LEGAL
Changes to be aware of in the new Privacy Act coming soon‌ A new Privacy Act is coming into force on 1 December 2020. While things will stay largely business as usual, the new Act will introduce some important changes to privacy law in New Zealand that real estate agents and agencies should be aware of. Some of the changes will require planning and preparation to make sure compliance is achievable when the new Act kicks in.
What’s changing? Our current privacy regime makes it clear that personal information must only be collected for lawful purposes, that it must be stored and safeguarded correctly, and that people must have reasonable access to review and edit private information that is held about them. Disclosure of personal information is only permitted in limited circumstances. The new Act is intended to make sure that personal information is kept safe and secure in line with new technology and ways of doing business. Most businesses will need to make some updates to their current privacy practices as a result. The changes will be relevant to all businesses that collect, store, and use personal information about employees and customers. Real estate agencies are a good example of a business that collects a significant amount of personal information about a wide variety of people, from employees to vendor clients to potential purchasers attending open homes. Agencies and agents will need to understand their obligations under the new Act, and make sure they can meet them.
Implement a privacy breach procedure Under the new Act, businesses will need to report serious privacy breaches. A privacy breach is any unauthorised or accidental access to, disclosure, alteration, loss, or destruction of personal information, or
64
|
The Real Estate Institute of New Zealand
Lindsey Smith, Senior Registered Legal Executive, Rainey Collins
an action that prevents the holder from accessing the information. If a real estate agency has a privacy breach that it believes has or could cause serious harm, it will need to notify the Office of the Privacy Commissioner and the affected person or people as soon as possible. Failing to inform the Privacy Commissioner about a notifiable privacy breach will be an offence. Not all breaches will need to be reported, only those that cause serious harm. Determining if a breach has or might cause serious harm will be a case-by-case assessment, taking into account things like disclosure of very sensitive information or to a large number of recipients, and the nature of the harm that might result. The Office of the Privacy Commissioner will be releasing online guidance about the new requirement to notify privacy breaches.
More information collected now than ever before Anti-money laundering requirements have increased the amount of personal information agents need to collect on a regular basis. The current situation with COVID-19 has also resulted in a greater need to obtain information from everybody who is interested in a property, so agents and agencies are dealing with an increasing volume of personal information that needs to be obtained, used, stored, and disclosed correctly. Agents must ensure that they do not obtain, or keep, private information unless it is
