28 Jan 2022, 10:02

Note: This was originally a blog post that was reviewed in May 2025 and brought over to the case notes section of our website as a good example of the serious threat to public health exception. That doesn’t come up very often but was important during the Covid-19 pandemic.

The right to privacy remains fundamental in the government’s pandemic response. When asked whether we have to choose between a good pandemic response or having privacy, New Zealand’s former Privacy Commissioner John Edwards responded in a media interview:

"We should be saying, I reject that, I want both. I want to contribute to the management of the pandemic and I will give up freedoms to do so on the condition that my privacy is respected as we do so. Those pressures to frame the need to give up rights in ways that simplify, I think, need to be resisted constantly."

The Privacy Act and the Health Information Privacy Code contain a process for pandemic decision-making to make sure that personal information, including health information, can be used as necessary for the pandemic response, while ensuring that people’s privacy is protected.

After two consecutive High Court judicial review decisions in November and December 2021, the Director-General of Health modified his decision about the release of data of unvaccinated Māori in the North Island/ Te Ika a Māui to the Whānau Ora Commissioning Agency – the data being subsequently released with clear conditions.

As an independent intervenor in the proceedings, the Privacy Commissioner provided specialist insight into aspects of privacy, personal information, and the Health Information Privacy Code.

The judicial review resulted in two consecutive decisions from Her Honour Justice Gwyn and include the first (and second) judicial consideration in Aotearoa New Zealand of the “serious threat to public health” exception under rule 11 of the Code.

Read more about the judicial review as well as the Privacy Commissioner's submissions.

The Court’s decisions gave guidance about:

• the scheme of the Privacy Act and the Code
• discretionary decision-making about releasing data where there is a serious threat to public health
• how te Tiriti o Waitangi and tikanga Māori respectively influence the exercise of this discretion.  

The Court agreed with the Privacy Commissioner’s approach that the purpose of the Privacy Act is concerned with both the protection and use of personal information: it is a “how to”, not a “don’t do”.

The “serious threat to public health” exception is highly relevant in the government’s pandemic decision making and an important component of the privacy framework. The Court agreed with the Commissioner’s submissions that urgent decision-making within a tight timeframe cannot be a “counsel of perfection” before information is disclosed in response to an evident threat to public health. The Court required the Ministry to reconsider its response to the requests for vaccination data based on an evidence-based assessment.

The Act and Code empower appropriate sharing of personal information under the information privacy principles (including health information under the Code rules) where necessary in specific circumstances such as the pandemic.

This case is a reminder that neither the Act nor the Code necessarily pose insurmountable barriers to disclosing and using personal information in the public interest – especially if necessary to respond to a public health emergency. The Code requires proportionate and evidence-based assessments when deciding whether to rely on rule 11(2) to disclose specific health information. Government decisions about disclosing sensitive information like vaccination data that is necessary for the pandemic response should refer to relevant public health advice to make an objective and evidence-based assessment.

At the heart of these proceedings are government decisions about the use of Māori data in responding to the pandemic and mitigating the serious public health risk and specific risk to Māori. This raised important questions about the role of tikanga Māori in the Ministry’s decision-making process with tikanga evidence before the Court, from Dr Carwyn Jones and Lady Tureiti Haroumi Moxon that the highly prized taonga of health has primacy in the pandemic context:

There is taonga in life and health. If there is taonga in data, then that taonga must give way to life and health. Providing the contact details of unvaccinated Māori provides the best chance of respecting the taonga of their life and health.

The Court also examined the Ministry’s discretion to disclose Māori data in terms of its expressed commitment to exercise its powers in relation to the vaccine rollout in accordance with Te Tiriti o Waitangi.

The Office of the Privacy Commissioner takes account of cultural perspectives on privacy under section 21(c) of the Act. Te Tiriti o Waitangi is considered a founding document and the text(s) and the principles of partnership, active protection and equity help guide our work. The Court’s discussion of te Tiriti o Waitangi, tikanga Māori and Māori data sovereignty respectively will further help to inform our Office’s approach.