On 01 December 2020, a new Privacy Act 2020 (Act) came into effect in New Zealand, replacing the Privacy Act 1993.  The new Act clarifies that any agency carrying on business in New Zealand will be subject to the obligations in the Act, even if it has no physical presence in New Zealand.  

One of the key changes the new Act introduces is a mandatory data breach notification regime.  The regime requires agencies to notify privacy breaches to the Privacy Commissioner and affected individuals where the breach has caused, or is likely to cause, serious harm.  Practically, this means that businesses and organisations will need to have internal processes in place so that an assessment can be carried out as to whether a privacy breach requires reporting, should a breach occur. 

The Act also introduces more comprehensive controls on the disclosure of personal information overseas.  Broadly, the overseas entity/person the personal information is being disclosed to must be subject to similar safeguards as those required by the Act.  If the relevant jurisdiction does not have similar safeguards in place, the individual to whom the personal information relates must authorise the disclosure after being expressly informed that the overseas entity/person may not be required to adequately protect the information. Businesses and organisations can comply with the overseas disclosure obligations in the Act by including contractual safeguards in their contracts with offshore parties.

From an enforcement perspective, the Act creates some new criminal offences including those relating to the destruction of personal information by an agency or the impersonation of an individual for the purposes of accessing their personal information.  The Privacy Commissioner is also now able to issue compliance notices requiring an agency to take (or refrain from taking) certain actions in order to comply with the new Act.

Julika Wahlmann-Smith, Senior Associate, Janou Kannangara, Solicitor

 Mainzeal decision

The Court of Appeal has recently delivered its judgment in the highly publicised Mainzeal litigation (Yan v Mainzeal Property Construction Limited (in liquidation) [2021] NZCA 99).  The Mainzeal proceedings were brought by the liquidators of Mainzeal Property and Construction Limited (Mainzeal), a large construction company that was placed into liquidation in 2013, leaving unsecured creditors with outstanding claims in excess of NZ$110M.  The liquidators sought compensation against the former Mainzeal directors for breaches of their duties under sections 135 and 136 of the Companies Act 1993.

The Court of Appeal upheld the High Court’s finding that the directors had breached of section 135 by allowing the business of the company to be carried on in manner likely to create a substantial risk of serious loss to Mainzeal’s creditors.  However, the Court disagreed with the High Court’s basis for determining the compensation payable by the directors for this breach.  As there was no net deterioration in Mainzeal’s financial position between the date on which the liquidators asserted Mainzeal should have ceased trading and the date it was placed into liquidation, the Court held that no loss was attributable to the breach.  The Court therefore rejected the “entire deficiency” approach applied by the High Court (under which the entire loss on liquidation is recoverable) as an appropriate basis for determining compensation for breach of section 135 in the circumstances of the case.  The Court also considered that the “new debt” approach (see below) was unsuitable for determining compensation for a breach of section 135. 

The Court of Appeal also differed from the High Court in finding that the directors had breached section 136 of the Act by agreeing to Mainzeal to incurring obligations without reasonable grounds for believing that it would be able to perform those obligations.  The Court considered that the “new debt” approach was appropriate for determining compensation for the breach of section 136.  Continuing to trade should only be considered if there is a realistic prospect of enabling the company to meet both existing debt and any new commitments (i.e.no “robbing Peter to pay Paul”).  Accordingly, the directors were held liable for all new debt incurred in breach of the duty which remained unpaid at liquidation.  The Court referred the case back to the High Court to determine the quantum of damages for this breach.   

Erich Bachmann, Partner, Janou Kannangara, Solicitor