New Zealand Outlined in Government press Notify all data Personal information, Expected that Lower — ‘material’ proposed release law changes to breaches to the Privacy defined to mean Commissioner will notification ‘Privacy scheme strengthen protection’, 28 May Commissioner information about an have full range of threshold 2014 identifiable individual existing powers Notify both the Privacy Two-tier available Commissioner and affected notification individuals where the breach system carries a real risk of harm OECD OECD Privacy Framework Notify a national authority Personal data, defined as N/A Lower Guidelines (2013) of security information relating to notification — ‘significant international breaches’ an identified or threshold guidance identifiable individual Notify both a national Two-tier material (not authority and individuals notification binding) where a significant security system breach is likely to adversely affect those individuals
New Zealand — proposed scheme Outlined in Government press release ‘Privacy law changes to strengthen protection’, 28 May 2014 Notify all ‘material’ data breaches to the Privacy Commissioner Notify both the Privacy Commissioner and affected individuals where the breach carries a real risk of harm Personal information, defined to mean information about an identifiable individual Expected that Commissioner will have full range of existing powers available Lower notification threshold Two-tier notification system OECD Guidelines — international guidance material (not binding) OECD Privacy Framework (2013) Notify a national authority of ‘significant security breaches’ Notify both a national authority and individuals where a significant security breach is likely to adversely affect those individuals Personal data, defined as information relating to an identified or identifiable individual N/A Lower notification threshold Two-tier notification system
Consultation-draft-data-breach-notification-2015-discussion-paper.DOCX