The European Commission’s data privacy working group (the Article 29 Working Party) recently issued an Opinion finding New Zealand’s data privacy legislation (the Privacy Act 1993) ensures an ‘adequate’ level of protection for personal data.  If the European Commission follows this Opinion in its official adequacy decision (as they are likely to do), New Zealand will join Andorra, Argentina, Canada, Faeroe Islands, Guernsey, Israel, Jersey, the Isle of Man and Switzerland on the list of non-European Economic Area (EEA) countries to which personal data may be exported without falling foul of the export rules and restrictions under European wide privacy law.

If New Zealand is officially declared ‘adequate’ by the European Commission, this will offer EEA data exporters a simple and reliable route to complying with European export rules for data exports to New Zealand.  The main alternatives (entering into the European Commission approved Standard Contractual Clauses or establishing intra-group Binding Corporate Rules) require considerable administrative effort, time and costs.  Even reliance on the Safe Harbor option for export to relevant US companies is becoming more challenging since regulators started to question the compliance efforts of Safe Harbor certified organizations.  Most prominently, the German regulators explicitly require exporting companies to conduct diligence on their importer’s Safe Harbor compliance.

It should be noted that general obligations for outsourcing and data transfer applicable within the EEA still apply with respect to countries that have been declared ‘adequate’.  Exporting to an adequate country, however, is a much more convenient option compared to non-adequate countries.  It is no surprise, therefore, that non-EEA countries wanting to open themselves up to European (and flow though) business push hard for adequacy decisions.  As with Israel which was also declared adequate earlier this year, New Zealand’s positive Article 29 Working Party Opinion comes after a major overhaul of its privacy rules and a long wait. 

Though the European Commission is yet to make its official decision, the Opinion of the Article 29 Working Party is a very important step in the process.  It therefore now seems likely that the European Commission’s official decision will be a positive one for New Zealand.  This will be good news for companies working with New Zealand based service providers or group companies, who should find their administrative and compliance costs reduced.  It also opens up New Zealand’s outsourcing and information services industries, make their competitive and reliable industry players more accessible and a valuable option for foreign companies doing business in the region.