4 Aug 2021

High Court stops RNZ from using further information stolen in Waikato DHB cyber attack

6:09 pm on 4 August 2021

RNZ has been ordered to not use any more of the information stolen in the Waikato District Health Board cyber attack and also ordered to permanently delete any copies of it from its systems.

A microphone with the RNZ logo on it.

Photo: RNZ / Claire Eastham-Farrelly

The DHB went to the High Court seeking a number of restraining orders, after RNZ broadcast a story about a child who spent more than nine weeks in hospital, because Oranga Tamariki failed to find a suitable placement.

That story was based on documents published by the cyber hackers on the dark web.

The DHB wanted court orders to prevent RNZ from accessing any more of the documents and publishing any more stories. It also sought and obtained orders against "unknown defendants" to prevent anyone using, accessing or publishing the documents or their contents.

In a judgement released today, Justice Churchman stopped short of requiring RNZ to take the story down.

However, RNZ cannot use any more of the hacked information and all copies have to be deleted.

In a statement, RNZ head of news Richard Sutherland said the media organisation had worked with the DHB to reach this agreement.

He said RNZ is happy to consent to the restrictions laid out in the judgment.

"RNZ has previously indicated that it has no intention to make use of other documents," Sutherland said.

"The story will remain on the RNZ website and RNZ stands by its view that the public interest was best served in bringing the case to light."

In a statement, Waikato DHB said it brought the court action to protect the affected individuals' right to privacy.

It said this was of particular importance when any affected individuals do not have an opportunity to provide consent for their information to be viewed or shared publicly.

The Privacy Commissioner issued a statement saying it supports the steps taken by Waikato District Health Board to protect against any further accessing or disclosure of information that was illegally obtained by cyber hackers as part of the ransomware attack on the DHB.

The Privacy Commissioner is considering applying for leave to intervene in any substantive hearing, given the important privacy interests raised by the proceedings.