COVID-19 Vaccination Records and the Privacy Act 2020

Civil Litigation & Dispute Resolution
Aug 25 2021

Can the Government keep a record about what vaccinations I have had?

The recent arrival of the Delta variant of Covid-19, in New Zealand has resulted in a huge increase in vaccinations. As a part of this, the New Zealand Ministry of Health (MOH) has created a “COVID Immunisation Register”, also known as the CIR.

The CIR is confidential, and is used by the MOH to store records of immunisation levels within New Zealand. It records all relevant identification details for those people who have received a COVID-19 Vaccination. Examples of this information include; your name, date of birth, health number, address, details about the vaccination/s received and any reactions you had to the virus.

The CIR is accessible by medical professionals. However, the details of workers who are subject to the COVID-19 Public Health Response (Vaccinations) Order 2021 – that is workers who are legally required to be vaccinated – will also be recorded in the Border Workforce Testing Register (BWR). Employers who are required to have their workers vaccinated are able to check this second register to ensure workers that they hire are complying with those requirements.

At first glance, it can be scary to know that MOH is storing this kind of personal information. However, MOH’s record keeping, like all businesses with a presence in New Zealand, is closely regulated by the Privacy Act 2020. This means that, just like anyone else, they have to comply with the rules. While anyone who receives a vaccination will automatically be recorded on the CIR, this is subject to restrictions, namely:

  • It will be kept confidential only to those working in the vaccination programme;
  • It will be held securely; and
  • You can correct your records if they are wrong.

Information from workers who are required to be vaccinated can also be given to their employers, who will be able to use it to ensure they comply with legal requirements, but must otherwise keep it confidential. Employers using this information should also take care to ensure that they comply with their employment obligations when they are doing so.

Privacy Act 2020

New Zealand carefully controls the way all businesses use private or personal information. This is done through the Privacy Act 2020. This Act created 13 Privacy Principles, which are flexible rules which govern the way businesses use our information. They are flexible to make sure that they can always be applied to new technologies. The principles regulate the collection, storage, use and distribution of information by business, including MOH.

Collection

The overarching principle relating to the collection of information is ensuring agencies (ie. MOH) are collecting information in manner that is lawful, fair, and not unreasonably intrusive for the individuals concerned. Broadly, this means that MOH needs to make you aware that they are collecting your information (such as your phone number) – they can’t do it covertly. An example of this that you may see often is when you click onto a website, and a “cookie banner” pops up, notifying you that the website is using cookies. If they are going to use it for a particular purpose, they will also usually need your consent.

Storage

Once information has been collected, the 2020 Act requires that information be securely stored. It needs to be protected from harm such as loss, unauthorised access, misuse or modification. MOH has confirmed that the CIR operated on a secure platform hosted in Sydney. Only authorised persons can access the register.

Information should only be stored for a limited period of time. A limited period of time is the period for which it is required, and for a reasonable period of time. Here, the purpose of collecting the information is to help control the spread of Covid-19. MOH has indicated that the information will be retained on the CIR for a minimum of 10 years.

Use

Under the Act, the information collected by MOH when administering vaccines can only be used for the purpose for which it was collected – to control the spread of COVID-19. They cannot use the information to contact you needlessly, or send you spam emails.

The only people able to access the information are Ministry staff involved in the vaccine roll out and (in the case of the BWR) employers who need to know if their staff are vaccinated. Employers who are not required to have vaccinated employees will not be able to use the CIR to check up on their workers.

Release outside of the specific reasons why the information was requested will only be possible in special circumstances – such as where you consent, or where there is a legal reason that disclosure is required. Otherwise, you are entitled to expect this information to be kept confidential.

What can I do if I think my privacy rights are being breached?

You are always entitled to get in contact with any organisation holding your information, and request a summary of the information held. This is the same for the MOH. If there are any errors, you are entitled to request that the information be corrected.

If you feel that the a company has breached the Privacy Act, you should get in touch with them. If you aren’t happy with their response, you are able to make a complaint to the Office of the Privacy Commissioner. The Privacy Commissioner than has the power to investigate and rectify the matter. If a business does not comply with the investigation, the Privacy Commissioner can fine them up to $10,000.00.

If you are dissatisfied with the result from the Privacy Commissioner, you can appeal to the Human Rights Review Tribunal. The Tribunal can review further, and also has the power to award damages for emotional harm.

Where We Can Help

The recent changes to the Privacy Act mean that Holland Beckett Law has been advising our clients on all things privacy. This has included updating their online privacy statements, as well as correct practice for businesses to adhere to the new legislation.

We are also providing advice to clients who are affected by the various Covid orders that have been put in place – including the requirement to ensure that employees are vaccinated. This is a difficult area, and we recommend that employers working with the BWR get specific advice about their obligations.

The increasing need to create accurate records with personal information mean that it is important to have people on your side who understand the requirements – like in relation to the CIR and the BWR. We are more than happy to discuss your situation and help you better understand your rights, obligations, and options.

You may also like ...
What protection do you have as a business purchasing goods? Contract and Commercial Law Act
Everyone knows about the Consumer Guarantees Act 1993 (CGA), which provides a “consumer” with remedies if a business has failed to provide goods or services to a reasonable standard. But what happens if you are a business purchasing goods? The answer is not found in the Consumer Guarantees Act 1993; it is found in the Contract and Commercial Law Act 2017 (the CCLA). The CCLA implies seven conditions and/or warranties in a contract for the sale of goods: right to sell; conformity with description; fitness for purpose; merchantable quality; conformity with samples; rights of examination, and; acceptance. Not every breach of contract allows for rejection, but a trivial breach of a condition does. This means that a buyer can return goods supplied to a seller. Importantly, whether a term is a condition or a warranty depends on the construction of the sale of goods contract. An important implied condition is “fitness for purpose”. This means that goods must be reasonably fit for purpose. But, unlike the CGA, this condition will only apply where the buyer makes known to the seller the particular purpose for which the goods are required, and that the goods are of a description that it is in the course of the seller’s business to supply. What this means is that when a buyer of a vehicle makes known to the seller that they will be using a vehicle to tow a caravan, then there is an implied condition that the vehicle is fit for that purpose; towing a caravan. This was the case in Finch Motors v Quinn (No 2) [1980] 2 NZLR 519. Mr Quinn, the buyer, told the seller that he wanted a car for towing a boat on extended trips. The seller, Finch Motors, told Mr Quinn they had the ideal car for the job. Not long after the sale, Mr Quinn used his car to tow the boat when it overheated. This, the Court found, was a breach of the implied condition that goods are fit for purpose. There is also an implied condition that goods are of a “merchantable quality”. This is similar to “acceptable quality” under the CGA. The test for whether goods are of a “merchantable quality” is found in an old case, Taylor v Combiner Buyers [1924] NZLR 627. In that case, the Court asked the following question: Are the goods of such a quality and in such a state and condition as to be saleable in the market, as being goods of that description, to buyers who are fully aware of their quality, state, and condition, and who are buying them for the ordinary purposes for which goods so described are bought in that market? Unlike the CGA, the CCLA allows contracting parties to vary or exclude the implied conditions and/or warranties. This includes fitness for purpose and merchantable quality. To do this, the contract must be clear as to the conditions and/or warranties that it purports to vary or exclude. In Wallis, Son & Wells v Pratt & Haynes [1911] AC 394 (HL), for example, the seller’s terms and conditions stated that there is “no warranty express or implied”. The Court found that this did not exclude implied conditions, only implied warranties. If the seller wanted to exclude the implied conditions, including fitness for purpose and merchantable quality, they had to do so expressly. Holland Beckett has experience advising buyers and sellers. This is a complex area of law and Holland Beckett is available to assist.
Read more
What your Directors and Officers Insurance doesn’t cover
Recent high profile prosecutions under the Health & Safety at Work Act (HSWA) have highlighted limitations of standard insurance cover for corporate directors and officers. Specifically, where criminal prosecutions may result in extensive defence costs for targeted directors or officers.  Typical directors and officers (D&O) insurance will not cover defence costs where the prosecution is based on criminal liability, such as sections 48 and 49 of the HSWA, in the absence of acquittal. What D&O insurance is and what it typically covers New Zealand law places a high standard on a company’s decision makers, i.e.,  its board of directors and senior executives.  A company will typically place D&O insurance to mitigate the risk for such persons.  This covers a range of liabilities and includes compensation for legal claims and defence costs when acting in a governance or senior role. Companies can place D&O insurance for their directors and employees.  However, a company may only effect the insurance if its constitution expressly authorises it (see s 162 of the Companies Act). D&O insurance can include where a person is charged with a breach of director’s duties or an infringement of the Resource Management Act (RMA).  However, this insurance does not, and lawfully cannot, cover all liabilities. Gaps in cover and criminal liability A company cannot effect D&O insurance to cover defence costs where there is criminal liability if the insured is not acquitted.  This is explicit at s 162 of the Companies Act.  Absent other measures, this can leave a defendant  funding their own defence in relation to liability under the HSWA or the RMA. However, a director or employee may place their own insurance personally for defence costs in relation to criminal liability (which includes liability for collusion under the Commerce Act, offences under the RMA and offences under the HSWA).  Taking out personal defence cost cover is worth considering as many of these offences have strict liability, meaning, you can still be found liable for an accidental breach. If you are a director or executive employee of a company with exposure to liability under the RMA, HSWA, Commerce Act or any other statutes that have criminal liability, it might be a good time to consider personal cover.  Or, if you already have D&O insurance, reviewing what you are covered for already. If you would like to discuss anything in relation to D&O insurance, including understanding what your policy says or what cover you might want to consider, contact our Corporate and Finance team.
Read more
Baigent’s Damages
Lawyers are used to talking about historic cases by referring to the main parties to a proceeding.  Names like Crown v Brown and Collins v Smith are common place, even for important cases.  However, in the history of the law there are a handful of cases that are referred to with special names.  Some of these names are descriptive, like the so called Ship Money Case that in many ways triggered the English civil war, while others carry the name of an important participant.  This is the case with the example of Baigent’s case. Legal origins Baigent’s case was an important step in the development of New Zealand’s human right law.  It was the case that first recognised the Courts power to award compensation to people who had been the victim of government actions in breach of the New Zealand Bill of Rights Act 1990 (the Bill of Rights).  Its official description is Simpson v Attorney-General, but it has long been called “Baigent’s case”.  The Baigent of Baigent’s care was Mrs Baigent.  Although she had passed away by the time the Court of Appeal released its judgment in July 1994 it was her experience during an unlawful police search that lead the Court of Appeal to confirm that claims for damages for breaching the Bill of Rights were available in New Zealand. Mrs Baigent’s story has a simple beginning.  She was the victim not of a mistaken of identity but of a mistaken address.  A police officer, acting on a tip about a tinny house, mistakenly identified her address as the address of a suspected drug dealer.  A search warrant was issued for the address and the police went to search it.  When the police arrived at Mrs Baigent\'s home she was not there, but her son informed them that they had the wrong address.  He spoke to his sister (a Wellington lawyer) who also explained that the address belonged to Mrs Baigent.  Despite this the police were heard saying “we often get it wrong but while we are here we will have a look around anyway”, and this is exactly what they did.  The police searched the address and found nothing. The Court of Appeal was asked to answer the question of whether Mrs Baigent’s claim for compensation for the unlawful search should be struck out as having no proper legal basis.  Ultimately, the Court found that it was open to New Zealand Courts to give an award of damages for breaches of the Bill of Rights.  Although not required to make a decision in that particular case, President Cooke of the Court of Appeal suggested that an award of something less than $70,000.00 would probably be appropriate.  The Court was never required to decide the question as the matter was (it is understood) confidentially settled some time later.  Despite this, the case has become an important part of New Zealand’s Bill of Right jurisprudence. Baigent’s place Since Baigent’s case there have been dozens of claims for compensation after breaches of the Bill of Rights.  The breaches cover a wide variety of state actions.  Many relate to excessive use of force or degrading treatment by government agencies, like the police or the Department of Corrections.  Others relate to unlawful seizures and breaches of fair trail rights.  The awards that have been given for these claims vary.  The largest – for a criminal defendant who was sentenced to a long prison term for minor offending under the former three strikes law – was $450,000.00.  Other awards have tended to focus on emotional harm and often measure in the thousands or tens of thousands. Baigent’s case and what are often called “Baigent’s damages” are an important part of holding the government to account and upholding the Bill of Rights.  While a range of other remedies exist – for example, declarations that either a particular law does not comply with the Bill of Rights or that government actions have breached the Bills of Rights, and orders to reverse or stay decisions in breach of the Bill of Rights – many of these tools only prevent breaches from continuing.  In cases where the parties have suffered real harm, the availability of financial compensation is the only tool that really exists to remedy what has gone wrong. How we can help Holland Beckett has experience acting for claimants in Baigent’s damages cases resulting in both Court ordered compensation and confidential settlements.  Holland Beckett has also advised government bodies about compliance with the Bill of Rights to ensure damages claims cannot be made. This is a complex area of the law and Holland Beckett is available to assist both in advising people who feel their rights have been breached and agencies that want to ensure they comply with their legal obligations.
Read more

Start typing and press enter to search

Scroll to Top