In an emergency situation like Covid-19, government responders may need to rapidly share personal information about individuals to limit the spread of the virus, or to mitigate its effects on individuals.

The Civil Defence National Emergencies Code 2013, issued under the Privacy Act, allows this to happen in a controlled way while the country is in a state of national emergency (plus 20 working days after the emergency ends).

We have been pleased to see public discussion about the code by academics and practitioners, which we discuss below.

To recap - how does the code work?

As outlined in our earlier blogpost, the Code provides authority for agencies to collect, use or disclose personal information during a state of national emergency for purposes directly related to the government’s response to this emergency (in this case, Covid-19).  

Collecting, using or disclosing personal information is permitted for this purpose, so long as the relevant agencies reasonably believe all of the following criteria are met:

• the individual concerned may be involved in the national emergency – as all New Zealanders are currently affected, this could be anyone in New Zealand;
• the collection, use or disclosure is for a purpose that directly relates to the government or local government management of response to, and recovery from, the state of national emergency caused by the Covid-19 pandemic; and
• in the case of a disclosure, the personal information is disclosed to one of the following agencies:
• a public sector agency;
• an agency that is, or is likely to be, involved in managing or assisting in the management of the emergency; or
• an agency directly involved in providing repatriation, health, financial or other humanitarian assistance services to individuals involved in the emergency.

This means that in situations where an individual’s authorisation would usually be required under the Privacy Act before collecting, using or disclosing their personal information in relation to Covid-19, agencies can use the Code as legal authority, subject to the limits above.

Finding out more about the code

If you need to find out more, you can consult these resources.

There is analysis from Richard Best Law recognising the code as a powerful tool for information sharing when responding to Covid-19 and enabling agencies to act quickly.

The commentary provides some analysis of how the code works in the context of Covid-19 and whether the Code is clear enough.

We agree with this analysis that:

• the code modifies the information privacy principles (IPPs) that deal with collection, use and disclosure;
• other IPPS will still operate (security, access and correction, accuracy and retention); and
• any relevant legal prohibitions to collection, use and disclosure of personal information in other legislation besides the Privacy Act will still operate and need to be taken into account.

At a Victoria University of Wellington law school panel, “the legal low-down on the lockdown”, lecturer Marcin Betkier gives an overview about the Code.

Contact us

If you have any questions of comments about this emergency code of practice and how it could be used in the fight against Covid-19, you can contact us.

You can send us your comments about the Code and there will be a chance to contribute during public consultation on the updated code later in the year ahead of its re-issue under the Privacy Act 2020.

Covid-19