Private Law Theory

ABSTRACT
This paper interrogates the growing dissonance between New Zealand’s digital economy and its frameworks for consumer redress. It identifies a significant regulatory ‘void’ within the Privacy Act 2020, arguing that the Act’s conciliatory enforcement pathway and high remedial ‘harm threshold’ – requiring ‘significant humiliation’ or ‘loss of dignity’ – create an insurmountable barrier for consumers harmed by the modern data-extraction economy. This gap, driven by the ‘Brussels Effect’ pressure to maintain EU adequacy through superficial transparency reforms, is not accidental but a de facto policy choice. The paper’s central thesis is that a potent, albeit latent, solution already exists within New Zealand’s consumer protection statutes. First, it argues that the Fair Trading Act 1986 provides an immediate pathway for regulatory action: the ‘overall impression’ doctrine, affirmed in Commerce Commission v Viagogo AG, can be directly transposed from ‘drip pricing’ to ‘drip collection’, rendering opaque privacy policies and dark pattern interfaces misleading conduct under section 9. This argument is substantiated by the successful ‘deterrence-by-enforcement’ model pioneered by the ACCC in its actions against Google, Meta, and Trivago, and bolstered by the FTA’s new unconscionable conduct provisions. Second, the paper advances a novel argument that the Consumer Guarantees Act 1993 applies to data-related harms, positing that data management is an intrinsic ‘service’ and that a data breach constitutes a per se failure of the guarantee of ‘reasonable care and skill’ under section 28 – reframing privacy as service quality and unlocking commercial remedies, including consequential loss, via the Disputes Tribunal. The paper concludes that while activating the Commerce Commission is the immediate imperative, the superior long-term solution is a convergent regulatory model emulating the United Kingdom’s Digital Regulation Cooperation Forum.

Opland, Russell, Consumer Protection Law in New Zealand: A Means of Redress for Privacy Harms? (April 5, 2026).