Plain language law

New Zealand law explained for everyone

 Plain Language Law homepage
Back to
120: Liability for actions of officers, employees, agents, and members of agencies
or “Organisations are responsible for privacy breaches by their staff or agents”
You could also call this:

“Organisations are responsible for privacy breaches known to their staff or agents”

When someone in your organisation knows about a serious privacy problem, the law treats it as if your whole organisation knows about it. This applies to the rules in section 114 and section 115 of the Privacy Act.

If an officer, employee, or member of your organisation knows about a serious privacy problem, the law says your organisation knows about it too. This is true even if the bosses don’t actually know yet.

The same idea applies to people who work for your organisation but aren’t employees. These people are called agents. If an agent knows about a serious privacy problem, the law says your organisation (called the principal agency) knows about it too. This rule applies to all parts of the Privacy Act except for section 118.

This text is automatically generated. It might be out of date or be missing some parts. Find out more about how we do this.

Next up: 122: Publication of identity of agencies in certain circumstances

or “Sharing agency names for serious privacy breaches”
Next

Part 6 Notifiable privacy breaches and compliance notices
Notifiable privacy breaches

121Knowledge of officers, employees, agents, and members of agencies to be treated as knowledge of employers, principal agencies, and agencies

  1. Subsection (2) applies to processes and proceedings under this Act relating to the obligations under section 114 or 115.

  2. Anything relating to a notifiable privacy breach that is known by an officer, an employee, or a member of an agency is to be treated as being known by the employer or agency.

  3. Subsection (4) applies to processes and proceedings under this Act relating to the obligations under section 114 or 115 except a proceeding under section 118.

  4. Anything relating to a notifiable privacy breach that is known by an agent is to be treated as being known by the principal agency.

Notes
  • Section 121 heading: amended, on , by section 98(1) of the Statutes Amendment Act 2022 (2022 No 75).
  • Section 121(2): amended, on , by section 98(2) of the Statutes Amendment Act 2022 (2022 No 75).