General context, key principles and hot topics
1Identify the highest-profile corporate investigation under way in your country, describing and commenting on its most noteworthy aspects.
New Zealand’s Financial Markets Authority has noted that it has an ongoing investigation into the conduct of CBL Corporation Limited (in liquidation) and its directors. As at mid 2019, the Financial Markets Authority has publicly stated that, following a preliminary assessment, it has concerns about disclosure made as part of the initial public offer, continuous disclosure, financial reporting and directors’ duties. New Zealand’s Serious Fraud Office publicly announced an investigation into matters relating to CBL in mid 2018.
The High Court appointed liquidators to CBL Insurance Limited in November 2018 on the application of the Reserve Bank of New Zealand, in its capacity as insurance regulator. Further, the Reserve Bank of New Zealand commissioned an independent review of its own supervision of CBL to identify lessons for itself and the insurance regulatory regime.
2Outline the legal framework for corporate liability in your country.
While there are some offences that on their proper interpretation cannot be committed by corporations (as opposed to natural persons), the general position in New Zealand is that corporations are legal persons and may be held criminally liable for offences. A corporation may be criminally liable for the conduct of employees or agents through the application of the doctrine of vicarious liability, or it may be liable directly or personally.
There is no corporate manslaughter offence under New Zealand law. Although it was considered for inclusion in the Health and Safety at Work Act 2015, it was ultimately excluded.
3Which law enforcement authorities regulate corporations? How is jurisdiction between the authorities allocated? Do the authorities have policies or protocols relating to the prosecution of corporations?
The key law enforcement authorities that regulate corporations include the following:
- New Zealand’s Serious Fraud Office, which investigates and prosecutes serious or complex financial crime, including bribery and corruption;
- Inland Revenue Department, which is responsible for enforcing New Zealand tax law (including investigating tax-related offending);
- Reserve Bank of New Zealand, which is responsible for enforcing law relating to the regulation of banks, insurers and non-bank deposit takers;
- Financial Markets Authority, which is responsible for enforcing securities, financial reporting and company law relating to capital markets and financial services in New Zealand;
- Commerce Commission, which enforces legislation promoting competition in New Zealand markets and consumer protection legislation, including legislation prohibiting misleading and deceptive conduct in trade; and
- Worksafe, the workplace health and safety regulator, which conducts investigations and criminal prosecutions in relation to workplace health and safety breaches.
Unlike many similar jurisdictions, New Zealand has no centralised agency to take prosecution decisions. Regulatory agencies frequently publish their own enforcement policies. To assist in maintaining a core set of standards for the conduct of public prosecutions, the Solicitor-General publishes Prosecution Guidelines. These Guidelines contain no specific policies relating to the prosecution of corporations.
4What grounds must the authorities have to initiate an investigation? Is a certain threshold of suspicion necessary to trigger an investigation?
The statutory requirements differ across enforcement authorities, but in all cases there are limits as to when an investigation can be commenced and information-gathering powers used. For example, the director of New Zealand’s Serious Fraud Office requires a reason to suspect that an investigation into the affairs of any person may disclose serious or complex fraud before issuing a notice to produce a document; the director then needs to satisfy the higher threshold requirement of having reasonable grounds to believe that an offence involving serious or complex fraud may have been committed before issuing a notice requiring a person to attend an interview.
5How can the lawfulness or scope of a notice or subpoena from an authority be challenged in your country?
Before making any formal challenge, it may be possible to vary the scope and terms of a notice or subpoena through an informal agreement with the issuing authority. A notice or subpoena issued by a public authority may otherwise be formally challenged through an application to the High Court for judicial review.
In a notable example of a challenge through judicial review, notices issued by the Financial Markets Authority requiring the recipients to supply information or produce documents were declared to be unlawful because of a failure to comply with the statutory requirement to specify a time for compliance.
6Does your country make use of co-operative agreements giving immunity or leniency to individuals who assist or co-operate with authorities?
Most New Zealand regulators’ enforcement guidelines provide that proactive and co-operative behaviour should be taken into account when considering enforcement outcome. This is a similar feature in criminal sentencing guidelines.
In the context of competition law, the Commerce Commission operates a specific Cartel Leniency Policy in respect to breaches of the prohibition against cartel conduct. The Cartel Leniency Policy grants immunity to the first person involved in a cartel that the Commission is not aware of, or is aware of but does not have sufficient evidence to launch court proceedings, who reports that cartel to the Commission. Any subsequent cartel members who co-operate will not receive immunity, but may be eligible for the Commission’s co-operation policy or the Amnesty Plus scheme.
7What are the top priorities for your country’s law enforcement authorities?
A major focus for New Zealand’s Serious Fraud Office has been bribery and corruption, particularly as New Zealand increasingly has links to high-risk jurisdictions, including doing more business with countries in the red zone of the Transparency International index.
The Inland Revenue Department is focusing on implementing proposals to address base erosion and profit shifting, and systems to allow for the greater exchange of information between tax authorities.
Both the Financial Markets Authority and Commerce Commission continue to focus on conduct that has the potential to harm customers, particularly vulnerable customers, or to harm New Zealand’s reputation. The Commerce Commission’s enforcement priorities for 2019–2020 include environmental claims, online retail, motor vehicle financing and related add-ons, and cartel conduct.
8Does your country regulate cybersecurity? Describe the approach of local law enforcement authorities to cybersecurity-related failings.
With the exception of legislation regulating the telecommunications industry, New Zealand does not have any specific laws that impose general obligations on organisations or individuals in relation to cybersecurity. However, the Privacy Act 1993 and the Companies Act 1993 impose certain obligations with cybersecurity implications. The European Union’s General Data Protection Regulation may also be applicable to organisations operating in New Zealand where their activities fall within its jurisdiction.
The Privacy Act 1993 requires an agency holding personal information to ensure that the information is protected by reasonable security safeguards against loss, unauthorised access, use, modification or disclosure and other misuse. If it is necessary for information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency must be done to prevent unauthorised use or disclosure of the information.
Under the Companies Act 1993, a director of a company must, when exercising powers or performing duties as a director, exercise the care, diligence and skill of a reasonable director. For most companies, reliance on technology and data is critical to the functioning of business, meaning that this duty of care is likely to extend to the management of cyber risk.
The New Zealand government promotes good cybersecurity practice. CERT NZ is a government agency established in 2017 to receive reports of cyber incidents, analyse threats, share information and advice, coordinate incident responses and be an international point of contact. The National Cyber Security Centre, which is a division of the government’s Community Security Bureau, assists New Zealand’s most significant public and private sector organisations to protect their information systems from advanced cyber threats. Other regulators, for example, the Financial Markets Authority, also are working with market participants to ensure high standards of cyber resilience and security.
9Does your country regulate cybercrime? What is the approach of law enforcement authorities in your country to cybercrime?
There are a number of provisions in the Crimes Act 1961 relevant to cybercrime. These sections are very broad and cover (for example) hacking. The offences are treated similarly to conventional crimes in that they fall under the jurisdiction of the New Zealand Police. It is an offence, for example, to:
- dishonestly or by deception access any computer system and:
- obtain or intend to obtain any property, privilege, service, pecuniary advantage, benefit, or valuable consideration; or
- cause loss to another person;
- intentionally or recklessly destroy, damage or alter any computer system where the person knows or ought to know that danger to life is likely to result;
- intentionally or recklessly and without authorisation:
- damage, delete or otherwise interfere with or impair any data or software in a computer system;
- cause any of the above to occur; or
- cause any computer system to fail, or to deny service to any authorised users;
- sell, offer, agree to sell, or possess for the purpose of sale, any software or other information that would enable another person to access a computer system without authorisation where:
- the defendant knows that the sole or principal use of the software is the commission of an offence; or
- the defendant promotes the software or information as useful for the commission of an offence, knowing or being reckless as to whether it will be used for that purpose;
- possess any software or other information that would enable the person to access a computer system without authorisation, where the person intends to use that software or information to commit an offence; and
- access a computer system without authorisation (excluding where a person authorised to access a computer system accesses it for a purpose other than the one for which the person was given access).
Cross-border issues and foreign authorities
10Does local criminal law have general extraterritorial effect? To the extent that extraterritorial effect is limited to specific offences, give details.
Criminal law does not have general extraterritorial effect. However, there is a range of offences relating to conduct occurring outside New Zealand that can amount to an offence in New Zealand. An example is the bribery of foreign public officials by an employee of a company incorporated in New Zealand.
11Describe the principal challenges that arise in your country in cross-border investigations, and explain whether and how such challenges depend on the other countries involved.
The principal issues that have arisen in the cross-border investigations we have been involved in include:
- ensuring that there is no difference in approach between jurisdiction as to the scope and application of legal advice and litigation privilege;
- ensuring that there is no difference in approach to data protection or privacy laws and that all data transfer arrangements put in place take into account the need to respect these laws and protect legal professional privilege;
- understanding the different legal offences in play across multiple jurisdictions, including determining whether different regimes may have applicable extraterritorial offences;
- ensuring that there is no difference in approach between jurisdictions as to the potential culpability of officers or employees that may result in additional care in respect of providing independent advice to officers or employees;
- ensuring that there are no differences in approach to positive obligations to notify regulators and enforcement agencies of potential offences;
- whether evidence-sharing or mutual assistance treaties exist between the relevant jurisdictions; and
- practical issues around the analysis, review and translation of datasets that include a mixture of languages.
12Does double jeopardy, or a similar concept, apply to prevent a corporation from facing criminal exposure in your country after it resolves charges on the same core set of facts in another? Is there anything analogous in your jurisdiction to the ‘anti-piling on’ policy as exists in the United States (the Policy on Coordination of Corporate Resolution Penalties) to prevent multiple authorities seeking to penalise companies for the same conduct?
The principle of double jeopardy may apply to prevent a corporation from facing criminal exposure in New Zealand after it resolves charges on the same set of facts in another country. Section 26(2) of the New Zealand Bill of Rights Act 1990 provides that no one who has been finally acquitted or convicted of, or pardoned for, an offence shall be tried or punished for it again. This provision applies to all legal persons, including corporations, by virtue of section 29. Difficult issues could arise, however, and the principle of double jeopardy could be tested if it is thought that an alleged offender has been unreasonably or improperly acquitted in, or unreasonably leniently punished by, the courts of another country.
New Zealand does not have any laws that are directly analogous to the United States’ ‘anti-piling on’ policy. However, the ‘totality principle’ in relation to sentencing dictates that, in arriving at the appropriate sentence for several offences, the sentencing judge must not only consider each offence individually, but also assess the offender’s overall culpability and determine the effective sentence that is appropriate for the whole of the conduct. The Sentencing Act 2002 provides that, if a court is considering imposing sentences of imprisonment for two or more offences, the individual sentences must reflect the seriousness of each offence. In some circumstances, however, concurrent rather than cumulative sentences may be more appropriate to reflect the gravity of the overall offending.
Specific statutes set out further sentencing rules in particular contexts. For example, the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 provides that, if a person is or may be liable to more than one civil penalty under the Act in respect of the same or substantially the same conduct, civil penalty proceedings may be brought against the person for more than one civil penalty, but the person may not be required to pay more than one civil penalty in respect of the relevant conduct.
13Are ‘global’ settlements common in your country? What are the practical considerations?
Such settlements are not common in New Zealand, but there have been examples of information exchange and co-operation between New Zealand authorities and their counterparts in other countries.
14What bearing do the decisions of foreign authorities have on an investigation of the same matter in your country?
New Zealand law enforcement authorities generally keep abreast of international developments and try to co-operate with their counterparts in foreign jurisdictions. In this respect, New Zealand’s Serious Fraud Office, Financial Markets Authority, Inland Revenue Department and Commerce Commission all have standing co-operation agreements in place with equivalent authorities in other jurisdictions.
In the event of a decision by a foreign authority on an identical matter being investigated in New Zealand, we would expect that the New Zealand authorities would take into account that decision but continue to conduct their own investigation.
Economic sanctions enforcement
15Describe your country’s sanctions programme and any recent sanctions imposed by your jurisdiction.
New Zealand ratifies United Nations sanctions through regulations promulgated under the United Nations Act 1946. This legislation enables the New Zealand government to act promptly to impose or remove sanctions shortly after a decision has been taken by the United Nationals Security Council. Financial sanctions targeting designated individuals and entities associated with Al Qaeda and the Taliban are implemented separately under the Terrorism Suppression Act 2002. New Zealand’s sanctions are communicated to the public primarily via the New Zealand Gazette, the Ministry of Foreign Affairs’ website and ministerial press releases.
Outside these existing frameworks, there is no general legislative power to allow the New Zealand government to impose economic sanctions in the absence of a United Nationals Security Council Resolution. Draft legislation that would permit the New Zealand government to impose unilateral or autonomous sanctions in certain circumstances was introduced into the House in May 2017 but has not yet progressed further through the parliamentary process.
Despite not having an autonomous sanctions regime, New Zealand can apply a limited range of diplomatic sanctions in the absence of authorising regulations. These include the refusal of entry visas, the expulsion of diplomats, the suspension of official visits, and the suspension of aid and co-operation.
16What is your country’s approach to sanctions enforcement? Has there been an increase in sanctions enforcement activity in recent years, for example?
Sanctions compliance monitoring and enforcement functions are carried out by the New Zealand Customs Service, Ministry of Foreign Affairs and Trade, Immigration New Zealand and New Zealand Police. These government departments have robust systems and procedures in place for monitoring compliance with United Nations trade sanctions, visa restrictions and financial sanctions respectively.
Individuals and companies convicted of an offence under New Zealand’s sanctions regulations may be subject to criminal or civil penalties. The maximum penalties are:
- in the case of an individual, imprisonment for a term not exceeding 12 months or a fine not exceeding NZ$10,000; or
- in the case of a company or other corporation, a fine not exceeding NZ$100,000 (per offence).
Evidence of knowledge or intent to breach sanctions will attract significantly harsher enforcement action.
Sanctions enforcement activity has traditionally been limited. New Zealand’s first prosecution for a breach of regulations made under the United Nations Act 1946 occurred in 2018. In New Zealand Customs Service v. Pacific Aerospace Limited  NZDC 5034, Pacific Aerospace Limited pleaded guilty to three breaches of the United Nations Sanctions (Democratic People’s Republic of Korea) Regulations 2006 for supplying a Chinese company with aircraft parts knowing that they would be used to service an aircraft based in North Korea. These breaches carried a maximum penalty of NZ$300,000, but the District Court imposed a penalty of NZ$74,805 owing to a host of mitigating factors.
As a result of this prosecution, New Zealand companies (especially those operating in high-risk jurisdictions) have become increasingly vigilant with respect to their sanctions compliance obligations.
17Do the authorities responsible for sanctions compliance and enforcement in your country co-operate with their counterparts in other countries for the purposes of enforcement?
New Zealand’s compliance and enforcement authorities co-operate with their counterparts in other jurisdictions both on a bilateral ad hoc basis, and under the auspices of the United Nations sanctions framework.
18Has your country enacted any blocking legislation in relation to the sanctions measures of third countries? Describe how such legislation operates.
19To the extent that your country has enacted any sanctions blocking legislation, how is compliance enforced by local authorities in practice?
New Zealand has not enacted any blocking legislation in relation to the sanctions measures of third countries.
Before an internal investigation
20How do allegations of misconduct most often come to light in companies in your country?
Allegations of misconduct come to light in all manner of ways in New Zealand, including:
- after specific accidents or events that highlight issues;
- through whistleblowers;
- through internal and external audits and compliance reviews;
- through thematic reviews undertaken by regulators; and
- through media reports, including in respect of emerging issues in other jurisdictions.
21Does your country have a data protection regime?
New Zealand’s Privacy Act 1993 governs the collection, storage and disclosure of personal information in New Zealand. The Act applies to all companies and requires that personal information is collected and stored only with an individual’s knowledge, and only disclosed with consent, unless specified exceptions are met.
There is currently an amendment Bill before New Zealand’s Parliament, which would replace the existing Privacy Act 1993 with a more comprehensive data protection regime that would include a mandatory reporting obligation in the event of privacy breach and would require New Zealand agencies to ensure that personal information disclosed overseas would be subject to acceptable privacy standards.
22To the extent not dealt with above at question 8, how is the data protection regime enforced?
Under the current data protection regime, any person may make a complaint to the Privacy Commissioner regarding an alleged breach of the Privacy Act 1993. If the Privacy Commissioner is unable to resolve the matter, proceedings can be brought in the Human Rights Review Tribunal alleging a breach of the Act.
23Are there any data protection issues that cause particular concern in internal investigations in your country?
In our experience, the data protection issues that arise in New Zealand are similar to those encountered in internal investigations in other developed countries.
The Privacy Act 1993 allows disclosure of otherwise private personal information should it be required to avoid prejudice to the maintenance of the law, including the prevention, detection, investigation, prosecution and punishment of offences. This can allow the disclosure of personal information to a regulatory agency in the context of an investigation.
24Does your country regulate or otherwise restrict the interception of employees’ communications? What are its features and how is the regime enforced?
Section 216B of the Crimes Act 1961 makes it an offence to intentionally intercept any private communication by means of an interception device. However, it is an exception to this offence if a party has the express or implied consent of the originator or recipient to intercept that communication.
The interception of employee communications that are work-related and using work email or equipment owned by the employer can be lawful, but there are limits to an employer’s right to intercept such communications, including privacy implications. Under the Privacy Act 1993, collection of data must be for a lawful purpose and be necessary to achieve that purpose. In addition, an employer should not intrude to an unreasonable extent upon the personal affairs of its employees. An employer should expressly reserve the right to monitor employee emails (and, if applicable, other forms of work-related communications) and make it clear why that monitoring is occurring. The Privacy Commissioner in New Zealand has stated that monitoring of employee work email is acceptable following notification but that the interception of emails from an employee’s private email account will not be lawful, even if accessed using an employer’s server.
Interception or monitoring of telephone communications may also be lawful in the workplace where there is a good reason for such recordings and employees are aware that they may be recorded.
An employee can raise an issue in relation to interception of communications via a complaint to the Privacy Commissioner or by bringing an employment claim via the Employment Relations Authority.
Dawn raids and search warrants
25Are search warrants or dawn raids on companies a feature of law enforcement in your country? Describe any legal limitations on authorities executing search warrants or dawn raids, and what redress a company has if those limits are exceeded.
Authorities that investigate corporate crime in New Zealand, such as the Serious Fraud Office or Financial Markets Authority, may conduct dawn raids of businesses or residential premises under the authority of a search warrant issued by the court or an issuing officer. The Commerce Commission also has similar powers.
The authorities will also consider using their powers to compel companies to provide information via the authorities’ respective statutory powers by issuing statutory notices.
When a raid is carried out under a warrant in New Zealand, the authority may use reasonable force to gain entry to the premises. However, it may only search the premises specified in the warrant and seize items within the scope of the warrant. Some authorities have additional powers that can be exercised during the search, including compelling persons to assist with the search or to answer questions relevant to the search, such as how to access electronic documents or where documents are located.
If there are significant errors in the process of obtaining the warrant or authorising the raid, or in its execution, the raid can be challenged by judicial review (in the High Court) and rendered unlawful, and the material seized during the raid could be rendered inadmissible.
26How can privileged material be lawfully protected from seizure during a dawn raid or in response to a search warrant in your country?
In most instances, legally privileged material cannot be seized during a dawn raid.
The authorities who investigate corporate crime are frequently accompanied during raids by an independent lawyer specifically tasked with reviewing on-site any material that the company asserts as privileged. It is important to be aware of where privileged material is likely to be stored (electronically and physically) so that claims for privilege can be made before items are seized. The company should assert its rights in writing in this regard.
When there is a dispute as to privilege, in practice, the authority will often seal the material or the server (depending on what is permitted to be seized under the warrant) for review by an independent lawyer (typically a barrister) for privilege before it is examined by the investigating team.
Technology such as servers, mobile phones and tablets may contain both privileged and non-privileged material that cannot be separated. These can be seized or cloned during the raid, subject to the terms of the warrant. In practice, the privileged material will then be quarantined by digital forensic experts within the authority and privileged material will be identified by applying search criteria provided by the company.
27Under what circumstances may an individual’s testimony be compelled in your country? What consequences flow from such compelled testimony? Are there any privileges that would prevent an individual or company from providing testimony?
An individual providing required information in the course of a proceeding or to a person carrying out a statutory power has a right against self-incrimination when providing testimony. This right does not apply when it is removed by statute, and a number of New Zealand statutes that provide regulatory investigation powers expressly remove this right. Whether information obtained compulsorily is admissible in court will depend on the statute under which that information is acquired.
Whistleblowing and employee rights
28Describe the whistleblowing framework in your country. What financial incentive schemes exist for whistleblowers? What legal protections are in place for whistleblowers?
The Protected Disclosures Act 2000 offers protection to individuals who make qualifying protected disclosures of serious wrongdoing in or by an organisation. A disclosure is protected if the:
- information is about ‘serious wrongdoing’ as defined in the Protected Disclosures Act;
- individual has a reasonable belief that the information is true (or likely to be true);
- individual wishes to disclose the information for it to be investigated; and
- individual wishes the disclosure to be protected.
A protected disclosure must be made in accordance with the internal procedures of the organisation, unless circumstances permit otherwise.
An individual who makes a protected disclosure is granted three core protections under the Protected Disclosures Act:
- Protection from retaliatory action. The individual cannot be dismissed or disadvantaged in his or her employment as a result of making the disclosure.
- Confidentiality. Anyone to whom the disclosure was made must use his or her best endeavours not to disclose information that might identify the individual (unless the individual’s consent is obtained or there is a reasonable belief that disclosure of identity is essential to the investigation or the principles of natural justice).
- Immunity from civil or criminal liability. The individual cannot be sued for making a protected disclosure.
Upon receipt of a protected disclosure, an organisation has 20 working days to take action, and failure to do so entitles an individual to make further disclosure to an appropriate authority.
There are no financial incentive schemes for whistleblowers in New Zealand.
29What rights does local employment law confer on employees whose conduct is within the scope of an investigation? Is there any distinction between officers and directors of the company for these purposes?
Under the Employment Relations Act 2000, an employee may be dismissed or disadvantaged (when in ongoing employment) lawfully only if the employer can justify its action. The test for justification is whether the employer’s actions were what a fair and reasonable employer could have done in all the circumstances at the time the action occurred. This is an objective test, which requires an employer’s actions to be both substantively justified and procedurally fair.
Characteristics of a fair process in relation to an allegation of misconduct include (but are not limited to):
- conducting a sufficient investigation, having regard to the resources available;
- advising the employee of the nature of the allegations against him or her;
- providing all relevant information and an opportunity to provide feedback;
- providing an opportunity for the employee to be supported by a support person or other representative; and
- genuine consideration of feedback provided by the employee prior to making a decision.
If an employer is unable to justify an action (according to the test above), the employee has a personal grievance. Potential remedies for a successful personal grievance include reinstatement, reimbursement of lost remuneration, and compensation for hurt and humiliation.
Good faith obligation to employees
Both employers and employees owe each other a duty of good faith. This duty includes not doing anything that directly (or indirectly) misleads or deceives (or is likely to mislead or deceive) the other. This also requires parties to be active and constructive in establishing and maintaining a productive employment relationship as well as being responsive and communicative.
Specifically, when an employer proposes to make a decision that will, or is likely to, have an adverse effect on the continuation of employment, the employer has a good faith duty to provide the affected employee with all relevant information. The employer must also provide the employee with the opportunity to comment on the information.
Directors and officers
If a director is also an employee, the above obligations apply with regard to the employment relationship. All directors will also be subject to obligations under the Companies Act 1993, including duties to act in good faith, to act in the best interests of the company and to exercise the care, diligence and skill of a reasonable director in the same circumstances. Failure to comply with such duties may result in additional consequences.
30Do employees’ rights under local employment law differ if a person is deemed to have engaged in misconduct? Are there disciplinary or other steps that a company must take when an employee is implicated or suspected of misconduct, such as suspension or in relation to compensation?
The employment rights described at question 29 apply to an employee who is the subject of an investigation regardless of whether misconduct is ultimately found to have occurred. If an employee is dismissed as a result of misconduct, the justification test will apply to the employer’s actions. Good faith obligations apply for the duration of the employment relationship regardless of the reason for termination.
There is no requirement for an employer to suspend an employee who is implicated or suspected of misconduct. However, suspension may be lawful, provided the employee’s employment agreement contains a power to suspend, a dismissible action has been alleged and a fair process is followed.
For a dismissal to be lawful, a full and fair disciplinary process must be followed including (as discussed at question 29) putting the relevant allegations to the employee and seeking the employee’s feedback prior to making a decision to dismiss.
31Can an employee be dismissed for refusing to participate in an internal investigation?
An employee can only be dismissed for refusing to participate in an internal investigation if such a refusal constitutes a failure to follow a lawful and reasonable instruction from the employer. Whether this is the case will depend on whether participation in the investigation is within the scope of the employee’s role.
Generally, as discussed at question 29, the justification test and good faith obligations apply to all disciplinary processes or other actions taken by an employer against an employee.
Commencing an internal investigation
32Is it common practice in your country to prepare a document setting out terms of reference or investigatory scope before commencing an internal investigation? What issues would it cover?
There is a range of practices in New Zealand depending on the legal representatives engaged. However, it is good practice to draw up written terms of reference. This is particularly the case when an external party is being instructed and there is a desire to ensure a tight rein is kept on the scope of the investigation.
The key purposes of a terms of reference document include:
- setting out very clearly the aims of the investigation;
- defining the scope of the investigation, in terms of both the issues to be covered and any proposed limitations in terms of access to people or documents;
- recording who is conducting the investigation and to whom in the company (and in what form – written or oral) they are to report; and
- setting time frames.
Privilege should be a key consideration when drafting the terms of reference. When litigation privilege may be claimed over a report, the terms of reference should record that the company anticipates proceedings and that the dominant purpose of the investigation is preparing for those proceedings. Given privilege is a matter of substance and not form, this alone will not guarantee a claim of privilege is successful. Further, the terms of reference will also need to be implemented as intended for privilege to attach.
33If an issue comes to light prior to the authorities in your country becoming aware or engaged, what internal steps should a company take? Are there internal steps that a company is legally or ethically required to take?
A company should obtain prompt legal advice on the issue, and should consider matters such as:
- notifying insurers;
- preserving claims against or minimising liabilities to other parties;
- identifying any other jurisdictions and regulators potentially relevant to the issue;
- continuous disclosure obligations;
- any legal obligations to report or regulator policies encouraging self-reporting;
- protecting whistleblowers;
- commencing employment investigations; and
- document preservation.
34What internal steps should a company in your country take if it receives a notice or subpoena from a law enforcement authority seeking the production or preservation of documents or data?
Upon receipt, the notice or subpoena should be sent to the appropriate person or persons, which will usually include the general counsel. We recommend acknowledging receipt of the notice immediately, indicating that the notice will be considered and that the recipient will revert with any questions or concerns as to the scope or timelines set out in the notice. An initial assessment of the legal basis for the notice (for instance, to check whether it is a voluntary or compulsory request, whether it is validly issued and whether there are any confidentiality obligations) is recommended.
Consideration should then be given to which documents and other materials may respond to the notice or subpoena, and steps should be taken to preserve and hold those documents and materials. Consideration should also be given to how best to address the request, for example keyword searching across date ranges. Issues of privilege, data privacy and (where applicable) bank secrecy and contractual confidentiality obligations should be considered (noting there may be particular issues if a voluntary notice is issued).
Once a plan is developed as to how to respond in terms of process, we typically recommend checking the approach to be adopted with the requestor and explaining any difficulties foreseen in terms of completing what is required within the time frame set in the notice.
The company may be required to take steps to preserve documents and data prior to the receipt of a notice or a subpoena if earlier correspondence with the law enforcement authority suggests a proceeding may be commenced. An obligation to preserve documents exists from the time a court proceeding is reasonably contemplated. Particular consideration should be given to automated document deletion practices as electronic documents must be preserved in a retrievable format even when they would otherwise be deleted in the ordinary course of business.
35At what point must a company in your country publicly disclose the existence of an internal investigation or contact from a law enforcement authority?
Companies publicly listed on the New Zealand Exchange must disclose material information immediately. ‘Material information’ means information that:
- a reasonable person would expect, if it were generally available to the market, to have a material effect on the price of the issuer’s quoted securities; and
- relates to particular securities, a particular issuer or particular issuers, rather than to securities generally, or issuers generally.
Some exceptions to the continuous disclosure obligation apply, notably where information is generated for internal management purposes, or comprises matters of supposition or is insufficiently definite to warrant disclosure. Legal advice is recommended on the application of continuous disclosure rules to a particular internal investigation or contact from law enforcement.
Privately owned companies are not required to publicly disclose the existence of internal investigations or contact from law enforcement.
36How are internal investigations viewed by local enforcement bodies in your country?
New Zealand regulators and enforcement agencies are typically not opposed to internal investigations that would not impede a criminal investigation. However, if a matter becomes known to an authority before the internal investigation has begun or been concluded, some caution is necessary. At present, New Zealand regulators and enforcement agencies provide less formal guidance on the appropriateness and expectations around internal investigations than in some other jurisdictions.
37Can attorney–client privilege be claimed over any aspects of internal investigations in your country? What steps should a company take in your country to protect the privilege or confidentiality of an internal investigation?
In some circumstances, where an investigation is conducted by lawyers and comprises confidential legal advice, or an investigation is conducted for the dominant purpose of preparing for contemplated court proceedings, privilege may be claimed over aspects of the investigation. A company should take legal advice on the applicability of privilege before commencing an internal investigation. Where privilege attaches, the relevant communications or work-product must be kept confidential to preserve privilege.
38Set out the key principles or elements of the attorney–client privilege in your country as it relates to corporations. Who is the holder of the privilege? Are there any differences when the client is an individual?
Under the Evidence Act 2006, legal advice privilege attaches to communications between a person and their legal adviser if:
- the communication was intended to be confidential; and
- it was made in the course of, and for the purpose of the person obtaining professional legal services from the legal adviser, or the legal adviser giving such services to the person.
Corporations can be persons for the purposes of the Evidence Act. The same privilege applies to individuals.
39Does the attorney–client privilege apply equally to in-house and external counsel in your country?
Yes, so long as the in-house or external counsel holds a current practising certificate. Privilege may attach to communications to or from an in-house lawyer, provided that the in-house lawyer holds a current practising certificate, and provided that the communications were intended to be confidential and were made in the course of, and for the purpose of, the person obtaining professional legal services. Privilege may also apply to lawyers of certain named overseas jurisdictions.
40Does the attorney–client privilege apply equally to advice sought from foreign lawyers in relation to (internal or external) investigations in your country?
The provisions in the Evidence Act 2006 pertaining to attorney-client privilege are sufficiently broad to cover advice given by overseas practitioners as defined in that Act.
41To what extent is waiver of the attorney–client privilege regarded as a co-operative step in your country? Are there any contexts where privilege waiver is mandatory or required?
The concept of limited waiver of attorney–client privilege is recognised as a potential step, but there are no specific policies or contexts where it is expected by regulators as a matter of course.
42Does the concept of limited waiver of privilege exist as a concept in your jurisdiction? What is its scope?
The concept of limited waiver is recognised in New Zealand. The Evidence Act 2006 provides that a person who has legal advice or litigation privilege (for instance) may waive that privilege either expressly or impliedly. The Act sets out those situations where privilege will be deemed to be waived generally if the privilege holder:
- (or anyone with the authority of that person) voluntarily produces or discloses, or consents to the production or disclosure of, any significant part of the privileged communication, information, opinion or document in circumstances that are inconsistent with a claim of confidentiality;
- acts so as to put the privileged communication, information, opinion or document at issue in the proceeding; or
- institutes a civil proceeding against a person who is in possession of the privileged communication, information, opinion or document, the effect of which is to put the privileged matter at issue in the proceeding.
In cases of limited waiver, therefore, care needs to be taken, particularly regarding the first bullet point above, by ensuring that confidentiality is maintained over the material.
43If privilege has been waived on a limited basis in another country, can privilege be maintained in your own country?
The key consideration will be whether the limited waiver in another country is deemed to amount to a general waiver of privilege (applying the statutory test – see question 42).
44Do common interest privileges exist as concepts in your country? What are the requirements and scope?
This concept exists in New Zealand and is frequently invoked. The provisions of the Evidence Act 2006 dealing with waiver of privilege (see question 42) will govern whether disclosure of privileged information to a person with a common interest is deemed to be a waiver of privilege. Further, it is key to a successful claim to common interest privilege that disclosure should take place in circumstances of confidentiality.
45Can privilege be claimed over the assistance given by third parties to lawyers?
Communications by clients or lawyers with third parties (such as accountants or other experts) may only attract privilege in exceptional circumstances. Either the communication must be for the dominant purpose of preparing for apprehended litigation, or in certain narrow circumstances the third party may be considered to be the agent of the client for the purpose of communications with the lawyer.
46Does your country permit the interviewing of witnesses as part of an internal investigation?
Yes. However, it is important to remain sensitive both to expectations of any other investigating authority and to employee rights.
47Can a company claim attorney–client privilege over internal witness interviews or attorney reports?
Yes, to the extent that any documents fall within the categories of legal advice privilege or litigation privilege, as discussed in questions 32 and 38. This may depend on the context of the investigation, who is conducting the investigation, and any terms of reference under which these persons are engaged.
48When conducting a witness interview of an employee in your country, what legal or ethical requirements or guidance must be adhered to? Are there different requirements when interviewing third parties?
When a witness in an investigation is also an employee, an employer’s actions must be fair and reasonable in all the circumstances and the employer will owe a duty of good faith to the employee (as outlined in question 29). Unless the interview arises in the context of a disciplinary process against the employee, no additional obligations (including in relation to notification or warning) arise.
The duty of good faith applies only to employees and not third parties (including former employees).
49How is an internal interview typically conducted in your country? Are documents put to the witness? May or must employees in your country have their own legal representation at the interview?
The conduct of an internal interview is entirely fact-specific. The employee cannot be misled in relation to the information provided or the questions asked. As a consequence, it is common to put documents to the individual being interviewed. Employees are not required to, but they may have legal representation or a support person present.
Reporting to the authorities
50Are there circumstances under which reporting misconduct to law enforcement authorities is mandatory in your country?
In certain circumstances, it is mandatory to report misconduct to law enforcement authorities in New Zealand. For instance, under the Anti-Money Laundering and Countering Financing of Terrorism Act 2009, financial institutions must report certain suspicious transactions. Under the Companies Act 1993, a liquidator must report to the Registrar of Companies certain offences committed by a company or its directors that are ‘material to the liquidation’. As another example, under the Financial Markets Conduct Act 2013, a number of parties, including an auditor, issuer, supervisor and manager of schemes established under that Act, must report to the Financial Markets Authority the contravention or possible contravention of an issuer’s obligations under that Act, or the likely insolvency of an issuer or a registered scheme.
51In what circumstances might you advise a company to self-report to law enforcement even if it has no legal obligation to do so? In what circumstances would that advice to self-report extend to countries beyond your country?
Relevant considerations for a company in deciding whether to self-report an issue to law enforcement may include the expectations of the relevant agency, whether issues of public health and safety are at risk, and whether agencies in other jurisdictions have been notified.
Like many jurisdictions globally, New Zealand has introduced a leniency policy that provides a cartel participant with immunity from prosecution by the Commerce Commission for its participation in that cartel, as long as that participant is the first party involved in that cartel to come forward to the Commerce Commission, and meets a number of further criteria (such as ongoing co-operation with the Commerce Commission during an investigation). For cartels that have had global effect or implementation, the decision whether to self-report cartel conduct in New Zealand to the Commerce Commission is often made in coordination with legal counsel in other jurisdictions, as it is often important to know the sequence in which jurisdictions leniency applications are made, and to adopt a consistent approach across jurisdictions.
52What are the practical steps you need to take to self-report to law enforcement in your country?
The company or the individual should seek legal advice to ascertain its legal risk, and should satisfy itself as to the appropriate strategy. There are some particular considerations in relation to self-reporting under the Commerce Commission’s leniency policy. Because full immunity is only available for the first applicant to approach the Commerce Commission, and because the Commerce Commission may decline to offer immunity if it has already begun an investigation of its own accord, time is of the essence.
Responding to the authorities
53In practice, how does a company in your country respond to a notice or subpoena from a law enforcement authority? Is it possible to enter into dialogue with the authorities to address their concerns before or even after charges are brought? How?
New Zealand’s transparent approach to government means that agencies are typically open to communication at a range of stages. In practice, companies often enter into dialogue with agencies to clarify the scope of notices and deadlines within which information is requested.
54Are ongoing authority investigations subject to challenge before the courts?
The exercise of a public power (including, for instance, in an ongoing investigation) may in principle be challenged through an application to the High Court for judicial review.
55In the event that authorities in your country and one or more other countries issue separate notices or subpoenas regarding the same facts or allegations, how should the company approach this?
In such an event, counsel should liaise closely with the client’s counsel based in other jurisdictions, to ensure that any concessions or understandings are aligned. However, it will be important to ensure that any disclosure to a New Zealand agency meets the requirements of the notice in New Zealand and that obligations under New Zealand law (including in relation to data privacy and any confidentiality obligations) are properly considered.
Also the agency in question may have information-sharing arrangements in place with its counterparts in other jurisdictions. For example, the Commerce Commission has entered into a number of international agreements with foreign competition and consumer law protection agencies, which provide for co-operation on matters of common interest. Some co-operation agreements allow the Commerce Commission to share compulsorily obtained information with overseas regulators even without the party’s consent.
56If a notice or subpoena from the authorities in your country seeks production of material relating to a particular matter that crosses borders, must the company search for, and produce material, in other countries to satisfy the request? What are the difficulties in that regard?
There is often an expectation that a New Zealand company will search for information within its control, even if it is located in another country. However, data protection laws and blocking statutes in other jurisdictions may present legal obstacles to adopting such an approach.
57Does law enforcement in your country routinely share information or investigative materials with law enforcement in other countries? What framework is in place in your country for co-operation with foreign authorities?
There are formal mechanisms for New Zealand law enforcement to provide mutual legal assistance to other governments in criminal investigations and prosecutions. Formal mutual legal assistance by the New Zealand government is governed, largely, by the Mutual Assistance in Criminal Matters Act 1992. The New Zealand Police provide informal, police-to-police co-operation to other countries’ police forces. In addition, agencies such as New Zealand’s Serious Fraud Office and the Commerce Commission have entered into memoranda of understanding enabling the sharing of information with their counterparts in other countries.
58Do law enforcement authorities in your country have any confidentiality obligations in relation to information received during an investigation or onward disclosure and use of that information by third parties?
New Zealand agencies such as the Financial Markets Authority, Commerce Commission and Serious Fraud Office are bound by their empowering statutes to maintain a limited standard of confidentiality with respect to information obtained during their investigations. This prohibits publication or disclosure of the information or documents unless the disclosure falls within one of the listed exceptions. Where the party who provided the information consents, or the publication can be justified in light of the purposes of the empowering statute, publication may be permitted.
59How would you advise a company that has received a request from a law enforcement authority in your country seeking documents from another country, where production would violate the laws of that other country?
Generally, a company may wish to consider entering into a dialogue with the relevant New Zealand agency as early as possible to explain that it is prohibited from making the disclosure under the laws of another country.
60Does your country have secrecy or blocking statutes? What related issues arise from compliance with a notice or subpoena?
New Zealand’s data protection laws are primarily set out in the Privacy Act 1993. This sets out 12 data protection principles that apply to both public and private sector entities. These principles are generally similar to those underlying the data protection laws of other developed countries – the Privacy Act was heavily influenced by the Guidelines Governing the Protection of Privacy and Transborder Flows of Data issued by the Organisation for Economic Co-operation and Development in 1980.
A company conducting an investigation will have various obligations in relation to the collection, use, storage, accuracy and disclosure of personal information. Under the Privacy Act, an individual can make a data access request requiring the recipient to provide all personal information held about that individual (subject to limited exceptions).
For the purposes of Article 25(2) of Directive 95/46/EC (the Data Protection Directive), the European Commission has recognised New Zealand as ensuring an adequate level of protection for personal data transferred from the European Union. The effect is that personal data can flow from any of the EU Member States or the three Member States of the European Economic Area to New Zealand without any further safeguard being necessary.
61What are the risks in voluntary production versus compelled production of material to authorities in your country? Is this material discoverable by third parties? Is there any confidentiality attached to productions to law enforcement in your country?
A company should consider whether providing information voluntarily means (under the particular statute involved) that there is a broader range of circumstances in which the information can be used against it in court proceedings. However, in some contexts, providing information voluntarily will mean that it cannot be shared with overseas regulators without a waiver. There may be circumstances in which compelled production is preferable in light of the risks to the company of breaching confidentiality, bank secrecy or data privacy obligations.
As noted in question 58, New Zealand agencies such as the Financial Markets Authority, Commerce Commission and Serious Fraud Office are bound by their empowering statutes to maintain a limited standard of confidentiality with respect to information obtained during their investigations.
Third parties may make information requests to certain public agencies under the Official Information Act 1982. However, if an investigation is ongoing or the information was provided confidentially, the agency may have grounds, in certain circumstances, to withhold the information.
Prosecution and penalties
62What types of penalties may companies or their directors, officers or employees face for misconduct in your country?
The penalties for criminal offences in New Zealand include fines and imprisonment. Multiple corporate regulatory statutes allow agencies to take a range of enforcement actions. Notably, a number of agencies may bring civil proceedings seeking pecuniary penalties against companies and individuals. In some circumstances, individuals can be debarred from (for instance) being a director or being involved in the management of a company.
63Where there is a risk of a corporate’s suspension, debarment or other restrictions on continuing business in your country, what options or restrictions apply to a corporate wanting to settle in another country?
There is no legislative regime for suspension and debarment from government contracts in New Zealand. However, under the Government Rules of Sourcing, a government agency may exclude a supplier from participating in a contract if there is a good reason for exclusion, which includes conviction for a serious crime or offence.
64What do the authorities in your country take into account when fixing penalties?
Authorities must have regard to binding or relevant sentencing principles when fixing penalties for conviction of a criminal offence. Factors the courts have had regard to include:
- level of culpability;
- harm to victims (investors or the ‘nation’);
- previous character;
- co-operation or assistance with the investigation; and
- whether a guilty plea was entered and at what stage.
Similar factors have been taken into account in fixing civil pecuniary penalties. In deciding what enforcement action to take, an agency will also be guided by the principles set out in its own enforcement policies.
Resolution and settlements short of trial
65Are non-prosecution agreements or deferred prosecution agreements available in your jurisdiction for corporations?
Some New Zealand agencies (such as the Financial Markets Authority) may obtain ‘enforceable undertakings’. An advantage for the company concerned is that they can form part of a settlement and thereby avoid immediate court action. A potential disadvantage is the risk of future breach of the undertaking, as the agency may bring court proceedings for breach of the undertaking itself.
66Does your jurisdiction provide for reporting restrictions or anonymity for corporates that have entered into non-prosecution agreements or deferred prosecution agreements until the conclusion of criminal proceedings in relation to connected individuals to ensure fairness in those proceedings?
New Zealand does not have non-prosecution or deferred prosecution agreements. However, in general, the Criminal Procedure Act 2011 provides that a court may grant an order preventing the publication of the identity of any person connected with criminal proceedings or the accused. It may grant such an order if (for example) the publication would be likely to cause undue hardship to the connected person.
Additionally, the Financial Markets Authority and Commerce Commission each have broad powers to make orders prohibiting the publication or communication of any information, document or evidence that is provided or obtained in connection with certain activities of the regulators, including investigations.
67Prior to any settlement with a law enforcement authority in your country, what considerations should companies be aware of?
Relevant considerations will include the risks of enforcement action if a settlement is not entered into, the nature of the potential enforcement action that may be taken, the strength of the company’s potential defence, any reputational risks, whether all relevant agencies are involved in the settlement, whether confidentiality is available, and whether any issues are raised in other jurisdictions as a result of either the settlement or the possible enforcement action.
68To what extent do law enforcement authorities in your country use external corporate compliance monitors as an enforcement tool?
The term ‘corporate compliance monitor’ is not used within the New Zealand regulatory environment. However, regulators may in instances either using their specific statutory powers or in the context of negotiating settlements or enforceable undertakings with parties require independent oversight of a company’s compliance programme. For example, section 95 of the Reserve Bank of New Zealand Act 1989 gives the Reserve Bank of New Zealand the power to require a bank to provide a report by a Reserve Bank of New Zealand-approved, independent person. These reviews can investigate such issues as risk management, corporate or financial matters, and operational systems.
69Are parallel private actions allowed? May private plaintiffs gain access to the authorities’ files?
Civil claims by private parties running parallel to agency investigations and action are generally possible. The courts may allow a plaintiff in parallel proceedings access to authorities’ files. However, particularly where the information sought is of a confidential or commercially sensitive nature, there will often be obstacles to obtaining this information.
Publicity and reputational issues
70Outline the law in your country surrounding publicity of criminal cases at the investigatory stage and once a case is before a court.
When materials are published in the period leading up to or during a proceeding, the publication of those materials could amount to contempt of court when there is a real risk that it interferes with the administration of justice.
71What steps do you take to manage corporate communications in your country? Is it common for companies to use a public relations firm to manage a corporate crisis in your country?
Both communications specialists within the company itself and external public relations consultants are routinely used to manage a corporate crisis in New Zealand.
Generally, the chief executive officer is the company spokesperson and manages messaging in conjunction with the board or with internal communications or public relations teams. In-house and external counsel may also be called on to advise in some circumstances. Some organisations may consult external public relations specialists, particularly if they do not have the expertise in-house, in the face of a crisis.
72How is publicity managed when there are ongoing related proceedings?
Companies often decline to comment on matters where there are proceedings before the courts. A key consideration tends to be the continuous disclosure obligations of listed issuers of securities.
If information can be disclosed to the public, companies may opt to distinguish between the facts found and the legal consequences. Careful consideration is required, particularly regarding any confidential obligations (such as bank secrecy obligations) when dealing with a voluntary disclosure and whether customer information can be redacted. It may be better for the purposes of public relations to wait until disclosure is required by law.
Duty to the market
73Is disclosure to the market in circumstances where a settlement has been agreed but not yet made public mandatory?
There are exceptions to the New Zealand Exchange requirements to disclose material information to the market when information is either confidential or concerns an incomplete negotiation or proposal.
74Do you expect to see any key regulatory or legislative changes emerge in the next year or so designed to address corporate misconduct?
The New Zealand government is currently considering further regulation in the financial services sector to include new entity-level obligations to ensure that customers are treated fairly throughout an institution’s relationships with those customers and a corresponding directors and senior managers regime (potentially akin to the UK Senior Managers Regime or Australian Bank Executive Accountability Regime) to span both prudential and conduct requirements.
In April 2019, the New Zealand government criminalised cartel conduct. From April 2021, individuals who intentionally engage in cartel conduct are liable on conviction to imprisonment for a term not exceeding seven years or a fine not exceeding NZ$500,000 (or both).
1 Polly Pope, Kylie Dunn and Emmeline Rushbrook are partners at Russell McVeagh.