This content is for informational and educational purposes only and does not constitute legal advice.
On 17 October 2025, the Auckland District Court issued a ruling against HelloFresh, fining the company NZD 845,000 for misleading subscription practices. The ruling found that HelloFresh breached the Fair Trading Act by misleading consumers into reactivating subscriptions. It was stated that the meal-kit company conducted nearly 1 million cold calls over 18 months, reactivating around 80,000 subscriptions by offering discount vouchers without clarifying that accepting them could restart paid subscriptions. It was also stated that the practices were embedded in HelloFresh’s processes.
On 9 October 2025, the Office of the Privacy Commissioner (OPC) of New Zealand issued a public statement clarifying that the Privacy Act 2020 does not prevent the sharing of information where there is a safety or well-being concern for a child. The statement followed the Government’s acceptance of all recommendations from the 2022 Dame Karen Poutasi Review on changes to improve the system of safety nets for preventing harm in the children's system. It stated that the Oranga Tamariki Act allows lawful information sharing to keep children safe and that Sections 15, 16, and 66C of the Act provide legal protection for those acting in good faith. The Commissioner stressed that urgent concerns about harm should take priority and that good privacy practice ensures information is shared correctly.
On 23 September 2025, the Privacy Amendment Act's provisions on cross-border data transfer regulation entered into force. The Act provides that the Privacy Commissioner may assess the privacy protections in a third country to ensure that that country provides comparable safeguards for the purposes of cross-border data transfers. The Act provides for data transfers on an individual basis and on the basis of membership of a block of countries.
On 22 September 2025, the Governor General of New Zealand signed the Privacy Amendment Bill into law. The Bill provides that the Privacy Commissioner may assess the privacy protections in a third country to ensure that that country provides comparable safeguards for the purposes of cross-border data transfers. The Bill provides for data transfers on an individual basis and on the basis of membership of a block of countries.
On 22 September 2025, the Governor General of New Zealand signed the Privacy Amendment Bill into law, which introduces notification requirements for the indirect collection of personal information. The law requires agencies to notify individuals when collecting personal information from third parties, with exceptions for data collected before 1 May 2026. The notification must also include the purpose for the collection and the intended recipients of the information. The individual must be made aware of the name and address of both the collecting and the holding agency. If the collection is required by law, the specific law must be identified. The individual must also be informed of their rights to access and correct their information. The notification should occur as soon as reasonably practicable after the collection. The requirement does not apply if the individual is already aware of all these matters. There are several exemptions where notification is not necessary, including situations where non-compliance would not prejudice the individual's interests, the information is publicly available, or notification would prejudice law enforcement, public safety, security, or international relations.
On 18 September 2025, the Parliament of New Zealand adopted the Privacy Amendment Bill (No. 292-1), which proposes amendments to the Privacy Act 2020. The Privacy Amendment Bill clarifies in Part 2 that the Privacy Commissioner may assess the privacy protections in a third country to ensure that that country provides comparable safeguards for the purposes of cross-border data transfers, both on an individual basis and on the basis of membership of a block of countries.
On 18 September 2025, Parliament adopted the Information Privacy Principle (IPP) 3A in the Privacy Amendment Bill, which introduces notification requirements for the indirect collection of personal information. The agency must take reasonable steps to inform the individual that their information has been collected. This notification must also include the purpose for the collection and the intended recipients of the information. The individual must be made aware of the name and address of both the collecting and the holding agency. If the collection is required by law, the specific law must be identified. The individual must also be informed of their rights to access and correct their information. This notification should occur as soon as reasonably practicable after the collection. The requirement does not apply if the individual is already aware of all these matters. There are several exemptions where notification is not necessary. These exemptions include situations where non-compliance would not prejudice the individual's interests, the information is publicly available, or notification would prejudice law enforcement, public safety, security, or international relations.
On 11 August 2025, the Privacy Commissioner issued guidance on the use of images under the Privacy Act 2020. The Commissioner confirmed that photographs qualify as personal information when they identify an individual. Agencies are expected to be transparent when collecting, using, or sharing such information, and commercial agencies must do so fairly and without unreasonable intrusiveness, even in public places. The guidance also stressed that the fact that personal information is publicly available does not automatically make its use or disclosure fair or reasonable. Agencies must assess factors such as the sensitivity of the image and the potential impact on the individual. The Commissioner further recommended that agencies wishing to use photographs for commercial purposes obtain consent both for taking the photographs and for their intended use. However, the guidance clarified that the Privacy Act does not apply to the collection and reporting of news and current affairs by news media.
On 8 July 2025, the Ministry of Business, Innovation and Employment adopted the Artificial Intelligence (AI) strategy focusing on investing with confidence to drive AI adoption and economic growth. The strategy aims to boost productivity in key sectors including agriculture, healthcare, education, and tourism. The strategy applies to both public and private sectors, addressing the low uptake among small and medium enterprises and principles-based policy aligned with Organisation for Economic Co-operation and Development's AI Principles. It also focuses on responsible AI guidance for businesses, and public sector leadership in AI use. The strategy also promotes international collaboration, including investment attraction, and commits NZD 1.2 billion annually to science, innovation, and technology.
Last updated: 17/10/2025