On 4 April 2011, the Article 29 Working Party (in its opinion 11/2011) recommended that the levels of protection of personal data in New Zealand be considered "adequate" for the purpose of receiving
On 4 April 2011, the Article 29 Working Party (in its opinion 11/2011) recommended that the levels of protection of personal data in New Zealand be considered "adequate" for the purpose of receiving European data exports, having assessed New Zealand data protection laws and, in particular, the Privacy Act 1993 (the “Act”).
The Working Party assessment of the Act indeed showed that it is broadly similar to the EU Data Protection Directive 95/46/EC (the “Directive”) in the following aspects: (i) scope of application; (ii) essential principles; (iii) regulation of sensitive data, automatic individual decision and up to a certain extent direct marketing; (iii) procedural and enforcement mechanisms. That said, the Article 29 Working Party identified some areas of weaknesses, in particular in relation to direct marketing and international data transfers and therefore recommended New Zealand to take the necessary steps to address these issues.
What is data export adequacy?
The concept of data export adequacy originates from the Directive, which prohibits the transfer of personal data to countries outside of the European Economic Area unless "adequate" measures are put in place to protect the data. One such measure is an "adequacy" declaration by the European Commission (“Adequacy Finding”), which normally follows an initial finding by the Article 29 Working Party that the country in question has a legislative regime imposing adequate data protection safeguards to ensure personal data imported from the EU is processed lawfully and securely.
What this means
Obtaining an Adequacy Finding therefore has great significance, helping adequate countries to attract more business from entities with a European presence. Not only does an Adequacy Finding enable data flows for the country in question with European businesses, it also increases a country’s standing on the international stage, by acting as a public declaration of the stringency of that country's national data protection laws. Accordingly, the Article 29 Working Party’s opinion is great news for New Zealand and represents an important step towards an Adequacy Finding by the European Commission - which will hopefully be forthcoming soon.
Other adequate territories
The growing importance of an Adequacy Finding is seen by the number of countries seeking it. The countries officially declared as adequate are Andorra, Argentina, Canada, Faeroe Islands, Switzerland, the Bailiwicks of Guernsey and Jersey, the Isle of Man and most recently Israel. Uruguay is currently in the final stages of the process, whilst Australia and Japan are looking to be recognised as adequate. An Adequacy Finding is a mark that such jurisdictions take data protection seriously and offer a stable and safe environment to which data can be entrusted.
The Article 29 Working Party’s opinion is available at http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2011/wp182_en.pdf