Version as at 6 December 2023 (ii) (2) Privacy Act 2020 Part 3 s 28 regulates the manner in which personal information may be obtained or made available. An action taken by an agency does not breach IPPs 1 to 5, 7 to 10, or 13 if the action is authorised or required by or under New Zealand law. Compare: 1993 No 28 s 7(1), (2), (4) 25 IPPs 1 to 4 do not apply to personal information collected before 1 July 1993 IPPs 1 to 4 do not apply to personal information collected before 1 July 1993. Compare: 1993 No 28 s 8(1) 26 Restricted application of IPP 13 to unique identifiers assigned before 1 July 1993 (1) IPP 13(1) to (4)(a) does not apply to unique identifiers assigned before 1 July 1993. (2) However, IPP 13(2) applies to the assignment of a unique identifier on or after 1 July 1993 even if the unique identifier assigned is the same as that assigned by another agency before that date. Compare: 1993 No 28 s 8(5), (6) 27 Restricted application of IPPs to personal information collected or held for personal or domestic affairs (1) IPPs 1 to 3 and 4(b) do not apply to an agency if that agency— (2) (3) (a) is an individual; and (b) is collecting personal information solely for the purposes of, or in con‐ nection with, the individual’s personal or domestic affairs. IPPs 5 to 12 do not apply to an agency if that agency— (a) is an individual; and (b) is holding personal information that was collected by a lawful means solely for the purposes of, or in connection with, the individual’s per‐ sonal or domestic affairs. However, the exemptions in subsections (1) and (2) do not apply if the collec‐ tion, use, or disclosure of the personal information would be highly offensive to a reasonable person. Compare: 1993 No 28 s 56 28 IPPs 2, 3, and 4(b) do not apply to personal information collected by intelligence and security agencies IPPs 2, 3, and 4(b) do not apply to personal information collected by an intelli‐ gence and security agency. Compare: 1993 No 28 s 57 33