The NZ Privacy Act has changed

Industry Updates
Written By Janelle McPherson

Have you updated your processes? Here’s what you need to know →

The Privacy Act Amendment came into force on May 1st, with the new IPP3A principle relating to indirect collection of personal information*.

As many kiwi businesses reach out to new leads with information supplied from a third party, it is key to understand how you must now inform individuals of how you will use their data.

What has changed?

If you collect someone’s personal data or information indirectly or from a third party source, you now need to tell them.

What counts under this change:

  • Lead referrals from other clients

  • Collecting contact details from third party sources (i.e platforms such as LinkedIn)

  • Sourcing personal details through data purchasing or shared lead lists

If you collect personal data from anywhere that is not the person directly, it is likely this change will apply.

So what do you need to do?

You need to take reasonable steps to ensure that the individual is informed that:

  • Their information has been collected

  • Why it has been collected

  • The intended recipients of that data

  • The name of who now holds that data (your business)

  • Whether the collection is authorised

  • The individuals right to ask you to amend or delete their data

Note that updating your email signature and privacy policy is not enough - You need to clearly state your intent when you contact the individual. It is also advisable to send internal communications to your team so they are aware of the updates.

Does this mean I can not source leads from contacts, websites etc?

No you still can, but when you use personal data provided to you from a source that is not the individual themselves, you now need to notify them that you have the data and how you intend to use it.

Confused (not surprised) - here’s an example of when this would apply and how to go about it.

Say your client texts you with the name, email address and phone number of a potential lead, who does not know that their information has been provided to you.

When you reach out and email them, include messaging similar to the following:

“Hi, I’m Janelle from Someone Digital. I was provided your contact details from Claire at Lincoln Loft, as she thought you may be interested in our Digital Marketing Services. I just wanted to let you know that we have your contact details so we could reach out about this, and you can ask us to change or delete that data from our systems at any time”.

References:

https://www.privacy.org.nz/tuhono-connect/statements-media-releases/privacy-amendment-act-passes/

https://www.justice.govt.nz/justice-sector-policy/key-initiatives/enhancing-the-privacy-act/

Still not sure or need help putting this into practise? Flick us an email at hello@someonedigital.co.nz and we will do our best to help!

Janelle McPherson