Reading time: 5 minutes

In New Zealand, if your business handles personal information, then you are an agency under the Privacy Act. Therefore, you need to deal with this personal information in line with your obligations as an agency transparently and responsibly. You will collect a lot of personal data from your customers online and use this data for your own purposes. But, who owns this data? In New Zealand, your privacy obligations as an agency apply regardless of who owns it. Data ownership itself can become complex very quickly, especially when it regards personal information. For some guidance, this article will explain who owns the personal data your New Zealand business keeps.

Your Privacy Obligations When You Hold Personal Data

Personal information is any kind of information you can use to identify a living individual. When your business deals with this kind of information, whether online or offline, you are an agency under privacy law. Therefore, you need to handle this data according to the principles the Privacy Act prescribes. These principles regulate data:

  • collection;
  • usage;
  • storage;
  • access
  • security;
  • disclosure; and
  • disposal.

When you collect customers’ personal information, you need to tell them:

  • that you are doing so;
  • why you are doing so;
  • how you will use their information;
  • who has access to their information;
  • whether any laws apply;
  • whether they can choose not to share their personal information;
  • the consequences of this choice; and
  • your contact details for privacy concerns.

When you collect personal information, you need to do so with an identifiable purpose and communicate this to your customers. If you want to change this purpose or share personal information with third parties, you generally need the relevant person’s permission.

If there is a privacy breach, you need to notify any affected individuals if it is likely to cause them serious harm.

How Does the Privacy Act Relate to Data Ownership?

The idea of “personal information” is broad and can apply to all kinds of different data. It can include:

  • names;
  • images;
  • email addresses; or 
  • financial details.

The Privacy Act does not focus on ownership of this information. Instead, it imposes responsibilities on any entity that deals with this information to ensure the individuals’ privacy is secure and their personal data is safe. Therefore, a person does not automatically have ownership over their data just because it is about them under privacy law.

However, this does not mean that you have complete control over how you can use the personal data your business stores, as you would with data that you own. As the section above details, you are subject to certain restrictions and obligations that protect the rights of your customers.

For example, when you ‘own’ data, a benefit of this is that you can exclude others from having access to that data because you do so. However, individuals have a right to access any personal information about them that you store, reducing your control over the relevant data. You can only refuse access if you have a legitimate and legal reason to do so.

Who Owns the Personal Data My Business Keeps?

Personal data is a type of information, which means it can appear in many different forms. These include:

  • emails;
  • databases;
  • reports;
  • recordings;
  • notes; or
  • photos.

Therefore, you do not necessarily own the personal data your business keeps, but you will likely own the document or file that you find it in.

For example, your reports may refer to customers or employees by name or include their images. They have privacy rights that regulate how you can distribute or share this information, but you will likely have intellectual property rights to the report itself.

If you breach the Privacy Act and do not handle personal information according to its principles, you may have to destroy any relevant personal information you store as compensation. This depends on:

  • how severe your breach was;
  • what the affected individual wants you to do with their personal information; and
  • the kind of penalty that is appropriate for the situation

Potential Intellectual Property Concerns

If you ever have any disputes or issues regarding personal data ownership rights, it will likely become an intellectual property matter. Whoever owns the data will be the person or business with inherent or registered intellectual property rights over that data. These rights may include:

  • copyright;
  • patents;
  • designs;
  • trade marks;
  • plant variety rights; or 
  • geographical indications.

If you licence your IP, then it may be a good idea to include privacy requirements in that licence if it includes personal information.

Key Takeaways

New Zealand privacy law does not give people ownership over their personal data. Instead, it imposes restrictions on agencies like your business that handle it. Subject to IP considerations, you will likely own the form that the personal information expresses itself. However, this ownership has some restrictions when an individual wants to exercise their privacy rights. 

If you would like more information or guidance around personal data and ownership, contact LegalVision’s data, privacy, and IT lawyers on 0800 005 570 or fill out the form on this page.

Frequently Asked Questions

What is personal information?

Personal information is any data about an identifiable individual. Therefore, if you can use this data to identify a living person, then it is personal data. For example, names or email addresses.

Do individuals own their personal data in New Zealand?

Individuals do not necessarily own their personal data, or data that can identify them. On the contrary, they have various rights they can exercise in relation to that data. Therefore, agencies that store any personal data also need to meet their legal obligations around data privacy.

About LegalVision: LegalVision is a tech-driven, full-service commercial law firm that uses technology to deliver a faster, better quality and more cost-effective client experience.

The majority of our clients are LVConnect members. By becoming a member, you can stay ahead of legal issues while staying on top of costs. From just $119 per week, get all your contracts sorted, trade marks registered and questions answered by experienced business lawyers.

Learn more about LVConnect

Need Legal Help? Get a Free Fixed-Fee Quote

If you would like to receive a free fixed-fee quote or get in touch with our team, fill out the form below.

Our Awards
  • 2019 Top 25 Startups - LinkedIn 2019 Top 25 Startups - LinkedIn
  • 2020 Excellence in Technology & Innovation – Finalist – Australasian Law Awards 2020 Excellence in Technology & Innovation Finalist – Australasian Law Awards
  • 2020 Employer of Choice – Winner – Australasian Lawyer 2020 Employer of Choice Winner – Australasian Lawyer
  • 2021 Fastest Growing Law Firm - Financial Times APAC 500 2021 Fastest Growing Law Firm - Financial Times APAC 500
  • 2021 Law Firm of the Year - Australasian Law Awards 2021 Law Firm of the Year - Australasian Law Awards
  • 2020 Law Firm of the Year Finalist - Australasian Law Awards 2020 Law Firm of the Year Finalist - Australasian Law Awards