L 28/12 Official Journal of the European Union 30.1.2013 DECISIONS COMMISSION IMPLEMENTING DECISION of 19 December 2012 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by New Zealand (notified under document C(2012) 9557) (Text with EEA relevance) (2013/65/EU) THE EUROPEAN COMMISSION, Having regard to the Treaty on the Functioning of the European Union, Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ('), and in particular Article 25(6) thereof, After consulting the European Data Protection Supervisor Whereas: (1)  Pursuant to Directive 95/46/EC, Member States are required to provide that the transfer of personal data to a third country may take place only if the third country in question ensures an adequate level of protection and if the Member States’ laws implementing other provisions of the Directive are complied with prior to the transfer. (2)  The Commission may find that a third country ensures an adequate level of protection. In that case, personal data may be transferred from the Member States without additional guarantees being necessary. (3)  Pursuant to Directive 95/46/EC the level of data protection should be assessed in the light of all the circumstances surrounding a data transfer operation or a set of data transfer operations and giving particular consideration to certain specified elements relevant for the transfer. (4)  Given the different approaches to data protection in third countries, the adequacy assessment should be carried out, and any decision based on Directive 95/46/EC should be made and enforced in a way that does not arbitrarily or () OJ L 281, 23.11.1995, p. 31. unjustifiably ~ discriminate against or between third countries where like conditions prevail, nor constitute a disguised barrier to trade, regard being had to the Union’s present international commitments. New Zealand is a former British colony. It became an independent Dominion in 1907, but did not formally sever its constitutional ties with Great Britain until 1947. New Zealand is a unitary State and does not have a written constitution in the conventional sense of an entrenched constitutive document. The country is a constitutional monarchy and parliamentary democracy on the Westminster model, with the Queen of New Zealand as the Head of State. New Zealand operates on the principle of Parliamentary sovereignty. Nevertheless, by convention there are a number of statutes that are of particular constitutional importance and are regarded as ‘higher law’. This is in the sense that they form part of the constitutional back- ground or landscape by informing government practice and the enactment of other legislation. Moreover, cross- political consensus would be expected in the event of amendment or repeal of this legislation. Several of these statutes — the Bill of Rights Act of 28 August 1990 (Public Act No 109 of 1990), the Human Rights Act of 10 August 1993 (Public Act No 82 of 1993), and the Privacy Act of 17 May 1993 (Public Act No 28 of 1993) — are relevant to data protection. The constitu- tional importance of this legislation is reflected by the convention that they must be taken into account when developing or proposing new legislation. The legal standards for the protection of personal data in New Zealand are primarily set out in the Privacy Act, as amended by the Privacy (Cross-border Information) Ammendement Act of 7 September 2010 (Public Act No 113 of 2010). It predates Directive 95/46/EC, and is not limited to automatically processed data or structured data in a filing system, but covers all personal information in whatever shape or form. It covers the entire public and private sectors, with a few specific public interest exceptions that one would expect in a democratic society.