Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Amy Ryburn
The Biometrics Processing Code is here
Following several years of consultation, a Biometrics Processing Code 2025 (Code) has been released under the Privacy Act 2020. Organisations that want to start collecting biometric information (ie information about how an individual looks, moves or behaves) will need to consider and apply the Code from 3 November 2025. Organisations that already collect biometric information will have until 3 August 2026 to align with the Code. What does the Code apply to?
MBIE consulting on a proposed 5th edition of the Government Procurement Rules
Economic Growth Minister Nicola Willis announced on 12 March 2025 proposed changes to Government Procurement Rules (Rules), with public consultation on the draft Rules open until 8 April 2025. The Rules provide government agencies with the Government’s standards of good practice for government procurement.
Preliminary agreements
Click here to watch the video There are lots of reasons why contracting parties may enter into a preliminary, limited-scope agreement that contemplates a more detailed agreement at a later date to cover the substance of a project or transaction. In this webinar Amy Ryburn (partner) and Elizabeth Rose (senior associate) covered: What are the various types of preliminary agreements and what makes them special or different from any other type of contract?
Cyber security: What's happening in Australia
A Cyber Security Bill 2024 (Cyber Bill) has been tabled in Australia's Federal Parliament. The Cyber Bill sets out a legislative framework to help address broad, whole-of-economy cyber security issues and to enable the Australian Government to respond to new and emerging cyber security threats. It is part of a broader package of Australian cyber security reforms, including in relation to its existing security requirements on Government intelligence and critical infrastructure.
Small but potentially helpful changes to the Privacy Act
For those who missed it in the blur of the school holidays, a Statutes Amendment Bill was introduced to Parliament (Statutes Amendment Bill) at the end of September. The Statutes Amendment Bill is an omnibus Bill that includes changes to over 40 different Acts, including the Privacy Act 2020 (Privacy Act). The amendments proposed to the Privacy Act are relatively minor but provide some helpful insights or clarification for those needing to interpret the Privacy Act.
Poupou Matatapu - OPC guidance finalised
The Office of the Privacy Commissioner (OPC) has released its Poupou Matatapu online toolkit. The toolkit is intended to provide agencies with an overview of the OPC's expectations as to what good privacy practice looks like and how agencies can work towards achieving that. Poupou Matatapu is comprehensive and we consider that it is likely to be an important touchstone for businesses and other agencies when they are designing or reviewing their own privacy practices, or engaging with the OPC.
Regulatory update: Cabinet paper on strategic approach to work on artificial intelligence
Late last week, the Office of the Minister of Science, Innovation and Technology proactively released a paper submitted to Cabinet addressing New Zealand's approach to working with artificial intelligence (AI). The Cabinet paper notes that New Zealand has been uncharacteristically slow to embrace AI and identifies confidence and capability as key factors inhibiting the rate of domestic AI adoption, particularly compared to peer countries.
Regulation of algorithm use in New Zealand government processes
In recent decades the New Zealand government has made openness and transparency one of its key policy objectives regarding its collection, use, and sharing of data. Since 2011, a framework of principle-led policies has been developed that build on these core principles, including policies aimed at ensuring that government agencies can responsibly harness the incalculable benefits of "big data" and algorithmic analysis, while preserving public trust in government processes and systems.
Poupou Matatapu - OPC consultation on what doing privacy well looks like
This year is shaping up to be a big year for privacy compliance and data protection. Over the last few months, we've seen a draft Biometrics code, a Privacy Amendment Bill, and draft Customer and Product Data Bill in Parliament. Following on from this, last Friday the Office of the Privacy Commissioner (OPC) issued draft guidance to help agencies "do privacy well". The guidance is titled Poupou Matatapu (Poupou meaning posts or pillars and Matatapu meaning privacy).
Consultation open on draft Biometric Processing Privacy Code
The Office of the Privacy Commissioner (OPC) has recently released a draft Biometric Processing Privacy Code (Code) for public consultation. The consultation period closes on 8 May 2024. The Code proposes legal obligations on agencies that carry out automated processing of biometric information. With biometric processing rapidly becoming common place, this is an important opportunity for agencies to engage with this legislative change. What is biometrics?
Clarity still needed on exercising contractual discretions in New Zealand
The extent to which a party's discretions under a contract are fettered by standards of reasonableness has long been a source of debate. A New Zealand Court of Appeal judgment last year, together with a couple of subsequent judgments, have suggested that New Zealand law on this issue may be evolving. In this article, we take a look at the recent judgments and what they may mean in the future for contracting parties. The Woolley appeal - what was the case about?
Collaborative contracting in the public sector
Click here to watch the video Collaborative contracts are a category of contracts under the Government Procurement Rules. There are a broad range of these contracts available for public sector agencies to use. While they are often referred to as "all of government" contracts, AoG contracts are in fact only one category of collaborative contracts currently in place which public sector entities can use.
Review of facial recognition technology
The Privacy Commissioner has announced an inquiry into Foodstuffs' trial of facial recognition technology (FRT) in 25 of its North Island supermarkets. The inquiry demonstrates the Privacy Commissioner's interest in the use of biometrics and its outcome will likely need to be considered by agencies in relation to their own use of FRT.
Substantial AI regulation - EU first off the blocks
On 13 March 2024 the European Parliament passed the Artificial Intelligence Act (AI Act). This is a world-first attempt at substantially regulating the use of AI and provides a good indication of how regulation may develop around the world. The use of AI is rapidly expanding. As in many areas of technology or science, the creation of new tools and techniques leads to moral and philosophical questions about how these things should be used – just because we can doesn’t mean we should.
Service provider privacy breaches - three key lessons from the first three years of mandatory notifications
It's almost three years since the Privacy Act 2020 (Act) introduced a mandatory notification regime for privacy breaches that "have caused, or are likely to cause, serious harm". Unfortunately, there have also been plenty of opportunities to apply the new regime given the continuing rise in cyber incidents affecting New Zealand organisations.
Webinar - Dealing with data in services contracts
Click here to watch the video Dealing with data - drafting and negotiating provisions to address data risk in services contracts Many services arrangements will now involve the transfer, processing, storing and/or use of significant data sets. However, when you're working with basic services agreement templates that need tailoring or bolstering to deal with data risks, it can be challenging to identify what clauses might need to be included and why.
Amendment to the Privacy Act 2020 proposed
Agencies (eg companies and public sector agencies) that are subject to the New Zealand Privacy Act 2020 (Privacy Act) should take note of the introduction of the Privacy Amendment Bill (Bill) this week. The Bill seeks to address a perceived gap in the Privacy Act in relation to what happens when an agency collects personal information about an individual other than from the individual concerned (ie where personal information is collected from another agency).
Webinar - Unfair contract terms in B2B contracts
Click here to watch the video 16 August 2023 marked one year since the extension of the unfair contract terms regime in the Fair Trading Act 1986 to standard form business-to-business contracts, came into force. In a recent webinar, Amy Ryburn (partner) and Anna Parker (special counsel) provided guidance for those grappling with questions like: How do you identify whether the regime applies to the contracts you're using? How should you approach the contract review task? Who needs to be involved?
The problem of scope in commercial contracts
Earlier this year, the global organisation World Commerce & Contracting (World CC) released a report provocatively titled “Most Important Terms 2022/23 – Negotiating for marriage or divorce?” which looked at the clauses most frequently negotiated and those which were viewed as the most important. The survey that led to the report was extensive - the report draws on data from 1,305 organisations throughout 59 countries and from an even mix of suppliers and customers.
Refresh of the Cloud First policy
In April 2023, Cabinet endorsed an update to the Government's "Cloud First" policy.
Reviewing SaaS terms - where on earth should a customer start?
Most organisations buying software for their business uses will be looking at Software as a Service (SaaS) solutions. SaaS solutions have a number of advantages, not the least being that they typically avoid having to spend large amounts of money to buy a new version of the software every few years, allowing customers the ability to spread cost as opex over a number of years.
MBIE releases consultation on draft Customer and Product Data Bill
The Ministry of Business, Innovation and Employment (MBIE) has recently released an exposure draft of the Customer and Product Data Bill (the Bill) for consultation, which would establish a consumer data right (CDR) in New Zealand. MBIE are seeking feedback on the exposure draft and how this new system for consumer data protection should work.
Privacy Commissioner guidance on the use of AI
Key takeaways The guidance highlights a number of key risks for businesses in relation to the use of generative AI: Generative AI typically requires the user to input data for that AI tool to operate. The inputted data may be used for a number of reasons, including to provide the user's requested response and to train the generative AI tool for future requests (including requests from other users).
IT security - the devil is in the detail
Cyber security and data protection are often the biggest concerns for organisations when contracting with ICT suppliers. Security breaches can have major financial, business and reputational impacts. Following the well-publicised ransomware attack on the Waikato DHB in 2021, the Ministry of Health is investing an additional NZ$75.7m over three years on cyber security. The Reserve Bank was subjected to a significant cyber-attack in early 2021.
Privacy Commissioner guidance on use of AI
The Privacy Commissioner has released guidance on his office's expectations regarding the use of generative artificial intelligence (AI) by businesses that are subject to the Privacy Act 2020 (Privacy Act).
Changes to Privacy Act on the horizon
Last week saw the Office of the Privacy Commissioner run another successful Privacy Week. While there were a number of interesting sessions held during the course of the week, our key takeaway was that organisations doing business in New Zealand should expect future changes to the Privacy Act 2020 (Privacy Act). We see three key drivers for change: 1.
Privacy and data protection: What will 2023 bring?
While the Privacy Commissioner announced late last year that it will undertake further consultation and “targeted engagement” in relation to a new Code of Practice for Biometrics this year, the outcome of the indirect collection consultation process is ongoing. However, it is likely that this will involve some amendment to the Privacy Act.
Privacy and data protection: what will 2023 bring?
With 2022 now in the rear view mirror, we've been thinking about what lies ahead for privacy and data protection in 2023, and have outlined what we see as five key themes to watch out for: 1. Reform of the New Zealand Privacy Act?
How fair are your standard B2B terms?
From 16 August 2022, the unfair contract terms (UCT) regime under the Fair Trading Act 1986 will be extended to standard form small trade contracts.
United Kingdom Government procurement law reform: a brief comparison to New Zealand
The United Kingdom (UK) is revising the laws that apply to Government agencies' procurements. While the UK's proposed approach has similarities to New Zealand, there are also significant differences. One which is likely to be of interest to agencies here is the UK's proposed transparency and information sharing requirements, which are more extensive than in New Zealand. The current UK procurement laws are based on EU directives.
COVID-19 - Do competition and consumer laws still apply? | Lexology
New Zealand
March 31 2020 The escalation of the response to COVID-19 has raised questions about how competition and consumer laws apply in extraordinary and challenging circumstances such as this.
Artificial intelligence and the regulatory landscape | Lexology
On 19 February 2020 the European Commission released a white paper on Artificial Intelligence (AI) which sets out the approach the Commission proposes to take as this new technology evolves. This provides an opportunity to reflect on the approach which may be taken in New Zealand and other jurisdictions.
Consumer data rights at a glance | Lexology
Australia, New Zealand
March 16 2020 On 6 February, the Australian Competition & Consumer Commission's (ACCC) Competition and Consumer (Consumer Data Right) Regulations (the Rules) came into effect. The Rules set out details of how the ACCC's consumer data and product data rights will work.
MBIE releases updated Government model contracts | Lexology
New Zealand
February 21 2020 Earlier today the procurement functional lead (the Chief Executive of the Ministry of Business, Innovation and Employment) issued the new versions of the Government model contract templates and an updated user guide. The new templates (version 3) can be found here. The templates have been updated to make a number of improvements, including changes to reflect the updated Government Procurement Rules which came into force in October last year.
Privacy 2.0 - California comes to the party | Lexology
New Zealand, USA
January 21 2020 On 1 January 2020 the California Consumer Privacy Act 2018 (CCPA) came into effect.
Australia welcomes the new digital age | Lexology
Australia
January 13 2020 The Australian Government late last year announced its roadmap for reform to better regulate online social engines, social media and digital content aggregators (Digital Platforms) in Australia, such as Facebook. This follows on from the 18-month Digital Platforms Inquiry (Inquiry) conducted by the Australian Competition and Consumer Commission (ACCC).
Unfair commercial practices - First High Court declaration and stronger laws to come | Lexology
New Zealand
November 27 2019 The High Court recently made its first declaration that the terms of a standard form consumer contract are unfair under the Fair Trading Act 1986 (FTA) in the case Commerce Commission v Home Direct Limited [2019] NZHC 2943 (Home Direct case). The judgment is particularly timely, as it comes shortly after the Government's announcement of new measures to target unfair commercial practices.
Guidelines on the long arms of the GDPR | Lexology
European Union, New Zealand
November 25 2019 The European Data Protection Board adopted a final version of the Guidelines on Territorial Scope (Guidelines) on 12 November 2019. The Guidelines are intended to set out a common interpretation of the EU General Data Protection Regulation (GDPR) for data protection authorities in the EU when determining whether or not processing of personal data by companies or organisations outside the EU falls within the scope of the GDPR.
IAPP Summit top takeaways | Lexology
Australia, New Zealand
November 1 2019 Earlier this week, Alex Chapman of Buddle Findlay's TMT team attended the first International Association of Privacy Professionals Australia and New Zealand summit in Sydney. The conference included a number of interesting speakers who touched on a range of privacy and data issues.
Government Procurement Rules: Open for consultation | Lexology
New Zealand
February 15 2019 The Ministry of Business, Innovation and Employment (MBIE) has released a draft version of the fourth edition of the Government Procurement Rules for consultation.
All's fair in love and war, but maybe not in business - Get your submissions in | Lexology
The New Zealand consumer law landscape looks set to shift again. Submissions close on 25 February 2019 on a discussion paper that explores whether existing protections against unfair practices should be extended. Why suggest reform? Existing laws already prohibit certain 'unfair' practices in both business-consumer and business-business contexts.
Termination for convenience in ICT contracts: It isn’t always that convenient | Lexology
New Zealand
February 7 2019 When ICT projects fail (and it has been reported in the past that two thirds of projects in New Zealand are failing) the customer's first reaction is often to look at terminating for breach.
Legal update on TMT - November 2018 - Extra territorialreach of the GDPR tested | Lexology
The United Kingdom's Information Commissioner's Office (ICO) has issued the first formal enforcement notice under the European Union's General Data Protection Regulation (GDPR). The enforcement notice has been issued against AggregateIQ Data Services Limited (AggregateIQ), a data analytics provider based in Canada. This is the first action taken by the ICO outside of the United Kingdom.
Legal update on TMT - November 2018 - The Office of the Privacy Commissioner moves to Azure | Lexology
The Office of the Privacy Commissioner (the OPC) is moving to Microsoft Office 365 and Azure cloud services (delivered from Australia) and has released its privacy impact assessment (PIA) of these services. The PIA sets out the OPC's assessment of the key privacy risks and how the OPC was satisfied that it could mitigate those risks (including a comparison with the risk of continuing to use an on-premise solution).
Legal update on TMT - November 2018 - What’s the point of a warranty period in a SaaS contract? | Lexology
We are increasingly seeing significant gaps between suppliers and customers of SaaS contracts in relation to their expectations about the purpose and effect of contractual warranty periods. The use of warranties and warranty periods in on-premise software licences is long-standing.
Legal update on TMT - November 2018 - Can GDPR and blockchain get along? | Lexology
Blockchain technologies are increasingly being promoted as a potential solution to a variety of data processing operations, largely due to blockchain's features of immutability, anonymity and decentralised control. For those still unfamiliar with the concept, we have written about it in the past. However, for those businesses who are currently or are considering utilising blockchain technologies, consideration may need to be given to the consistency between blockchain and applicable privacy law.
Legal update on TMT - November 2018 - Can I interest you in a firewall for your toaster? | Lexology
In September, the California state legislature enacted two identical bills regulating Internet-connected devices sold in California, aimed at developing minimum security standards for devices that make up the 'Internet of Things', or 'IoT'. The bills are among the first regulatory measures to be implemented worldwide that are specifically aimed at hastening the industry's response to the threat of IoT-based cyber-attacks.
Microsoft vs the United States of America - law enforcement access to cloud data | Techblog
In 2018 the United States (US) Supreme Court will consider an important case regarding law enforcement's ability to access information stored in the cloud. This case will help determine the extent to which US law enforcement agencies may be able to access your data, regardless of what country it is stored in. Case history The case began in 2013, when Microsoft was issued a search warrant requiring it to provide content from an email account that was thought to be linked to drug trafficking.
Microsoft vs the United States of America - law enforcement access to cloud data | Lexology
In 2018 the United States (US) Supreme Court will consider an important case regarding law enforcement's ability to access information stored in the cloud. This case will help determine the extent to which US law enforcement agencies may be able to access your data, regardless of what country it is stored in. The case began in 2013, when Microsoft was issued a search warrant requiring it to provide content from an email account that was thought to be linked to drug trafficking.
Techblog - Mandatory data breach reporting in Australia
As noted in our article "What's in a name?", mandatory data breach reporting has been on the agenda in New Zealand for some time. While they may have some ground to make up on the rugby field, it is one area where our trans-Tasman cousins have stolen a march on New Zealand.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Amy
Contact Amy, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack