The New Zealand Office of the Privacy Commissioner has released the long-awaited (by privacy lawyers at least!) model agreement for the cross-border transfer of personal information, designed to address the requirements set out in information privacy principle (‘IPP’) 12(1)(f) introduced by the Privacy Act 2020.

What is IPP12(1)(f)?

New IPP 12 applies to all agencies subject to the Privacy Act 2020 in the context of transfers of personal information by that agency to a ‘foreign person or entity’, other than where that foreign person or entity is solely going to hold the information to be transferred as agent for the transferor (such as where the foreign person or entity is an offshore cloud provider).

Where IPP 12 is triggered (that is, in the case of most, but not all disclosures made by the agency in reliance on IPP 11), the agency making the transfer must only make the disclosure to the foreign person or entity if one of the conditions of IPP 12 is satisfied. This includes the condition contemplated by IPP12(1)(f), which is that the transferor:

‘believes on reasonable grounds that [the transferee] is required to protect the information in a way that, overall, provides comparable safeguards to those in [the Privacy Act 2020] (for example, pursuant to an agreement entered into between [the transferor] and [the transferee].’

What does the model agreement do?

Entering into an agreement in the form of the model agreement will go most of the way (but perhaps not all) towards demonstrating that the transferor satisfies the condition contemplated by IPP12(1)(f). The hope is that the model agreement will drastically reduce the transaction cost for small to medium businesses when it comes to complying with the new requirements imposed in respect of cross-border transfers of personal information. As what will no doubt become an ‘industry-standard’ set of contractual terms, that have been implicitly endorsed by the regulator, it would seem that the model agreement looks set to become the benchmark for documenting the exportation of personal information from New Zealand for the foreseeable future – similar to how model clauses have formed the basis for innumerable transfers from Europe to the World, under the GDPR and its predecessor laws.

However, the model agreement is not the be-all-and-end-all when it comes to satisfying the condition set out in IPP12(1)(f). As a transferor, you will still need to be satisfied, on reasonable grounds, that the transferee is required to protect the information in a way that overall provides comparable safeguards to those in the Privacy Act 2020. The transferor cannot be blind to the ‘situation on the ground’ when it comes to the laws to which the transferee is subject, and cannot rely on the contractual protections afforded it by the model agreement in circumstances where it ought to know that, in reality, it could never hope to actually enforce those protections against the transferee (such as in situations where the judicial system in the country in which the transferee is based does not provide for adequate and practically enforceable remedies for contractual breach).

What do we like about the model agreement?

We like:

• The use of plain English drafting: the agreement is clear and easy to read, and generally avoids (where possible) legalese
• The clear guidance, which explains how to deploy the model agreement in user-friendly terms
• The Privacy Commissioner’s use of completed examples to demonstrate how to use the model agreement in practice.

Where to next?

New Zealand agencies looking to rely on the model agreement as a basis for cross-border transfers have until 1 December 2020 (the commencement date of the Privacy Act 2020) to get their ducks in a row. In this regard, all agencies should now be looking at whether or not IPP 12 will be triggered in the context of their business and operations, and if so, whether entry into an agreement on the basis of the model agreement is the best way with which to comply with the new limitations on cross-border transfers. Don’t leave it to the last minute to start discussing with your partners and affiliates with whom you are sharing personal information the way in which you can and will document those arrangements.

We also expect regulations in the near future which will specify the jurisdictions to which personal information may be freely transferred in reliance on IPP12(1)(e), being the ‘prescribed countries’ in respect of which the Ministry of Justice has made an assessment as to the adequacy of their privacy and other laws and the protection afforded to individuals with respect to the treatment of their personal information. While it’s hard to speculate exactly which countries will be ‘prescribed’, it would very much surprise us if all 27 member states of the European Union didn’t find their way on to the list, given the protections offered up by the GDPR.

As for the model agreement itself: we’d love to see the process streamlined even further, to contemplate the automated creation of an agreement through an online portal or similar.

While the use of the model agreement (and in particular, automation) will certainly make documenting cross-border transfers easier, every agency subject to New Zealand privacy law should make sure that they are relying on the model agreement in the right circumstances, for the right reasons, and in the right way: lest any shortcomings result in the agency becoming a ‘model defendant’ for non-compliance with the new Act.