the transfer of personal data
number of statutes that are of particular constitutional
to a third country may take place only if the third
importance and are regarded as ‘higher law’. This is in the
country in question ensures an adequate level of
sense that they form part of the constitutional back
protection and if the Member States’ laws implementing
ground or landscape by informing government practice
other provisions of the Directive are complied with prior
and the enactment of other legislation. Moreover, cross-
to the transfer.
political consensus would be expected in the event of

amendment or repeal of this legislation. Several of
these statutes — the Bill of Rights Act of 28 August
1990 (Public Act No 109 of 1990), the Human Rights
(2) The
Commission
may
find
that
a
third
country
ensures
Act of 10 August 1993 (Public Act No 82 of 1993), and
an adequate level of protection. In that case, personal
the Privacy Act of 17 May 1993 (Public Act No 28 of
data may be transferred from the Member States
1993) — are relevant to data protection. The constitu
without additional guarantees being necessary.
tional importance of this legislation is reflected by the
convention that they must be taken into account when
developing or proposing new legislation.
(3) Pursuant
to
Directive
95/46/EC
the
level
of
data
protection should be assessed in the light of all the
circumstances surrounding a data transfer operation or
a set of data transfer operations and giving particular
(7) The
legal
standards
for
the
protection
of
personal
data
in
consideration to certain specified elements relevant for
New Zealand are primarily set out in the Privacy Act, as
the transfer.
amended by the Privacy (Cross-border Information)
Ammendement Act of 7 September 2010 (Public Act
No 113 of 2010). It predates Directive 95/46/EC, and
(4) Given
the
different
approaches
to
data
protection
in
third
is not limited to automatically processed data or
countries, the adequacy assessment should be carried out,
structured data in a filing system, but covers all
and any decision based on Directive 95/46/EC should be
personal information in whatever shape or form. It
made and enforced in a way that does not arbitrarily or
covers the entire public and private sectors, with a few
specific public interest exceptions that one would expect
( 1 ) OJ L 281, 23.11.1995, p. 31.
in a democratic society.

---

EN
30.1.2013 Official
Journal
of
the
European
Union L
28/13
(8) There
are
a
number
of
regulatory
frameworks
in
New (15) The
Working
Party
on
the
protection
of
individuals
with
Zealand for dealing with privacy issues in terms of
regard to the processing of personal data established
policy, rules, or complaints jurisdictions. Some are
under Article 29 of Directive 95/46/EC has delivered a
statutory while others are self-regulating industry
favourable opinion on the level of adequacy as regards
bodies, including media regulation, direct marketing,
protection of personal data in New Zealand ( 1 ), which
unsolicited electronic messages, market research, health
has been taken into account in the preparation of this
and disability, banking and insurance and savings.
Implementing Decision.
(9) In
addition
to
legislation
enacted
by
the
New
Zealand (16) The measures provided for in this Decision are in
Parliament, there exists a considerable body of
accordance with the opinion of the Committee estab
common law whose roots stem from English common
lished under Article 31(1) of Directive 95/46/EC,
law, embodying common law principles and rules that
are relevant to data protection. Among the fundamental
HAS ADOPTED THIS DECISION:
common law principles is the principle that the dignity
of the individual is a paramount concern of the law. This
common law principle is a key element in the back
Article 1
ground context to judicial decision-making generally in
New Zealand. New Zealand case-law based on common
1. For
the
purposes
of
Article
25(2)
of
Directive
95/46/EC,
law also contains a number of other aspects of privacy
New Zealand is considered as ensuring an adequate level of
including invasion of privacy, breach of confidence and
protection for personal data transferred from the Union.
incidental protection in the context of defamation,
nuisance, harassment, malicious falsehood, negligence
2. The
competent
supervisory
authority
for
the
application
and others.
of the legal data protection standards in New Zealand is set out
in the Annex to this Decision.
(10) The
legal
data
protection
standards
applicable
in
New
Zealand cover all the basic principles necessary for an
Article 2
adequate level of protection for natural persons, and also
provide for exceptions and limitations in order to
1. Without prejudice to their powers to take action to ensure
safeguard important public interests. These legal data
compliance with national provisions adopted pursuant to
protection standards and the exceptions reflect the prin
provisions other than Article 25 of Directive 95/46/EC, the
ciples laid down in Directive 95/46/EC.
competent authorities in Member States may exercise their
existing powers to suspend data flows to a recipient in New
Zealand in order to protect individuals with regard to the
(11) The
application
of
the
legal
data
protection
standards
is
processing of their personal data in the following cases:
guaranteed by administrative and judicial remedies, and
by independent supervision carried out by the super
(a) where a competent New Zealand authority has determined
visory authority, the Privacy Commissioner, who is
that the recipient is in breach of the applicable standards of
endowed with the kinds of powers set out in Article 28
protection; or
of Directive 95/46/EC, and who acts independently.
Moreover, any interested party is entitled to seek
judicial redress for compensation for damages suffered
(b) where there is a substantial likelihood that the standards of
as a result of the unlawful processing of his personal
protection are being infringed, there are reasonable grounds
data.
for believing that the competent New Zealand authority is
not taking or will not take adequate and timely steps to
settle the case at issue, the continuing transfer would create
(12) New
Zealand
should
therefore
be
regarded
as
providing
an imminent risk of grave harm to data subjects and the
an adequate level of protection for personal data as
competent authorities in the Member State have made
referred to in Directive 95/46/EC.
reasonable efforts in the circumstances to provide the
party responsible for processing established in New
Zealand with notice and an opportunity to respond.
(13) This
decision
should
concern
the
adequacy
of
protection
provided in New Zealand with a view to meeting the
requirements of Article 25(1) of Directive 95/46/EC. It
2. The suspension shall cease as soon as the standards of
should not affect other conditions or restrictions imple
protection are assured and the competent authority of the
menting other provisions of the Directive that pertain to
Member States concerned is notified thereof.
the processing of personal data within Member States.
Article 3
(14) In
the
interest
of
transparency
and
in
order
to
safeguard
1. Member
States
shall
inform
the
Commission
without
the ability of the competent authorities in the Member
delay when measures are adopted on the basis of Article 2.
States to ensure the protection of individuals as regards
the processing of their personal data, it is necessary to
specify the exceptional circumstances in which the
( 1 ) Opinion 11/2011 dated 4 April 2011 on the level of protection of
personal data in New Zealand. Available at http://ec.europa.eu/
suspension of specific data flows may be justified,
justice/data-protection/article-29/documentation/opinion-
notwithstanding the finding of adequate protection.
recommendation/files/2011/wp182_en.pdf

---

L 28/14
EN
Official Journal of the European Union
30.1.2013
2. The
Member
States
and
the
Commission
shall
inform
each protection in New Zealand is adequate within the meaning of
other of cases where the action of bodies responsible for
Article 25 of Directive 95/46/EC and any evidence that this
ensuring compliance with the standards of protection in New
Decision is being implemented in a discriminatory manner.
Zealand fails to ensure such compliance.
Article 5
3. Where
information
gathered
under
Article
2(1)
and
under
paragraphs 1 and 2 of this Article provides evidence that any
Member States shall take all the measures necessary to comply
body responsible for ensuring compliance with the standards of
with this Decision until 20 March 2013.
protection in New Zealand is not effectively fulfilling its role,
the Commission shall inform the competent New Zealand
Article 6
authority and, if necessary, present draft measures in accordance
with the procedure referred to in Article 31(2) of Directive
This Decision is addressed to the Member States.
95/46/EC with a view to repealing or suspending this
Decision or limiting its scope.
Done at Brussels, 19 December 2012.
Article 4
The Commission shall monitor the functioning of this Decision
For the Commission
and report any pertinent findings to the Committee established
under Article 31 of Directive 95/46/EC, including any evidence
Viviane REDING
that could affect the finding in Article 1 of this Decision, that
Vice-President
ANNEX
Competent supervisory authority referred to in Article 1(2) of this Decision:
Privacy Commissioner:
Te Mana Matapono Matatapu
Level 4
109-111 Featherston Street
Wellington 6143
New Zealand
Tel: +64-4-474 7590
Contact e-mail: enquiries@privacy.org.nz
Website: http://privacy.org.nz/

---

Document Outline

• �

---