The right to privacy remains fundamental in the government’s pandemic response. When asked whether we have to choose between a good pandemic response or having privacy, New Zealand’s former Privacy Commissioner John Edwards responded in a media interview:

"We should be saying, I reject that, I want both. I want to contribute to the management of the pandemic and I will give up freedoms to do so on the condition that my privacy is respected as we do so. Those pressures to frame the need to give up rights in ways that simplify, I think, need to be resisted constantly."

The Privacy Act and the Health Information Privacy Code contain a process for pandemic decision-making to make sure that personal information, including health information, is able to be used as necessary for the pandemic response, while ensuring that people’s privacy is protected.

After two consecutive High Court judicial review decisions in November and December 2021, the Director-General of Health modified his decision about the release of data of unvaccinated Māori in the North Island/ Te Ika a Māui to the Whānau Ora Commissioning Agency – the data being subsequently released with clear conditions.

As an independent intervenor in the proceedings, the Privacy Commissioner provided specialist insight into aspects of privacy, personal information, and the Health Information Privacy Code.

The judicial review resulted in two consecutive decisions from Her Honour Justice Gwyn and include the first (and second) judicial consideration in Aotearoa New Zealand of the “serious threat to public health” exception under rule 11 of the Code.

Further information about the judicial review plus the Privacy Commissioner's submissions is available here in our online case note and court decisions section.

The Privacy Commissioner welcomes the Court’s decisions as they give guidance about the scheme of the Privacy Act and the Code, discretionary decision-making about releasing data where there is a serious threat to public health, and how te Tiriti o Waitangi and tikanga Māori respectively influence the exercise of this discretion.  

The judge’s analysis is consistent with our Office’s view on the application of the Code and the Act. The Court has agreed with the Privacy Commissioner’s approach that the purpose of the Privacy Act is concerned with both the protection and use of personal information: it is a “how to”, not a “don’t do”.

The “serious threat to public health” exception is highly relevant in the government’s pandemic decision making and an important component of the privacy framework. The Court agreed with the Commissioner’s submissions that urgent decision-making within a tight timeframe cannot be a “counsel of perfection” before information is disclosed in response to an evident threat to public health. The Court required the Ministry to reconsider its response to the requests for vaccination data based on an evidence-based assessment.

The Act and Code empower appropriate sharing of personal information under the information privacy principles (including health information under the Code rules) where necessary in specific circumstances such as the pandemic.

This case is a reminder that neither the Act nor the Code necessarily pose insurmountable barriers to disclosing and using personal information in the public interest – especially if necessary to respond to a public health emergency. The Code requires proportionate and evidence-based assessments when deciding whether to rely on rule 11(2) to disclose specific health information. Government decisions about disclosing sensitive information like vaccination data that is necessary for the pandemic response should refer to relevant public health advice to make an objective and evidence-based assessment.

At the heart of these proceedings are government decisions about the use of Māori data in responding to the pandemic and mitigating the serious public health risk and specific risk to Māori. This raised important questions about the role of tikanga Māori in the Ministry’s decision-making process with tikanga evidence before the Court, from Dr Carwyn Jones and Lady Tureiti Haroumi Moxon that the highly prized taonga of health has primacy in the pandemic context:

There is taonga in life and health. If there is taonga in data, then that taonga must give way to life and health. Providing the contact details of unvaccinated Māori provides the best chance of respecting the taonga of their life and health.

The Court also examined the Ministry’s discretion to disclose Māori data in terms of its expressed commitment to exercise its powers in relation to the vaccine rollout in accordance with Te Tiriti o Waitangi.

The Office of the Privacy Commissioner takes account of cultural perspectives on privacy under section 21(c) of the Act). Te Tiriti o Waitangi/Treaty of Waitangi is considered a founding document and the text(s) and the principles of partnership, active protection and equity help guide the work of the Office of the Privacy Commissioner. The Court’s discussion of te Tiriti o Waitangi, tikanga Māori and Māori data sovereignty respectively will further help to inform our Office’s approach.

Te Ao Māori, Covid-19