この記事は現在英語でのみご利用いただけます。
AI Governance in New Zealand: Privacy Act, Algorithmic Decision-Making, and the NZ Framework
New Zealand is developing its AI governance approach — the Privacy Act 2020, the Algorithm Charter, and the Office of the Privacy Commissioner's guidance create the current framework. The 2026 guide for NZ organisations.
Key Takeaways
New Zealand's Privacy Act 2020 is the primary legal framework for AI governance — its information privacy principles, including IPP 1 (purpose limitation), IPP 3 (collection from individuals), and IPP 10 (limits on use), apply to AI data processing.
The Algorithm Charter for Aotearoa NZ (2020) is a voluntary government commitment that establishes principles for government agencies using algorithms — transparency, explainability, human oversight, and non-discrimination. Approximately 30 agencies have signed.
The Office of the Privacy Commissioner has published guidance on the Privacy Act and AI that creates specific expectations for organisations using AI that affects individuals — including requirements for transparency, data minimisation, and access rights.
New Zealand's AI governance is closely aligned with Australia's — organisations operating in both countries can leverage Australian governance frameworks with relatively minor adaptation for NZ-specific requirements.
The NZ government is developing a more comprehensive AI policy framework — the 2024 Digital Strategy includes AI governance as a priority and the government has signalled intention to develop sector-specific guidance analogous to Australian regulators.
"情報提供のみを目的としています。この記事は法律、規制、財務または専門的なアドバイスを構成するものではありません。具体的なアドバイスについては、資格を持つ専門家にご相談ください。"
Privacy Act 2020 and AI
The Privacy Act 2020 is New Zealand's primary data protection legislation and its most significant AI governance framework. The Act's 13 Information Privacy Principles (IPPs) apply to personal information processed by AI systems, creating obligations that parallel those of Australia's Privacy Act. The most relevant principles for AI governance: IPP 1 requires that personal information is collected for a specified, lawful purpose and not for a purpose that would be unfair to the individual. Using data collected for one purpose to train an AI model for a different purpose may not satisfy IPP 1. IPP 3 requires that personal information is collected directly from the individual where practical — AI systems that aggregate personal information from multiple sources without individual knowledge may not satisfy this principle. IPP 10 prohibits using personal information for purposes other than those for which it was collected — AI systems that use customer data collected for service delivery to train predictive models may require specific consent or a new purpose specification.
The Algorithm Charter
New Zealand's Algorithm Charter for Aotearoa NZ represents a significant government commitment to transparent and accountable use of algorithms in the public sector. Agencies that sign the Charter commit to: maintaining a plain language summary of algorithms that affect individuals, being clear about where algorithms are and are not used in agency decisions, testing for bias and considering impacts on privacy before deployment, ensuring humans maintain meaningful oversight, engaging with affected communities, and providing a mechanism for complaints. While the Charter is voluntary, the approximately 30 signatory agencies include major government departments — MBIE, MSD, Statistics NZ, ACC, and Inland Revenue — that collectively affect most New Zealanders' interactions with government.