Any privacy law companies can contract out of in their T&Cs effectively doesn't exist. This is the privacy equivalent of security theatre, not robust privacy protection.
"...the entities will be able to contract out of the notification process via their terms and conditions."
#MarcDaalder, 2023
https://www.newsroom.co.nz/law-change-will-tell-you-when-your-data-is-sold