EU law restricts the data that can leave the EU, but data can be sent to organisations based in countries whose laws the EU deems 'adequate'. This means that they offer at least the same protection as EU laws.
New Zealand is just the 13th country or territory to be deemed 'adequate' by the Commission. The other 12 are Andorra, Argentina, Australia, Canada, Switzerland, the Faeroe Islands, Guernsey, Israel, the Isle of Man, Jersey, Uruguay and the United States, as long as the processing is done under the US's Safe Harbor scheme.
''While we work on reforming EU rules to guarantee personal data protection at home, we also need to make sure our citizens’ data is safe when transferred outside the EU too," said Viviane Reding, EU vice president and Justice Commissioner. "This decision is another step to boosting trade with our international partners while helping to set high standards for personal data protection at a global level.”