Artificial Intelligence and the Information Privacy Principles

• Authority: Government of New Zealand
• Jurisdiction: Other countries
• Collections: Miscellaneous documents
• Most recent activity: Proposed
• Most recent activity date: 2023-09-21

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Unfair discrimination and misrepresentation
• Unequal performance across groups
• Compromise of privacy
• AI system security vulnerabilities
• False or misleading information
• Overreliance and unsafe use
• Lack of capability or robustness
• Lack of transparency or interpretability

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Fraud, scams, and targeted manipulation
• Loss of human agency and autonomy
• Economic and cultural devaluation of human effort

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 8-10 subdomains, with strong focus on privacy compromise (2.1), security vulnerabilities (2.2), false information (3.1), lack of robustness (7.3), lack of transparency (7.4), unfair discrimination (1.1), unequal performance (1.3), and overreliance (5.1). Coverage is concentrated in privacy, security, AI system safety, and discrimination domains.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Real Estate, Rental & Leasing
• Management, Administrative & Support Services
• Public Administration (excl. National Security)

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Agriculture, Mining, Construction & Manufacturing
• Trade, Transportation & Utilities
• Information
• Finance & Insurance
• Professional & Technical Services
• Scientific Research & Development Services
• Educational Services
• Health Care & Social Assistance
• Arts, Entertainment & Recreation
• Accommodation, Food & Other Services
• National Security

All other sectors had no coverage in this document.

Sectors Summary

This is a cross-sectoral guidance document that applies to all sectors in New Zealand where AI tools are used to collect, use, or share personal information. The document explicitly states it applies to business, government, and community organizations of all sizes, as well as individuals. Specific examples are provided for real estate, public administration, and educational contexts, but the guidance is designed to be universally applicable across all economic sectors.

Legislative Status

Soft Law

Legislative Status Summary

This is a guidance document issued by the Privacy Commissioner that provides recommendations and expectations for agencies using AI tools. While it references the binding Privacy Act 2020, the document itself uses predominantly voluntary language ('should', 'recommend', 'may want to') and establishes expectations rather than enforceable obligations.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: Office of the Privacy Commissioner (OPC); Privacy Commissioner; Government of New Zealand
• Summary: The document is issued by the Privacy Commissioner of New Zealand, building on a previous statement of expectations from May 2023. The Privacy Commissioner is the regulatory authority responsible for privacy oversight in New Zealand.

Target

• Entity Types: AI_Developer, AI_Deployer, AI_User
• Entities: agencies; business organisations; government organisations; community organisations; individuals; landlords; employers
• Summary: The document explicitly targets all entities using AI tools in New Zealand, including businesses, government agencies, community organizations, and individuals. It applies to those collecting, using, or sharing personal information through AI tools.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: Office of the Privacy Commissioner (OPC); Privacy Commissioner
• Summary: The Privacy Commissioner has oversight authority for privacy compliance in New Zealand under the Privacy Act 2020. While this guidance document itself is not directly enforceable, the underlying Privacy Act obligations are enforceable by the Privacy Commissioner.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: Office of the Privacy Commissioner (OPC); Privacy Commissioner
• Summary: The Privacy Commissioner explicitly states they are monitoring AI tool developments and privacy impacts, with plans to update guidance over time. They invite ongoing dialogue about AI use cases and privacy issues.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document covers all stages of the AI lifecycle comprehensively, with particular emphasis on the Plan and Design, Collect and Process Data, Verify and Validate, Deploy, and Operate and Monitor stages. It provides detailed guidance on privacy considerations throughout the entire lifecycle from initial planning through ongoing monitoring.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• AI Systems
• Generative AI

Technical Scope Summary

The document explicitly mentions AI tools, AI systems, and AI models throughout. It specifically addresses generative AI in detail, referencing the Privacy Commissioner's previous statement on generative AI. The document takes a broad approach to AI systems including machine learning, classifiers, interpreters, and automation. It does not explicitly mention frontier AI, general purpose AI, foundation models, compute thresholds, or open-weight models.