a customer requests that a data holder provides data to the customer; and

the data is designated customer data that is about that customer; and

the request—

the data holder has verified the identity of the person who made the request under section 45(2).

an accredited requestor (A) requests that a data holder provides data to A in respect of a customer; and

the data holder has carried out confirmation in relation to the request under section 39; and

the data is designated customer data that is about that customer; and

the request—

A is acting within the class of its accreditation; and

the data holder has verified the identity of the person who made the request under section 45(2).

if the disclosure of the data would be likely to pose a serious threat to the life, health, or safety of any individual, or to public health or public safety (see subsection (3)); or

if the data holder reasonably believes that disclosure of the data would create a significant likelihood of serious harassment of an individual; or

if the data holder reasonably believes that disclosure of the data would create a significant likelihood of serious financial harm to any person; or

if the data holder reasonably believes that it is likely that the request was made (wholly or in part) as a consequence of deception; or

if the data holder reasonably believes that disclosure of the data would be likely to have a materially adverse effect on the security, integrity, or stability of either or both of the following:

in the case of section 14, if the customer owes a debt to the data holder in relation to charges imposed for responding to the request; or

in the case of section 15, if the accredited requestor owes a debt to the data holder in relation to charges imposed for responding to the request or providing any other regulated data services; or

in the case of section 15, if the data holder reasonably believes that the accredited requestor has contravened any obligation under this Act in connection with the request; or

in the circumstances prescribed in the regulations or standards.

the likelihood of the threat being realised; and

the severity of the consequences if the threat is realised; and

the time at which the threat may be realised.

a customer requests that a data holder perform an action relating to the customer; and

the requested action is a designated action; and

the data holder would ordinarily perform the action to which the request relates in the course of the data holder’s business (see subsection (3)); and

the request—

the data holder has verified the identity of the person who made the request under section 45(2).

an accredited requestor (A) requests that a data holder perform an action in respect of a customer; and

the data holder has carried out confirmation in relation to the request under section 39; and

the requested action is a designated action; and

the data holder would ordinarily perform the action to which the request relates in the course of the data holder’s business (see subsection (3)); and

the request—

A is acting within the class of its accreditation; and

the data holder has verified the identity of the person who made the request under section 45(2).

if performing the action would be likely to pose a serious threat to the life, health, or safety of any individual, or to public health or public safety (see section 16(3)); or

if the data holder reasonably believes that performing the action would create a significant likelihood of serious financial harm to any person; or

if the data holder reasonably believes that it is likely that the request was made (wholly or in part) as a consequence of deception; or

if the data holder reasonably believes that performing the action would be likely to have a materially adverse effect on the security, integrity, or stability of either or both of the following:

in the case of section 18, if the customer owes a debt to the data holder in relation to charges imposed for responding to the request; or

in the case of section 19, if the accredited requestor owes a debt to the data holder in relation to charges imposed for responding to the request or providing any other regulated data services; or

in the case of section 19, if the data holder reasonably believes that the accredited requestor has contravened any obligation under this Act in connection with the request; or

in the circumstances prescribed in the regulations or standards.

when or how the joint customers may or must make a request or give an authorisation under this subpart:

how the data holder or accredited requestor may or must deal with a request or authorisation from 1 or more of the joint customers:

when a request made, or an authorisation given, by 1 or more of the joint customers must be treated as effective (or ineffective) for the purposes of this Act.

allowing or requiring a data holder or an accredited requestor to deal with a request or an authorisation in any of the following ways (on the terms and conditions (if any) specified in the regulations):

allowing 1 or more joint customers to view or change permissions for how those joint customers may or must make a request or give an authorisation.

they jointly hold a financial product issued by the data holder; or

they have rights or obligations under the same agreement with the data holder.

a person requests that a data holder provides data to the person; and

the data is designated product data; and

the request—

if the data holder reasonably believes that disclosure of the data would be likely to have a materially adverse effect on the security, integrity, or stability of either or both of the following:

in the circumstances prescribed in the regulations or standards.

when or how a secondary user may or must make a request or give an authorisation under subpart 1 on behalf of a customer; and

how the data holder or an accredited requestor may or must deal with a request or an authorisation from a secondary user; and

when a request made or an authorisation given by a secondary user must be treated as effective (or ineffective) for the purposes of this Act.

whether, when, or how a person may or must be approved, or treated as being approved, to do either or both of the following:

when or how the approval referred to in paragraph (a) may be viewed, changed, or revoked.

A is specified, or belongs to a class specified, in designation regulations as a secondary user in relation to a class of customers; and

B belongs to that class of customers; and

where required by the regulations, A has been approved, or is treated as being approved, as a secondary user in the manner required by the regulations (and that approval has not been revoked or otherwise ceased to be in effect).

specifies the data or action being requested; and

complies with the requirements provided for in the standards about making requests (if any); and

otherwise makes the request in the manner prescribed in the regulations (if any).

enable the data holder to receive requests for regulated data services; and

enable the data holder to provide regulated data services in response to those requests or to otherwise respond to those requests (including where the service must not or may not be provided).

security and identity verification measures:

reliability and timeliness of responses to requests for regulated data services:

availability:

usability:

accessibility:

monitoring use and functionality:

reporting on any of the matters referred to in paragraphs (a) to (f) (including to the chief executive).

ensure that its electronic system is tested for the purpose of verifying that the system complies with some or all of the technical or performance requirements referred to in section 28; and

give a report to the chief executive on the testing.

refuses or fails, without reasonable excuse, to comply with a notice under section 29; or

in purported compliance with a notice under section 29, gives a report to the chief executive knowing it to be false or misleading in a material particular.

$100,000 in the case of an individual:

$300,000 in any other case.

receiving requests for regulated data services (including in relation to performing an action):

providing those services or otherwise responding to those requests:

notifying or otherwise making available information to any of the persons referred to in subsection (3).

a customer:

a secondary user:

another person that is a data holder:

an accredited requestor:

the chief executive:

any member of the public or any class of the public.

requirements about charging amounts payable in connection with regulated data services, including—

the information that must be notified or otherwise made available to any person referred to in section 31(3), the times at which, or the events on the occurrence of which, information must be notified or made available, and the manner of notifying or making available the information (including prescribing the manner in which the information must be presented, calculated, or prepared):

the format and description of data:

the manner in which requests for regulated data services are received and responded to (for example, a requirement to use an application programming interface (API)):

data quality:

the manner in which authorisations are confirmed under section 39(2).

a customer:

a secondary user:

a data holder:

another accredited requestor:

the chief executive:

any member of the public or any class of the public.

the information that must be notified or otherwise made available to any person referred to in section 33(2); and

the times at which, or the events on the occurrence of which, information must be notified or made available; and

the manner of notifying or making available the information (including prescribing the manner in which the information must be presented, calculated, or prepared).

an infringement fee of $20,000; or

a fine imposed by a court not exceeding $50,000.

to supply to the chief executive, within the time and in the manner specified in the notice, any information or class of information specified in the notice; or

to produce to the chief executive, or to a person specified in the notice acting on their behalf in accordance with the notice, any document or class of documents specified in the notice (within the time and in the manner specified in the notice); or

if necessary, to reproduce, or assist in reproducing, in usable form, information recorded or stored in any document or class of documents specified in the notice (within the time and in the manner specified in the notice).

given in writing; and

signed in the manner specified in the notice.

inspect and make records of that document; and

take copies of the document or extracts from the document.

the powers may be, or may continue to be, exercised as if the proceeding had not been commenced; and

no person is excused from fulfilling their obligations under that section by reason of the proceeding.

the applicant has established a prima facie case that the exercise of the power in question is unlawful; and

the applicant would suffer substantial harm from the exercise or discharge of the power or obligation; and

if the power or obligation is exercised or discharged before a final decision is made in the proceeding, none of the remedies specified in subsection (3), or any combination of those remedies, could subsequently provide an adequate remedy for that harm; and

the terms of that order do not unduly hinder or restrict the chief executive in performing or exercising their functions, powers, or duties under this Act.

any remedy that the High Court may grant in making a final decision in relation to the proceeding (for example, a declaration):

any damages that the applicant may be able to claim in concurrent or subsequent proceedings:

any opportunity that the applicant may have, as defendant in a proceeding, to challenge the admissibility of any evidence obtained as a result of the exercise or discharge of the power or obligation.

any information obtained as a consequence of the exercise of powers declared to be unlawful and any record of that information are destroyed; and

any documents, or extracts from documents, obtained as a consequence of the exercise of powers declared to be unlawful are returned to the person previously having possession of them, or previously having them under their control, and any copies of those documents or extracts are destroyed; and

any information derived from or based on such information, documents, or extracts is destroyed.

are admissible as evidence in any civil proceeding unless the court hearing the proceeding in which the evidence is sought to be adduced is satisfied that there was no unfairness in obtaining the evidence:

are admissible as evidence in any criminal proceeding if the evidence is excluded under section 30 of the Evidence Act 2006:

may otherwise be used in connection with the exercise of any power conferred by this Act unless the court that declared the exercise of the powers to be unlawful is satisfied that there was no unfairness in obtaining the evidence.

refuses or fails, without reasonable excuse, to comply with a notice under section 53; or

in purported compliance with a notice under section 53, supplies information, or produces a document, knowing it to be false or misleading in a material particular.

$100,000 in the case of an individual:

$300,000 in any other case.

a person (A) contravenes a duty imposed under this Act; and

A is a data holder or an accredited requestor; and

a person (B) referred to in subsection (3) has suffered, or is likely to suffer, loss or damage because of the contravention.

a customer:

a data holder or an accredited requestor (other than A).

any other remedy that a person may obtain for the loss or damage that has been, or is likely to be, suffered because of the contravention referred to in section 58; or

the powers of the chief executive, a court, or the Disputes Tribunal in respect of the contravention.

is an accredited requestor if that is not the case; or

is lawfully able to do either of the following if that is not the case:

be proceeded against by the filing of a charging document under section 14 of the Criminal Procedure Act 2011; or

be issued with an infringement notice under section 63.

the infringement fee is paid; or

an order for payment of a fine is made or deemed to be made by a court under section 21 of the Summary Proceedings Act 1957.

details of the alleged infringement offence that fairly inform a person of the time, place, and nature of the alleged offence:

the amount of the infringement fee:

the address of the chief executive:

how the infringement fee may be paid:

the time within which the infringement fee must be paid:

a summary of the provisions of section 21(10) of the Summary Proceedings Act 1957:

a statement that the person served with the notice has a right to request a hearing:

a statement of what will happen if the person served with the notice neither pays the infringement fee nor requests a hearing:

any other matters prescribed in the regulations.

delivering it to the person or, if the person refuses to accept it, bringing it to the person’s notice; or

leaving it for the person at the person’s last known place of residence with another person who appears to be of or over the age of 14 years; or

leaving it for the person at the person’s place of business or work with another person; or

if the person is a body corporate, delivering it to a director or an employee of the body corporate at its head office, principal place of business or work, or registered office, or by bringing it to the director’s notice or the employee’s notice if that person refuses to accept it; or

sending it to the person by prepaid post addressed to the person’s last known place of residence or place of business or work; or

sending it to an electronic address of the person in any case where the person does not have a known place of residence or business in New Zealand.

subsection (1)(a) to (c) does not apply (but see subsection (1)(d) instead); and

the infringement notice (or a copy of it) sent in accordance with subsection (1)(e) or (f) must be sent for the attention of a director or an employee of the body corporate.

an infringement notice (or a copy of it) sent by prepaid post to a person under subsection (1) is to be treated as having been served on that person on the fifth working day after the date on which it was posted; and

an infringement notice sent to a valid electronic address is to be treated as having been served at the time the electronic communication first entered an information system that is outside the control of the chief executive.

a pecuniary penalty order (with 2 tiers of penalties):

a declaration of contravention:

a compensatory order:

an injunction.

contravened a civil liability provision; or

attempted to contravene a civil liability provision; or

been involved in a contravention of a civil liability provision.

section 27 (data holder must operate electronic system for providing regulated data services):

section 43 (only customer, secondary user, or accredited requestor may request regulated data services):

section 45 (verification of identity of person who makes request).

$500,000 for a contravention, an attempted contravention, or an involvement in a contravention by an individual; or

$2,500,000 in any other case.

section 14 (data holder must provide customer data to customer):

section 15 (data holder must provide customer data to accredited requestor if authorisation is confirmed):

section 16(2) (data holder must refuse to provide any data if reasonable grounds to believe that a request is made under the threat of physical or mental harm):

section 18 (data holder must perform certain actions on customer’s request):

section 19 (data holder must perform certain actions on accredited requestor’s request if authorisation is confirmed):

section 20(2) (data holder must refuse to perform any action if reasonable grounds to believe that a request is made under the threat of physical or mental harm):

section 21 (how data holders and accredited requestors must deal with joint customers):

section 22 (data holder must provide product data to any person):

section 24 (how data holders and accredited requestors must deal with secondary users):

section 28 (electronic system must comply with prescribed technical or performance requirements):

section 31 (data holders must comply with requirements for requests, providing services, and making information available):

section 33 (accredited requestors must comply with requirements for making information available):

section 36 (accredited requestor must not act if reasonable grounds to believe authorisation or instruction is given under threat of physical or mental harm):

section 39 (customer’s authorisation must be confirmed):

section 40 (customer or secondary user must be able to control authorisation):

section 41 (accredited requestor must comply with prescribed duties in respect of authorisation):

section 42 (authorisation must not be required as condition of providing product):

section 48 (data holders and accredited requestors must have customer complaints process):

section 49 (data holder or accredited requestor must be member of dispute resolution scheme (if scheme has been prescribed)):

section 58 (data holder or accredited requestor must take prescribed steps to avoid, mitigate, or remedy loss or damage caused by contravention):

section 61 (prohibition against holding out):

section 124 (persons that will become data holders when designation comes into force must provide information to chief executive):

section 125 (other data holders must provide information to chief executive).

$200,000 for a contravention, an attempted contravention, or an involvement in a contravention by an individual; or

$600,000 in any other case.

the nature and extent of A’s conduct; and

the nature and extent of any loss or damage suffered by any person because of A’s conduct; and

any gains made or losses avoided by A; and

whether a person has paid an amount of compensation, reparation, or restitution, or taken other steps to avoid, mitigate, or remedy any loss or damage suffered by another person because of A’s conduct; and

the circumstances in which A’s conduct took place; and

whether A has previously been found by a court in a proceeding under this Act, or any other legislation, to have engaged in any similar conduct.

the court finds, whether in the same or separate proceedings, that a person is liable to pay a pecuniary penalty in respect of 2 or more contraventions of the same civil liability provision; and

those contraventions are of the same or a substantially similar nature and occurred at or about the same time.

the provision to which the contravention or involvement in the contravention relates; and

the person that engaged in the contravention or was involved in the contravention; and

the conduct that constituted the contravention or involvement in the contravention.

a person has contravened a civil liability provision; and

another person (the aggrieved person) has suffered, or is likely to suffer, loss or damage because of the contravention.

any person in contravention; or

any person involved in the contravention.

restraining a person from engaging or continuing to engage in conduct that constitutes or would constitute a contravention, an attempted contravention, or an involvement in a contravention of a civil liability provision; or

requiring a person to do an act or a thing if—

it is satisfied that the person has engaged in conduct of that kind; or

it appears to the court that, if an injunction is not granted, it is likely that the person will engage in conduct of that kind.

the person has previously engaged in conduct of that kind; or

there is an imminent danger of substantial damage to any other person if that person engages in conduct of that kind.

it is satisfied that the person has refused or failed to do that act or thing; or

it appears to the court that, if an injunction is not granted, it is likely that the person will refuse or fail to do that act or thing.

the person has previously refused or failed to do that act or thing; or

there is an imminent danger of substantial damage to any other person if the person refuses or fails to do that act or thing.

a proceeding may be brought against that person for the contravention, attempted contravention, or involvement in the contravention of any 1 or more of the provisions; but

no person is liable to more than 1 pecuniary penalty order for the same conduct.

A’s contravention was due to reasonable reliance on information supplied by another person; or

both of the following apply:

section 27; or

section 28 to the extent that it requires a data holder to comply with a CPD reliability and availability requirement.

A’s contravention was due to a technical fault in its electronic system referred to in section 27; and

A took reasonable precautions and exercised due diligence to avoid the contravention; and

A is in compliance with section 27 and the CPD reliability and availability requirements (see section 89(4)).

sections 14, 15, 18, 19, and 22 (duties for data holder to provide data or perform actions):

section 39(2) (duty for data holder to confirm authorisation):

section 45(2) (duty for data holder to verify identity of person who makes a request).

A provided the customer data in compliance, or purported compliance, with section 14 or 15; and

in providing the customer data,—

A provided the customer data in purported compliance with section 14 or 15; but

A did not have a duty to provide the customer data under either of those sections.

applications for orders, or for a court to exercise any other power, under any provision of this subpart:

appeals arising from any proceeding in the District Court under this subpart.

the amount claimed does not exceed $350,000; or

no amount is claimed; or

the occasion for the making of the order or the exercise of the power arises in the course of civil proceedings properly before the court; or

the parties consent, under section 81 of the District Court Act 2016, to the District Court having jurisdiction to hear and determine the application.

require a person to pay an amount exceeding $30,000; or

declare a person not liable to another person for an amount exceeding $30,000.

to act as the regulator of regulated data services, including by—

to provide services to promote the purpose of this Act:

to provide, or facilitate the provision of,—

to co-operate with any other law enforcement or regulatory agency that carries out a role in relation to regulated data services:

to keep under review the law and practices that are relevant to the chief executive’s other functions under this section (including overseas law and practices).

it is necessary or desirable for a non-public service person to have the principal role in the development of any standards in relation to particular designation regulations; and

the person should be approved under this subpart in order to ensure that they are an appropriate person to perform that role.

they have issued, or will issue, a standard, framework, code of practice, recommended practice, or requirement (the material); and

the chief executive proposes to incorporate by reference the material in any standards (whether in whole or in part, and with or without modification); and

the chief executive considers that the standards will be wholly or predominantly based on the material.

is a body corporate or an unincorporated body, and that the membership of the board or other governing body of the person has a reasonably balanced representation of stakeholder interests; and

will have in place fair and transparent processes for the development of standards; and

has sufficient knowledge, experience, and capability to efficiently—

they perform a function under another Act that involves recommending, developing, or making any secondary legislation; and

the chief executive considers that the function is relevant to the standards in respect of which they will act.

performing or exercising under delegation a function or power under any of the following:

giving advice on time frames for implementing standards:

providing services to promote the purpose of this Act or to assist the chief executive to perform any of the chief executive’s functions under section 95.

in the Gazette; and

on an internet site maintained by or on behalf of the Ministry.

change the terms and conditions of the approval; or

revoke the approval of a person under this subpart (wholly or for particular purposes).

in the Gazette; and

on an internet site maintained by or on behalf of the Ministry.

the decision is the same as, or different from, the advice or recommendation of an approved person; or