Disclosure of personal information - how to, not don't do

Our privacy framework is often used as a reason to withhold the disclosure of personal information. While withholding disclosure may be appropriate in certain circumstances, it should be kept in mind that the same privacy framework actually permits the disclosure of personal information, where warranted.

The COVID-19 pandemic has resulted in a number of tough questions around disclosure of personal information. This was the context for two recent judicial review cases in the High Court: Te Pou Matakana Limited v Attorney-General [2021] NZHC 2942 (WOCA No. 1) and [2021] NZHC 3319 (WOCA No. 2). The resulting judgments, which give guidance beyond the disclosure of personal information in a pandemic, emphasise that the Privacy Act 2020 (the Act) is not only concerned with the protection of personal information – it also provides a framework for how information can be used and disclosed.  

The proceedings

Te Pou Matakana, trading as Whānau Ora Commissioning Agency (WOCA), is a government-funded and Māori delivered approach to supporting whānau wellbeing and development. WOCA had been providing COVID-19 vaccination services and sought personal information from the Ministry of Health (the Ministry) regarding Māori in the North Island who were not yet vaccinated. WOCA wanted to use this information to reach out to unvaccinated Māori, for the purpose of increasing the Māori vaccination rate.

The Ministry provided WOCA with the COVID-19 vaccination status and booking information of individuals who had previously received services by a WOCA partner. However, it withheld disclosure of this information for Māori who had not previously received WOCA’s services. Instead, the Ministry offered to provide anonymised street mapping representations showing where unvaccinated communities are (which would require WOCA to go door-to-door to find the unvaccinated individuals) for the purposes of providing urgently needed vaccinations.  The Ministry’s decision appeared to stem from concerns about precedent-setting, vilifying the unvaccinated, and risking public confidence in the health system, by disclosure.

WOCA applied to the High Court for judicial review of the Ministry’s decision. Given the privacy issues involved, the Privacy Commissioner (the Commissioner) applied to intervene, so that he could make his own submissions to the Court on this case.

Central to both judgments was Rule 11 of the Health Information Privacy Code 2020 (HIPC) relating to the disclosure of health information.  

Rule 11(2)(d) permits disclosure of information by a health agency where it believes, on reasonable grounds, that three criteria are met:

(a) it is not reasonable or practicable to obtain authorisation for the disclosure from the individual concerned;

(b) there is a serious threat to public health, public safety, or the life or health of specific individuals; and  

(c) the disclosure of information is necessary to prevent or lessen that threat.

In WOCA No. 1, the Court directed the Ministry to retake its decision because the Ministry had wrongly applied Rule 11(2)(d), with regards to assessing whether the disclosure was ‘necessary’. The Ministry retook its decision and again decided that it would not release the information sought. WOCA then applied for judicial review of this second decision.

In WOCA No. 2, the Court found that the Ministry had once again wrongly applied Rule 11(2)(d). The Judge directed the Ministry to review its decision not to provide data in relation to Māori in the North Island who had only had their first dose, in light of the Court’s guidance on the meaning of “necessity” in the Act, and to make a decision on data which the Ministry had not yet agreed to disclose.

The Ministry released the information sought by WOCA shortly after WOCA No.2 was delivered.  

Key privacy takeaways

In its analysis of Rule 11 of the HIPC, the Court:

• acknowledged that while Rule 11 places limits on the ability to disclose health information, it also contains several exceptions that permit disclosure where other interests take precedence;
• found that the meaning of “necessary” in this context means only “needed or required”, and although it must be more than “desirable or expedient”, necessary does not mean (the higher thresholds of) “indispensable” or “essential”;
• accepted the Commissioner’s submission that a ‘least-privacy invasive’ test may be relevant if there are two equally effective alternatives for disclosure and one of those alternatives was less privacy intrusive than the other.  This was however not a case where there were two equally effective alternatives under consideration;
• found that where the requirement of necessity and efficacy in Rule 11(2)(d) are met, other interests or obligations may point to disclosure (in this case, a right to the highest attainable standard of health); and
• emphasised that where personal information is disclosed, the agency receiving the information will still be subject to the stringent requirements of the Act and the HIPC.

While these decisions relate to health information, the Court’s analysis of Rule 11(2)(d) is of value to all agencies, rather than health agencies alone. Similarly permissive criteria can be found in Information Privacy Principle 11(f) in the Act, which applies to all personal information.  

The HIPC and the Act do not impose an obligation to disclose personal information or confer a right to receive it. However, they do confer a discretion on agencies in terms of disclosure and provide exceptions that permit agencies to consider other interests and rights in exercising that discretion.

If you have questions in relation to your disclosure or other obligations under New Zealand privacy law, contact us.

Image credit: Tetiana Shyshkina