New Zealand

An agency must notify the Privacy Commissioner as soon as practicable after becoming aware that a notifiable privacy breach, one reasonably believed to have caused serious harm to an affected individual or to be likely to, has occurred. It must also notify each affected individual, or give public notice where individual notice is not reasonably practicable, unless a section 116 exception applies or a permitted delay is in effect.

An agency that, without reasonable excuse, fails to notify the Commissioner commits an offence carrying a fine of up to $10,000.

If an agency collects personal information about an individual from a source other than that individual, such as a third-party dataset or a scrape of another site, it must take reasonable steps to make the individual aware, as soon as practicable, of the fact and purpose of collection, the intended recipients, the collecting and holding agency's identity, any legal authority for the collection, and the individual's access and correction rights.

The duty does not apply where the individual has already been made aware of these matters by any means, or to personal information collected before 1 May 2026.

Binds a New Zealand agency for any action taken anywhere in respect of personal information it collects or holds, and an overseas agency for any action taken in the course of carrying on business in New Zealand, which section 4(3) confirms does not require a commercial operation, a New Zealand place of business, payment, or a profit motive.

Information privacy principle 1 confines collection to what is necessary for a lawful purpose connected with the agency's function, information privacy principle 2 requires collection directly from the individual concerned subject to listed exceptions including that the source is a publicly available publication, and information privacy principle 13 limits an agency's assignment of unique identifiers to what is necessary to carry out its functions.

An agency may disclose personal information to a foreign person or entity only where the individual authorised the disclosure knowing the recipient may not provide comparable safeguards, or the agency reasonably believes the recipient is itself subject to the Privacy Act 2020, subject to comparable overseas privacy laws, a participant in a prescribed binding scheme, subject to a prescribed country's laws, or otherwise contractually bound to provide comparable safeguards.

The condition does not apply where reliance is on the law-enforcement or research-and-statistics disclosure grounds of information privacy principle 11 and compliance is not reasonably practicable.

The Privacy Commissioner may issue a compliance notice requiring an agency to remedy a breach of the Act, an interference with privacy, or a breach of a code of practice, and an agency issued with one must take steps to comply as soon as practicable; if the agency has not remedied the breach after the appeal period, the Commissioner may take enforcement proceedings in the Human Rights Review Tribunal.

Separately, section 212 makes it an offence, on conviction carrying a fine of up to $10,000, to obstruct or mislead the Commissioner, make a false statement, falsely claim authority under the Act, impersonate an individual to obtain or alter their personal information, or destroy a document to defeat an access request.

A person must not make, import, sell, distribute, or advertise a device that circumvents a technological protection measure, provide a service intended to circumvent one, or publish information enabling circumvention, if that person knows or has reason to believe it will be used to infringe copyright in the protected work.

Doing so in the course of business, with actual knowledge rather than mere reason to believe, is a separate offence under section 226C. This targets trafficking in circumvention devices, services, and information rather than the act of a scraper's own access, so it reaches a tool-builder or reseller more directly than a party that merely uses an existing circumvention method to collect data.

Makes it an offence, punishable by up to 2 years imprisonment, to intentionally access, directly or indirectly, any computer system without authorisation, knowing or being reckless as to the lack of authorisation.

The section expressly does not apply to a person who is authorised to access a computer system but does so for a different purpose than the one for which access was given, which leaves open whether accessing a public, unauthenticated page (for which no authorisation was ever required) falls within the offence at all; no reported New Zealand decision has tested a scraping fact pattern under this section.

Sections 42 and 43 permit fair dealing with a work for criticism, review, and news reporting, and for research or private study, but the Act carries no exception for text and data mining, so training a model on scraped copyrighted text must fit one of these narrow purposes or infringe.

Section 2's definition of literary work includes a table or compilation, so a scraped compilation of data can attract copyright as a literary work if its selection or arrangement is original, but the Act contains no separate sui generis database right, so a database that is a mere compilation of facts without originality in selection or arrangement receives no protection.

The Privacy Act 2020's definition of personal information carries no exception for information that is publicly accessible, so an agency, including an overseas agency carrying on business in New Zealand, that scrapes personal information from a public website, including for AI training, must still collect it only for a lawful purpose connected with a function of the agency and only where necessary for that purpose under information privacy principle 1.

Information privacy principle 2 ordinarily requires collection directly from the individual concerned, but excuses that where the information is a publicly available publication, so a scrape drawing on such a publication does not by itself breach the source-of-collection principle even though the information remains personal information for every other purpose of the Act.

A publication classified as restricted may not be supplied, distributed, exhibited, or displayed otherwise than in accordance with its classification, most often an age limit such as 18 years or a younger specified age; doing so is a strict-liability offence, and doing so knowing or with reasonable cause to believe the publication is restricted carries a higher penalty.

Separately, supplying, distributing, exhibiting, or displaying to a person under 18 any publication that would itself be classified objectionable if made available to a person of that recipient's age is an offence where the supplier knows or has reasonable cause to believe this, regardless of whether the publication is objectionable for an adult recipient.

Distribute is defined to include providing access to a publication by means of a public data network, so an online host or platform supplying or displaying content falls within these provisions on the same terms as a physical retailer.

Fair dealing with a work for the purpose of reporting current events by means of a sound recording, film, or communication work does not infringe copyright; fair dealing with a work other than a photograph for reporting current events by any other means does not infringe copyright provided it is accompanied by a sufficient acknowledgement.

Neither subsection creates a blanket exception for a news aggregator's routine reproduction of headlines or extracts; the dealing must still be fair, judged on the specific facts, and directed at reporting current events rather than merely republishing another outlet's content.