without other safeguards being necessary.172 The decision does not cover data exchanges in the law enforcement sector. The European Commission has only recognised eleven other countries as providing adequate protection, including Canada and the United States.173 As noted above, New Zealand may no longer meet the EU’s data protection standards in light of the new European data protection regulation that goes into effect in May 2018. This may also be relevant to the current negotiations between the New Zealand Government and the EU for a free trade agreement of which negotiations are expected to begin in 2018. The Intelligence and Security Act 2017 requires that the Minister responsible for intelligence and security agencies issue Ministerial Policy Statements in relation to lawful activities of the Agencies and sets out guiding principles. In particular, the MPS on Cooperation of New Zealand intelligence and security agencies with public overseas authorities adopts a strong human rights approach for the exercise of due diligence when determining whether it is appropriate to engage with a particular overseas public authority and determining whether proposed activities are consistent with the law, particularly with respect to ensuring that the security agencies do not become complicit in human rights abuses. The MPS lists the ICCPR and seven other ratified UN human rights treaties as being among New Zealand’s “core human rights obligations.” The MPS noted that “actions or activities that run contrary to the obligations within those instruments may constitute a human rights breach in the context of this MPS.” The following key principles must be applied by the Agencies when cooperating with overseas public authorities: • Legality: Cooperation must be conducted in accordance with New Zealand law and all human rights obligations recognised by New Zealand law.174 cooperate with overseas public authorities where they know or assess that there is a real risk that the activity will lead to, or has been obtained as a result of, human rights breaches in that country. This includes a duty of due diligence and applies to requests to share intelligence on a case-by-case basis or within the context of a broader standing authorisation.175 • Necessity: Cooperation with overseas public authorities should only occur for the purposes necessary to support the Agencies to perform their statutory functions.176 • Reasonableness and proportionality: The Impact of cooperation with overseas public authorities should be reasonable and proportionate to the purpose for carrying out the cooperation, the benefit gained and the reputational risk to the Agencies and the New Zealand Government. The MPS includes a range of factors in determining reasonableness.177 • Protections for New Zealanders: When cooperating with overseas public authorities, the Agencies must continue to apply the same protections for New Zealand citizens and permanent residents that would normally apply, including adherence to the information privacy principles in the Privacy Act.178 • Information Management: Steps must be taken to ensure that information obtained by the Agencies and subsequently shared with overseas public authorities is managed in accordance with all information management requirements, standards and guidelines that relate to that information in New Zealand.179 The Agencies are also required to specify the protection, storage and use (including the passing on of that information to any third parties) to be adhered to in respect of personal information about New Zealanders, shared with an overseas public authority.180 • Human rights obligations: Agencies must not 172 See https://www.privacy.org.nz/blog/providing-an-adequate-level-of-data-protection/ 173 See http://ec.europa.eu/justice/data-protection/international-transfers/adequacy/index_en.htm 174 Ibid. paras. 30-34. 175 Ibid. paras. 35-46. 176 Ibid. para. 47. 177 Ibid. paras. 48-52. 178 Ibid. paras. 53-54. 179 Ibid. para. 55. 180 Ibid. para. 56. 33