New Zealand - AI Privacy Guidance

Overview

The Office of the Privacy Commissioner (OPC) published detailed guidance titled "Artificial intelligence and the Information Privacy Principles" on 21 September 2023. The guidance explains that the Privacy Act 2020 and the 13 Information Privacy Principles (IPPs) apply to the full lifecycle of AI systems used in New Zealand, including generative AI. The OPC sets clear expectations for organisations considering or using AI: secure senior leadership approval; assess necessity and proportionality; carry out Privacy Impact Assessments (PIAs) and Algorithmic/AI Impact Assessments (AIAs); be transparent with people about AI use; engage with Māori and affected communities; ensure human review for decisions affecting people; and prevent AI providers from retaining or disclosing personal information without lawful basis. The OPC guidance is available on its website and as a full PDF guide (see OPC AI topic page and the full guidance AI and the Information Privacy Principles (PDF)).

Definitions

The guidance uses a broad working definition of "AI tools" to include systems that perform tasks that appear to exhibit intelligent behaviour: machine learning models trained on data, classifiers, interpreters (speech-to-text, image captioning), generative systems (text, image, code) and automated decision systems. "Personal information" is defined in line with the Privacy Act 2020: information about an identifiable individual, including traditional identifiers (name, address), technical metadata (IP addresses, device IDs), and even inaccurate or fabricated data (deepfakes, fake profiles) where a person is identifiable. The guidance distinguishes training data (used to build models), model artefacts (weights, pre-trained models), runtime inputs (prompts, user data) and outputs (responses or decisions), and treats each stage as potentially engaging the IPPs.

Governance and Institutional Framework

The OPC expects organisations to embed AI privacy governance at senior leadership level and to assign clear accountability (privacy officers, data governance leads). Organisations should: (1) obtain explicit senior leadership approval informed by documented risk assessment and mitigations; (2) integrate PIAs/AIAs into project governance and procurement; and (3) include privacy and security conditions in supplier contracts. The guidance encourages cross-functional teams (privacy, legal, cybersecurity, data science, Māori engagement) and recommends that boards and executive teams be briefed about AI risks and compliance obligations. For public sector agencies the guidance aligns with New Zealand public service material such as the Algorithm Impact Assessment user guide and joint system leads' tactical guidance on generative AI — and encourages agencies to follow established procurement, security, and data governance frameworks. The OPC also notes its statutory role: it provides guidance, investigates complaints, may issue compliance notices and works with other agencies on sectoral codes; organisations should engage proactively with the OPC where novel or high-risk uses are contemplated. For further context see the OPC AI guidance and the OPC topic overview at OPC AI topic page.

Key Focus Areas

The guidance organises privacy risk across the AI lifecycle and highlights several focus areas: data sourcing and training (lawful collection, quality and bias risks, consent and purpose-limitation), model development (data minimisation, anonymisation limits, and provenance), operational use (inputs, prompts and inadvertent disclosure of PII), accuracy and fairness (testing, validation, representative datasets), transparency and explainability (clear public information, ability for individuals to understand and challenge decisions), human oversight (effective ‘human-in-the-loop’ design), security (protecting training data, prompts and models from leakage), and contractual safeguards (requirements for third-party AI providers not to retain or repurpose uploaded personal data). The OPC emphasises obligations under particular IPPs: collection and purpose (IPPs 1–4), storage and security (IPP 5), accuracy (IPP 8), limits on use/retention (IPPs 10–13), and disclosure (IPP 11–12). Cultural and equity considerations are central: the guidance recommends proactive engagement with Māori to address taonga data, tikanga, and data sovereignty concerns. The OPC also provides practical questions for each focus area to guide PIAs/AIAs and governance decisions.

Implementation Framework

The guidance recommends a practical implementation framework organisations can follow: (1) scope and purpose — document the intended use, expected benefits, and affected populations; (2) initial risk screen — assess whether the AI use involves personal information or high-impact decisions; (3) PIA/AIA — conduct a formal impact assessment with community engagement, including Māori where relevant; (4) procurement and contracts — include clauses on data handling, retention, deletion, and non-training/secondary-use promises; (5) testing and validation — implement accuracy, bias and robustness testing with representative datasets; (6) deployment controls — impose human oversight, error-reporting and fallback/manual processes; (7) monitoring and incident response — ensure breach detection, notification and remediation capabilities; and (8) documentation and transparency — publish plain-language statements on AI use, data practices and redress routes. The OPC also advises smaller organisations to err on the side of caution: avoid putting personal or sensitive information into third-party AI tools unless contractual and technical safeguards are demonstrably in place.

Monitoring and Evaluation

Monitoring should be continuous and multi-modal: technical monitoring (model performance, drift, error rates), privacy monitoring (access logs, prompt capture, retention checks) and governance monitoring (PIA reviews, contract audits, supplier assurance). The guidance recommends scheduled re-testing, post-deployment audits, incident logging and community feedback mechanisms, and the maintenance of records to demonstrate compliance. Organisations should document evidence of board/executive approvals, PIAs/AIAs, user notices, Māori engagement, testing outcomes, and supplier assurances. Where privacy risks materialise, organisations must follow breach-notification obligations under the Privacy Act and undertake remediation with transparency toward affected people.

Penalties, Liability, and Appeals

The OPC guidance is non-binding but sits within the enforcement architecture of the Privacy Act 2020. Organisations that fail to meet statutory obligations may face OPC investigations, compliance notices, published findings, and potential referral to the Human Rights Review Tribunal where individuals seek remedies. The Privacy Act contains criminal sanctions for some offences (for example failing to notify the Commissioner of a notifiable privacy breach can attract a monetary penalty), and remedies through tribunals or courts may include compensation and orders to change practices. The OPC emphasises reputational and contractual risks in addition to regulatory consequences and encourages proactive remediation, transparency, and engagement with the regulator to reduce enforcement risk.

Relationship to Other Instruments

The guidance cross-references New Zealand instruments and sectoral rules: the Privacy Act 2020 and associated Codes of Practice such as the Health Information Privacy Code 2020; public-sector AIA guidance and the Algorithm Impact Assessment user guide; procurement and cybersecurity guidance (including CERT NZ and GCSB materials on secure AI); and international instruments and standards (OECD AI principles, EDPB/ICO materials). The OPC positions its guidance as complementary to other statutory and non-statutory frameworks and recommends coordination across legal, human-rights, cyber security, procurement and indigenous-data-governance regimes to manage AI-associated privacy risks coherently.

International Alignment

The OPC situates New Zealand guidance within global developments: it references the alignment of privacy-by-design and transparency principles with international privacy regulators and standards bodies. The guidance acknowledges rapid international work on AI governance (EU AI Act deliberations, EDPB/ICO guidance, and cross-jurisdictional enforcement cooperation) and encourages organisations to track international standards, supplier commitments and model provenance, especially where models or services are provided from overseas. The OPC also highlights transborder data transfer considerations in light of disclosure and cross-border IPP rules and encourages contractual and technical safeguards for overseas processing.

Implementation Timeline

Sources and References