193Prohibition on transfer of personal information outside New Zealand

1. The Commissioner may prohibit a transfer of personal information from New Zealand to another country if the Commissioner is satisfied, on reasonable grounds, that—

2. the information has been, or will be, received in New Zealand from another country and is likely to be transferred to a third country where it will not be subject to a law providing comparable safeguards to those in this Act; and
3. the transfer would be likely to lead to a contravention of the basic principles of national application set out in Part Two of the OECD Guidelines and in Schedule 8 of this Act.

4. In determining whether to prohibit a transfer of personal information, the Commissioner must also consider, in addition to the matters set out in subsection (1) and section 21, the following:

5. whether the transfer affects, or is likely to affect, any individual; and
6. the general desirability of facilitating the free flow of information between New Zealand and other countries; and
7. any existing or developing international guidelines relevant to transborder data flows, including (but not limited to)—
   1. the OECD Guidelines:
   2. the General Data Protection Regulation.

8. Subsection (1) does not apply if the transfer of the information, or the information itself, is—

9. required or authorised by or under any enactment; or
10. required by any convention or other instrument that imposes international obligations on New Zealand.