30 Jul 2020

Privacy Commissioner investigating Boag's, Walker's leak

From Checkpoint, 6:16 pm on 30 July 2020

Privacy Commissioner John Edwards wants to establish whether any of the 18 people whose data was leaked want to pursue a case against those who breached their privacy. 

Privacy Commissioner John Edwards

John Edwards raised concerns about the distribution of patients' details in April.  Photo: Supplied / Office of the Privacy Commissioner

Edwards is investigating the Covid-19 patient privacy breach to see whether any further action can be taken following the release of a report that's confirmed political motives and National Party players were behind the leak. 

The inquiry, headed by Mike Heron QC, has laid the blame for circulating the private details of patients with Covid-19 on outgoing National MP Hamish Walker and the National Party's former president Michelle Boag. 

None of the media outlets which received the leaked patient details published them. 

Edwards told Checkpoint the affected patients were among his major concerns. 

"I'm very interested in finding out whether any of the individuals whose information was included [in the data breach] are interested in pursuing remedies because if they are, then I would certainly begin an investigation."

Edwards said he also wanted to explore the original basis for the distribution of the data, how the policy was conceived and executed and whether it was reviewed in a timely way. 

He said he had first raised concerns about the distribution of patients' details with the Ministry of Health in April.  

He intended to widen his probe into other emergency services who received the data. 

The primary concern was the distribution list and then secondly, the security measures around the data, such as passwords. 

He said he could only investigate the actions of an agency, not members of Parliament.

Michelle Boag.

Michelle Boag  Photo: RNZ / Kim Baker-Wilson

If someone complained about Boag he would have to consider that further. Boag received the data on behalf of the Auckland Rescue Helicopter Trust for whom she was acting chief executive.

She and the trust could both be held liable, but Edwards said that wasn't up to him.

"I don't have any ability to dole out penalties or punishments." 

His role was to see if there was any substance to a complaint, and if there was, he could try to bring resolution between the parties. If there was no resolution, he could refer the complaint to the director for Human Rights Proceedings who could bring a case to the Human Rights Tribunal which could award damages of up to $300,000. 

Edwards said he was aware that there was a lot of urgency and concern around the early stages of the pandemic and lockdown. 

"I need to be a little bit sensitive about the kind of hindsight I bring to that but also it is important that all the agencies involved take the lessons from this for the next time we have this kind of experience." 


  • Data leakers Boag, Walker did not consider harm to patients - Hipkins
  • Judith Collins: 'You can't play around with people's privacy'
  • Covid-19 privacy leak was 'deliberate and politically motivated', SSC inquiry finds
  • Covid-19 privacy leak: Michelle Boag stands down from roles with National deputy leader Nikki Kaye