New Zealand’s privacy regulator has explained how the Information Privacy Principles apply to AI systems. Its guidance is not a product endorsement or a claim that any commercial model is privacy certified.
Start with the information privacy principles
When a company uses AI to handle information about identifiable people, it should examine collection, use, disclosure, accuracy, security and retention in the context of the Privacy Act. A “summarize this customer complaint” prompt may disclose personal information even when the model produces only a brief answer. The analysis covers input files, internal retrieval, logs and vendor handling.
Assess before procurement
The Office of the Privacy Commissioner advises agencies to perform a privacy impact assessment before adopting AI tools for personal information. Define the benefit, foreseeable harms, information flows, who has access and alternatives with fewer data requirements. Treat the assessment as a living document if a vendor changes model or integration behavior.
Meaningful transparency and individual rights
Explain to people when their information is being used in consequential AI workflows and provide contact details for questions and corrections. Check factual information before acting on an automated summary; a fabricated allegation can quickly become harmful when copied into a customer or personnel file.
Māori data considerations
New Zealand regulators highlight engagement with Māori around risks and taonga information. A generic privacy notice does not replace meaningful community consultation about cultural, relational or collective interests when information is especially sensitive. Avoid using publicly visible material as an unrestricted AI training set without a fit-for-purpose assessment.
Decision aid
For a small retailer, use AI to draft generic FAQ text without customer records. For a local council planning a casework assistant, demand role-based retrieval, documented privacy assessment, staff instruction and human accountability. The Privacy Commissioner does not approve AI products: responsibility stays with the organization deploying them.
Sources & Further Reading
- Artificial Intelligence and Information Privacy Principles — New Zealand Office of Privacy Commissioner.
- Does Privacy Commissioner approve AI providers? — New Zealand Office of Privacy Commissioner.
Jurisdiction/scope: New Zealand; Privacy Act and OPC guidance. This is educational information, not legal, medical or other professional advice. No hands-on product testing is claimed.