14 Feb 2023, 13:00

Note: The Civil Defence National Emergencies (Information Sharing) Code applies in all areas where a national state of emergency has been declared. www.beehive.govt.nz/releases is a good place to check for new regions that have been added or removed.

A state of national emergency has been declared to assist with the response to Cyclone Gabrielle. 

The declaration applies to the six regions that have already declared a local state of emergency: Northland, Auckland, Tairāwhiti, Bay of Plenty, Waikato, and the Hawke’s Bay. 

The declaration triggers the Civil Defence National Emergencies (Information Sharing) Code 2020, under the Privacy Act 2020.

Privacy Commissioner Michael Webster says a state of national emergency allows agencies to collect, use or disclose personal information for purposes directly related to the government and local government’s response to the emergency.

“It is an incredibly stressful time for many people, especially those in the six regions. This code of practice was created to make it easier for government agencies and local government teams to work together in a safe, planned way.

“We are ready to support agencies on interpretation of the code to reflect the current situation. They can reach out to my team via our media desk.”

In this emergency, agencies can collect, use, or disclose personal information where they reasonably believe all the following criteria are met:

• The individual concerned may be involved in the emergency.
• The collection, use or disclosure is for a purpose that directly relates to the Government or local government management of response to, and recovery from, the emergency.
• In the case of a disclosure, the personal information is disclosed to one of the following agencies: a public sector agency; an agency that is, or is likely to be, involved in managing or assisting in the management of the emergency; or an agency directly involved in providing repatriation, health, financial or other humanitarian assistance services to individuals involved in the emergency.

This means in situations where an individual’s authorisation would usually be required before collecting, using or disclosing their personal information in relation to the emergency, agencies can use the Civil Defence Code as legal authority, subject to the limits above.

The Privacy Commissioner encourages agencies to follow up with individuals to notify them about the use of their information once this is reasonably practicable.

It is important to note that agencies are only permitted the additional latitude under the Civil Defence Code in order to manage or respond to the emergency. There are limits in the Privacy Act on using this personal information for any other purpose.

The Civil Defence Code as it applies to the specific regions will end on the following dates:

• Bay of Plenty – 28 March 2023 (20 working days after the state of national emergency for this region lapsed on 28 February 2023)
• Northland, Auckland, Waikato CDEM Group areas and Tararua District – 31 March 2023 (20 working days after Minister McAnulty ended the national states of emergency for these regions on 3 March 2023)
• Tairāwhiti and Hawke’s Bay - 13 April 2023 (20 working days after the national states of emergency in relation to these regions ended on 14 March 2023).

For more information or if you’re an agency that requires help please contact the OPC via their media desk: media@privacy.org.nz

Notes:

The Civil Defence Code does not restrict the application of any other relevant statutory authority, code of practice, or any of the information privacy principles. The Privacy Act continues to apply to personal information practices not enabled by the Civil Defence Code.

Read the Civil Defence National Emergencies (Information Sharing) Code 2020 here.