Criminal framework

Harmful Digital Communications Act 2015, sections 22 (causing harm by posting digital communication) and 22A (posting intimate visual recording without consent). The statute was enacted 2015, with intimate image specific s.22A added in 2022. Section 22A: up to 3 years imprisonment for individuals. Section 22 general offence: up to 2 years.

Civil and data protection framework

Privacy Act 2020 (right to access and correct, plus information privacy principle 5) provides the parallel civil route. Office of the Privacy Commissioner New Zealand (Privacy Commissioner) is the national supervisory authority and accepts complaints against any controller processing intimate imagery without lawful basis. The official site is https://www.privacy.org.nz.

Direct takedown authority

Netsafe is the statutory approved agency under the HDCA. The District Court can issue takedown orders under section 19 with binding effect on online content hosts.

Official victim support

Netsafe is the recognised support service. Available at https://www.netsafe.org.nz.

Five step removal process for New Zealand victims

  1. 1

    Preserve evidence before any contact with the perpetrator

    Capture full page screenshots with URLs visible. Save the original files. Note timestamps. This evidence supports both the Harmful Digital Communications Act 2015 complaint and any Privacy Act 2020 (right to access and correct, plus information privacy principle 5) request.

  2. 2

    File a criminal complaint under Harmful Digital Communications Act 2015

    Report to local police or the national cybercrime unit. Netsafe can assist with the report.

  3. 3

    Submit an erasure request under Privacy Act 2020 (right to access and correct, plus information privacy principle 5)

    Send a written request to each platform's designated data protection contact citing the legal basis. Privacy Commissioner can be petitioned if the platform fails to comply within 30 days.

  4. 4

    Send a US TAKE IT DOWN Act notice in parallel for covered platforms

    When the platform is subject to US jurisdiction, the 48 hour federal removal obligation applies in parallel with your domestic rights. ScanErase files these notices automatically.

  5. 5

    Track and escalate non compliant platforms

    Document every notice and every response. Use the regulator's takedown authority for non compliant platforms.

Frequently asked questions

What is the criminal NCII statute in New Zealand?

Harmful Digital Communications Act 2015, sections 22 (causing harm by posting digital communication) and 22A (posting intimate visual recording without consent). Enacted 2015, with intimate image specific s.22A added in 2022. Section 22A: up to 3 years imprisonment for individuals. Section 22 general offence: up to 2 years.

Who enforces data protection rights in New Zealand?

Office of the Privacy Commissioner New Zealand (Privacy Commissioner) is the national authority. Official site: https://www.privacy.org.nz.

Is there an official victim support service in New Zealand?

Yes. Netsafe provides direct help to victims. Site: https://www.netsafe.org.nz.

Does any regulator in New Zealand have direct takedown power?

Netsafe is the statutory approved agency under the HDCA. The District Court can issue takedown orders under section 19 with binding effect on online content hosts.

Can a New Zealand resident also use the US TAKE IT DOWN Act?

Yes when the hosting platform is subject to US jurisdiction. The TAKE IT DOWN Act applies to covered platforms regardless of where the victim resides. ScanErase's scan finds every US covered platform hosting your images, so you can file notices there in parallel with Privacy Act 2020 (right to access and correct, plus information privacy principle 5) requests.

Related guides