New Zealand, High Court of New Zealand, 6 December 2021, NZHC 3319
Case overview
Country
Case ID
Decision date
Deciding body (English)
Type of body
Type of Court (material scope)
Type of jurisdiction
Type of Court (territorial scope)
Instance
Area
Further areas addressed
Vulnerability groups
Outcome of the decision
Link to the full text of the decision
General Summary
This is a second application from an organization representing Maori people from the North Island of New Zealand seeking COVID-19 vaccination data on Maori people from the Ministry of Health. The applicants were seeking judicial review of the decision to decline to share the data of Maori individuals who had not been vaccinated. The information had been sought to assist their efforts to combat vaccine hesitancy in this vulnerable group. The data is private health information, which is protected under the Privacy Act 2020 and the Health Information Privacy Code 2020. According to Rule 11 of the Privacy Act, private health information can only be released without consent where obtaining individual consent is not desirable or practicable, and there is a serious threat to public health or safety of the health of the individual and disclosure of that information is necessary to prevent or lessen that threat. The Ministry decided that this test had not been met, and was therefore prevented from releasing the information by the Privacy Act. The Court determined that the Ministry erred in fact and in law when making this decision. The Court found that the circumstances of the case meant that the test for releasing the information under the Privacy Act had in fact been met. Also, the Ministry’s failure to involve the applicants in making their decision constituted a breach of the Applicants’ right to natural justice. The challenge was successful. Given the time passing and the urgency of the situation, the Court ordered the Ministry to make a decision within 3 days having regard to the reasons of the judgement.
Facts of the case
The applicants were seeking review of a Ministry of Health decision to decline to provide them with COVID-19 vaccine data for a group of Maori people on the North Island of New Zealand. This was their second application to the Court. Information was presented suggesting that the Maori population had lower rates of vaccination than non-Maori, and that Maori were at a higher risk from COVID-19. The applicants believed that access to this data would assist in improving vaccination rates amongst Maori. On the first occasion, the decision to decline the request was remitted back to the Ministry by the Court. The Ministry declined again to share the data on various bases, including that there were less privacy intrusive alternatives that would meet the applicants’ goals. The applicants argued that this decision contained several errors of fact and law, and that in making the decision the Ministry had not appropriately consulted the Maori community. Moreover, their approach did not consider the urgency of the situation. The applicants sought judicially review of that decision, seeking an order that the Ministry provide the data to them within three days, or in the alternative, that the Ministry’s decision be set aside, and the Ministry be directed to retake the decision within three days. The Court upheld the Applicants’ argument and concluded that the failure to effectively consult with the applicants was a breach of their right to natural justice. The Court ordered that the Ministry reconsider their decision.
Type of measure challenged
Measures, actions, remedies claimed
Individual / collective enforcement
Nature of the parties
Claimant(s)
Private collectiveDefendant(s)
Public
Type of procedure
Reasoning of the deciding body
The legal framework which the Court considered the dispute was contained within was the Privacy Act 2020 and the Health Information Privacy Code 2020. The Court considered whether or not sharing the data was “necessary” under that legislation. The definition of necessary was stated to mean “needed or required” but more than merely “desirable or expedient” but it does not mean “indispensable or essential”. The Court held that the Ministry’s definition of necessary “set the bar too high”. Therefore, the Ministry applied the wrong test for necessity in assessing whether disclosing the health data was necessary to reduce the threat of COVID-19 to the Maori people in question. The Court considered that the Ministry’s decision that the disclosure of the data would not be effective to address the risk was an error of law. It went on to conclude that the provision of mapping level data as opposed to the requested vaccination data was not an “equally effective alternative”. The Court held that the Ministry incorrectly added in the requirement of authorization by local Maori groups. It found that the Ministry exercised its discretion to disclose data inconsistently by requiring consultation before disclosure with some Maori groups but not other groups. The Court determined that the Ministry’s consultation was flawed resulting in the decision not being made in a reasonable timeframe. The Ministry was concerned about Maori data sovereignty. The Court found that, if the applicants had been consulted, the Ministry could have been assured that relevant data could have been shared without threatening Maori data sovereignty. The court considered the Ministry’s discretion and made reference to common law principles that the discretion must be exercised within the scope of the legislation and consistent with its purposes. The Court concluded that it had found a reviewable error in the Ministry’s decision and therefore the applicant was entitled to relief.
Conclusions of the deciding body
The Court upheld the claim and remitted the decision back to the Ministry within 3 days having regard to the reasons of the judgement.
Fundamental Right(s) involved
- Right to data protection
- Right to health (inc. right to vaccination, right to access to reproductive health)
- Right to privacy
Fundamental Right(s) instruments (constitutional provisions, international conventions and treaties)
Rights and freedoms specifically identified as (possibly) conflicting with the right to health
- Health v. data protection
- Health v. right to privacy (private and family life)
General principle applied
- Non-discrimination
- Due process
- Reasonableness
Balancing techniques and principles (proportionality, reasonableness, others)
Rule 11 of the Privacy Act requires that decisions to release private information for the purposes of public safety must be taken on ‘reasonable grounds’.
