Note: This content was specific to the 2020 COVID-19 outbreak. There is no current state of national emergency. 

On 25 March 2020, the Minister of Civil Defence Peeni Henare declared a state of national emergency under the Civil Defence Emergency Act 2002 in response to the Covid-19 pandemic. 

Along with a range of other special powers, a state of national emergency triggers the operation of the Civil Defence National Emergencies (Information Sharing) Code 2013 under the Privacy Act 1993.

This Code provides authority for agencies to collect, use or disclose personal information during a state of national emergency for purposes directly related to this emergency. 

In the Covid-19 emergency, agencies can collect, use, or disclose personal information where they reasonably believe all of the following criteria are met:

• the individual concerned may be involved in the national emergency – as all New Zealanders are currently affected, this could be anyone in New Zealand;
• the collection, use or disclosure is for a purpose that directly relates to the government or local government management of response to, and recovery from, the state of national emergency caused by the Covid-19 pandemic; and
• in the case of a disclosure, the personal information is disclosed to one of the following agencies:
  • a public sector agency;
  • an agency that is, or is likely to be, involved in managing or assisting in the management of the emergency; or
  • an agency directly involved in providing repatriation, health, financial or other humanitarian assistance services to individuals involved in the emergency.

This means that in situations where an individual’s authorisation would usually be required before collecting, using or disclosing their personal information in relation to Covid-19, agencies can use the Civil Defence Code as legal authority, subject to the limits above.

For example, employers can now disclose required employee information to the Ministry of Social Development to access the government wage subsidy without obtaining prior employee authorisation.

When dispensing with individual authorisation, the Privacy Commissioner encourages agencies to follow up with individuals to notify them about the use of their information once this is reasonably practicable.

It is important to note that agencies are only permitted the additional latitude under the Civil Defence Code in order to manage or respond to Covid-19. There are limits in the Privacy Act on using this personal information for any other purpose.

Notes:

• The Civil Defence Code does not restrict the application of any other relevant statutory authority, code of practice, or any of the information privacy principles.
• The Code does not affect the usual rules applying to disclosures to the news media.
• The Civil Defence Code will remain in force for a further 20 days after the expiry of the state of national emergency.  

Covid-19