Report shows privacy breach impact

Anyone who cannot grasp the impact of breaching the privacy of a Covid-19 patient might benefit from reading the recently released report from the Privacy Commissioner John Edwards.

In August, in the aftermath of the scandal over the release of patient data involving Michelle Boag and MP Hamish Walker, Mr Edwards launched his own inquiry into the Ministry of Health disclosure of Covid-19 patient information to emergency services. (Ms Boag had access to the information through her role in the Auckland Rescue Helicopter Trust.)

He found the ministry had a clear and measured rationale for providing patient information to the services in April, but that it should have revisited the decision once we began to move down the alert levels in May.

As far as Mr Edwards could tell (and it appears there were considerable gaps in the information he was provided and some tardiness involved) it was only the Boag/Walker furore in early July which prompted the ministry to review its policy.

Disappointingly, his report reveals another instance of police not paying proper attention to privacy.

In this case, although Mr Edwards found the police, in the early stages of the Covid-19 lockdown were entitled to have information on those with the illness in order to ensure their officers were not put at unnecessary risk, he was critical of them later using this information in the vetting process (used by organisations for checking out prospective employees) and disclosing it to other agencies.

While such disclosure was short-lived, only involving six cases, we wonder if there is a gung-ho attitude to aspects of privacy in some parts of the force. It was only in May we found out there had been an ad hoc trial earlier in the year using controversial facial recognition technology Clearview Al without necessary approval from the Police Commissioner, the Privacy Commissioner or the Cabinet.

We hope leadership from new commissioner Andrew Coster, who moved quickly to stop the vetting information sharing when it was drawn to his attention in April, will result in a much more cohesive and considered approach to privacy issues in future.

Mr Edwards’ report shows the ministry rightly resisted pressure to release information to members of Parliament and officials of local authorities.

Significantly, the report emphasises the fact that in New Zealand's small population, in some instances even releasing a small amount of apparently anonymous information can readily lead to identification of individuals with Covid-19.

Mr Edwards quotes at length from a moving statement he received from someone whose location had been released. This person, associated with the Hereford Conference cluster, was living in a small community, where they were easily identified as the only Hereford breeders.

The Covid patient had to cope with considerable attention, much of it unkind, while they were still sick and, even after recovering, they could not bear to go to local shops because of intrusive questions from people they encountered. Their decision to seek police permission to take a 110km round trip out of town for grocery shopping illustrates how overwhelming they found this unsought interest. They still avoid going out locally unless they have to.

As the person pointed out, the choice of who they told, and when, was taken away from them and ‘‘I cannot express enough how traumatic and stressful that was’’.

Mr Edwards said this highlighted the importance of a clear and co-ordinated approach to sharing information, even where that information is not intended to include identifiable details.

Among his recommendations is that the ministry develop a co-ordinated plan about sharing of such information to ensure all recipients are aware of the risks of releasing information that might lead to someone being identified and ways this could be mitigated.

We look forward to seeing prompt but thorough action from the ministry and the emergency services on all the privacy commissioner's recommendations.