Office of the Privacy Commissioner
PO Box 10094, Wellington 6140
Level 11, 215 Lambton Quay
Wellington, New Zealand
P +64 4 474 7590 F +64 4 474 7595
E [email address]
0800 803 909 Enquiries
privacy.org.nz
10 December 2024
Erika Whittome
By email only to:
[FYI request #29217 email]
Tēnā koe
Official Information Act Request (Our Ref: OIA/0414)
We refer to your Official Information Act request received on 18 November 2024.
You request:
I refer to a "news" communication dated 15 October 2021 from the Waikato DHB called
Staff Advisory - Order Requiring Healthcare Workers to be Vaccinated Against COVID-
19
This "news" says:
The DHB received permission from the Ministry of Health to access the Covid
Immunisation Register for those staff where we did not have a vaccination status. It has
been agreed it is essential for us to understand our workforce’s vaccination status so we
can rapidly and safely deploy staf to where they are needed most for our public health
response to this outbreak and to manage the risk of a wider community outbreak. This
access was granted after the Ministry of Health consulted the Of ice of the Privacy
Commissioner, which confirmed the Ministry could apply Rule 11(2)(d) of the Health
Information Privacy Code to allow disclosure of this private health information to DHBs
to support the public health response for this current outbreak.
Would you kindly share the memos, consultation documents, correspondence, emails
and any other communications regarding this consultation back in October 2021 to the
Privacy Commissioner.
Our response
Your request is refused under section 18(c)(i) of the Of icial Information Act 1982 on the
grounds that making available the information would be contrary to the provisions of a
specified enactment, i.e. section 206 of the Privacy Act 2020. Section 206 of the Privacy Act
requires the Privacy Commissioner and his Of ice, to maintain secrecy in respect of all matters
that come to our knowledge in the exercise of the Commissioner’s functions under the Privacy
Act.
Our Of ice is regularly engaged by public agencies, including health agencies, on a wide range
of matters that impact on individual privacy and provides expert advice on compliance with the
OIA/0414/A1032321
2
Privacy Act 2020. However, as per section 206 of the Privacy Act, there is an obligation upon
the Privacy Commissioner and staff at the Office of the Privacy Commissioner to maintain
secrecy in respect of all matters that come to their knowledge in the exercise of their functions
under the Act.
While the obligation of secrecy applies to the Of ice's engagement with the Ministry in relation
to its request for advice, in response to your request, a summary of OPC’s advice is set out
below. This is an exercise of the Privacy Commissioner's discretion to disclose information
under section 206(2) of the Privacy Act.
Summary of information requested
On 19 August 2021, the Ministry of Health approached OPC for advice in response to multiple
requests it was receiving from DHBs for access to staff vaccination status through the Covid
Immunisation register (CIR).
The Ministry advised that the DHBs are at different stages of the vaccine roll out and access
to employee vaccination status varied. In the current outbreak, vaccination information was
seen as critical to the ability of DHBs to service their communities and keep staff safe. The
Ministry advised that the normal process to obtain individual consent was unrealistic due to
the need to rapidly redeploy staff.
The Health Information Privacy Code (the Code) permits the collection, use and disclosure of
personal information by health agencies where there is a serious threat to public health or
safety (similar provisions are set out in the Privacy Act). These provisions can, in exceptional
circumstances, justify the sharing of information without consent.
Throughout the COVID-19 pandemic, OPC's advice has been that any reliance on the serious
threat exception must be based on a reasonable belief that it is necessary on health
grounds and based on current best practice epidemiological or clinical advice. This should
be guided by public health advice and scientific evidence from the Ministry of Health,
which has the lead role in advising the Government and New Zealand on whether a situation
represents a serious threat to public health, and what actions are needed to effectively prevent
or lessen that risk.
OPC’s feedback to the Ministry on 19 August 2021 was that it would need to consider the
latest public health advice from within the Ministry and consider each request on a case-by-
case basis. Based on the information that OPC had, including the recent move to Alert Level
4, the existence of community transmission in Auckland, the particular threat posed by the
Delta variant, and rostering issues at the DHB arising from the need to ensure that staff and
patients were kept safe, we expressed the view that there is likely to be an arguable case for
the Ministry to provide the employee vaccination information for health staf in those areas of
known community transmission of the Delta variant, under the serious threat exception.
We recommended that the Ministry should give consideration as to how it would communicate
any decision that it made to the health workforce, and that it should act urgently to regularise
the approach to vaccination information with all DHBs in the future.
Conclusion
If you are not satisfied with my response to your request, under section 28 of the Official
Information Act 1982 you have the right to ask the Ombudsman to investigate and review my
OIA/0414/A1032321
3
decision on your request, although we would welcome the opportunity to discuss this with you
first.
Nāku iti noa, nā
Liz MacPherson
Deputy Privacy Commissioner
OIA/0414/A1032321
