Blind hiring is rising in New Zealand as agencies aim to reduce bias and comply with evolving privacy laws. But knowing exactly what information to remove from CVs, what the law requires, and how this differs from other ANZ jurisdictions can be tricky.
TL;DR
New Zealand's Human Rights Act 1993 protects candidates from discrimination based on specific personal attributes. The Privacy Act 2020 tightens how agencies collect, use, and disclose candidate information. Agencies generally need to remove identifying details like names and photos before submitting CVs to clients. Differences with Australian law mean you can't apply the same compliance checklist for both countries. A practical checklist helps reduce risk and maintain compliance.
The Human Rights Act 1993: protected grounds
The Human Rights Act 1993 prohibits discrimination in employment based on certain protected grounds. For recruitment agencies, this means avoiding any action or decision that may disadvantage candidates due to:
- Age
- Sex (including pregnancy and childbirth)
- Race
- Colour
- Ethnic or national origins
- Disability
- Marital status
- Family status
- Religious or ethical belief
- Political opinion
- Employment status
- Sexual orientation
- Gender identity and expression
When submitting CVs to clients, agencies typically remove or mask information that could reveal these attributes to reduce unconscious bias. The Act applies to the entire recruitment process and holds agencies responsible for discriminatory practices, even if the client makes the final hire.
While the Act doesn't explicitly mandate blind hiring, it supports practices that help eliminate discriminatory bias.
Privacy Act 2020: what changes for recruiters
The Privacy Act 2020 replaced the 1993 Act and introduced more stringent rules around personal information handling. For recruitment agencies, key changes include:
- Stronger accountability: Agencies must take reasonable steps to ensure candidate data is accurate, secure, and only used for the intended purpose.
- New privacy principles: Recruitment data collection and disclosure must comply with the 13 Information Privacy Principles (IPPs), including transparency on how data is used.
- Mandatory breach reporting: Serious privacy breaches must be reported to the Privacy Commissioner and affected individuals.
- Cross-border data transfers: Agencies must ensure overseas clients or partners have adequate privacy protections.
Recruiters generally need to inform candidates about how their information will be processed and obtain consent where necessary. The Act also limits the retention of personal data beyond what is reasonably required.
What agencies must remove before client submission
To matches blind hiring practices under New Zealand law, agencies commonly remove or redact:
- Candidate name
- Date of birth or age
- Gender markers
- Photographs or images
- Ethnic or national origin details
- Marital or family status information
- Religious or political affiliations
- Any other details that might reveal protected status
This reduces risk of discrimination claims and helps clients focus on skills and experience alone. Some roles may require limited exceptions (e.g., gender for safety-sensitive positions), which should be documented and justified.
Redacting this information manually can be time-consuming and error-prone. Tools like Distill strip name, email, phone, photo, and graduation year automatically before submission, helping maintain compliance efficiently.
NZ vs Australian law: key differences
Although Australia and New Zealand share some recruitment compliance principles, differences matter:
| Aspect | New Zealand | Australia |
|---|---|---|
| Discrimination law | Human Rights Act 1993 covers many protected grounds including employment status and family status | Anti-Discrimination Acts vary by state, with some differences in protected attributes |
| Privacy regulation | Privacy Act 2020 with 13 IPPs; mandatory breach reporting | Privacy Act 1988, with APPs; breach reporting mandatory since 2018 |
| Blind hiring practices | No explicit blind hiring mandate but encouraged to prevent bias | Some states have specific guidance promoting blind hiring |
| Cross-border data | Stricter rules on overseas data transfers | Similar rules but vary by jurisdiction |
| Enforcement | Privacy Commissioner and Human Rights Commission | Office of the Australian Information Commissioner and state bodies |
Agencies operating trans-Tasman shouldn't assume compliance in one country covers the other. Tailoring processes to NZ law reduces liability.
Practical compliance checklist
- Review all candidate CVs before client submission for protected information.
- Remove or redact name, age, gender, photo, ethnicity, marital or religious details.
- Keep records of what is removed and why, for audit trails.
- Inform candidates upfront about what data you collect and how it will be used.
- Obtain explicit consent where required, especially for sensitive information.
- Ensure client contracts include clauses on handling personal data and non-discrimination.
- Train recruiters on blind hiring principles and Privacy Act requirements.
- Use software tools to automate redaction and reduce human error.
- Monitor any privacy breaches and have a response plan matching the Privacy Commissioner's guidelines.
- Regularly review policies against updates in NZ law and best practice.
FAQ
Q: Does the Privacy Act 2020 require anonymising CVs completely? No. The Act requires reasonable steps to protect personal information. Anonymising or redacting identifying details before client submission is a common measure but must be balanced against the client's legitimate need for candidate information.
Q: Can I share candidate information with overseas clients? Yes, but only if the overseas recipient has comparable privacy protections or if you have obtained consent. The Privacy Act 2020 limits cross-border data transfers without adequate safeguards.
Q: Is blind hiring mandatory in New Zealand? Not explicitly. The Human Rights Act 1993 and Privacy Act 2020 promote non-discrimination and privacy, which blind hiring supports. Many agencies adopt it to reduce risk, but it isn't a legal requirement.
Q: How do I handle exemptions for roles requiring specific attributes? Document the business justification clearly, limit data shared to what is necessary, and ensure consistent application to avoid discrimination claims.
Q: Are there penalties for non-compliance? The Privacy Commissioner can investigate breaches and require corrective action. The Human Rights Commission can handle discrimination complaints, which may lead to settlements or damages.
If you're regularly submitting CVs to New Zealand clients, automating the removal of personal details reduces compliance risk and saves time. Distill strips the name, email, phone, photo, and graduation year from CVs before submission, helping your agency meet blind hiring expectations and privacy obligations. Try Distill free today.