NZ Engine

Source:

Under the Privacy Act, individuals have a right to get access to their personal information. When an agency receives such a request, a recent decision by the Human Rights Review Tribunal shows the agency, where possible, must provide the information in a way that is meaningful and understandable to the requester.

The Tribunal said the Royal Australasian College of Surgeons (RACS) breached the Privacy Act in how it responded to a doctor’s request for personal information. A central issue was that the information was provided to the requester in a form which he could not decipher. 

Background

The doctor had applied for a place in a training programme to become an orthopaedic surgeon. He had applied to the programme repeatedly but had been unsuccessful each time. After his last bid, he made a request to see the personal information held about him by the RACS to understand why he had been rejected yet again.

Twenty working days elapsed. Eleven days later, the RACS responded and emailed the doctor’s personal file to him. Some documents were withheld from him.

Based on the documents provided to him, the doctor believed his application had been unfairly judged. He lodged an appeal with the RACS Appeals Committee and filed a complaint to the Office of the Privacy Commissioner about the withheld documents.

The RACS extended the deadline for the appeal process until the Privacy Commissioner investigation was completed. After our investigation was completed, RACS provided the doctor with information it had initially withheld from him – namely a table of referee scores. The scores formed part of the basis for his failed application.

The doctor said the referee scores were inconsistent with the verbal feedback he had received and were well below his previously achieved scores. There was little meaningful information to contextualise the scores. No information was provided to indicate what the scores had been marked out of, or whether they had been weighted.

The doctor said it was impossible for him to interpret or decipher the referee scores and to see if they had been correctly calculated.

At this stage, we were unable to reach a satisfactory resolution to the complaint and the doctor exercised his right to seek a ruling from the Tribunal.

Tribunal’s view: provide meaningful access

The Tribunal said an important feature of the case was that the personal information the doctor received from RACS could not be deciphered. The doctor hadn’t been given the formula, mechanism or “key” to help him understand how his referee scores were calculated.

The Privacy Act provides that personal information must be given in a form that can be understood (see section 42(1)(c) and (d)). Without such steps, it cannot be said that access to personal information had been given and an agency’s obligations had been met.

The Tribunal ordered the RACS to give the doctor the necessary information to make meaningful the scoring and assessment of his referee scores, such as the scoring mechanism or available formula, as well as the weighting and total points available to the referees in making their scores. This information was to be transparent, intelligible and easily accessible to the doctor.

Image credit: Steel black and white via Pixabay under Creative Commons Licence.

IPP6 – access, Human Rights Review Tribunal

Back

Source:

A man complained to us last year after staff took a copy of his driver’s licence as he checked in to a hotel. The complainant was surprised that staff copied his licence and they couldn’t tell him why they needed the copy or how long they would keep it for.

Hotels and other agencies often ask for ID and take a copy. But is it okay to do this under the Privacy Act?

Do you need to take a copy?

Principle 1 of the Privacy Act says you can only collect information if you need it for a lawful purpose. Your agency needs to ask itself this question for any information you collect from your customers, including their identification.

Unique identifiers (such as licence or passport numbers) also come with special rules. Principle 12(4) of the Act says you can’t require an individual to give you their unique identifier, such as a driver’s licence number, outside of the purposes in connection with which it was assigned or a directly related purpose.

If your agency needs to confirm that someone is who they say they are, then it’s probably reasonable to ask to see their identification, even if your business is not connected to the original purpose for assigning the identification (i.e. if you are not the agency that issued the identification, or a related agency, such as NZTA and Police with regard to driver licences).

But is it necessary to take a copy? We thought about this in a previous complaint in 2010 between a woman and her mobile phone company. In that case we agreed it was important for the agency to properly identify its customers, but we considered that sighting a customer’s identification fulfilled this purpose. We did not accept that it was necessary for the agency to also record the driver licence number or to take a photocopy. 

If you need a record, what will you keep and how long will you store it for?

If your agency decides it legitimately needs to take copies of customers’ identification, and it isn’t enough to simply sight it, the next question is how long you need to keep them. Your agency has obligations under principle 9 of the Act to keep personal information you collect for only as long as you have a lawful purpose to do so.

When agencies decide to store copies of identity information, they will need to keep it secure. Principle 5 of the Privacy Act says you must use reasonable security safeguards to protect against lose, unauthorised access, use, disclosure of misuse of the personal information.

The risk of harm if information is misused is particularly high with identity information. They can be used in fraud with extremely serious consequences, such as identity theft. Identity information cannot easily be changed or re-secured, unlike credit cards.

In many cases, you’ll only need to keep copies of identification for a very short time, especially if your agency has a short relationship with your customer. In addition, if you need to retain identity information, you should consider if it is possible to obfuscate or delete the unique identifier (such as driver’s license or passport number). This may aid compliance with principle 12 of the Privacy Act. It is also a step to take to mitigate the risk of misuse if identity information is lost or stolen.

There may be other laws which require certain classes of agencies to retain certain information for a set period of time. For example, the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 requires financial institutions to keep identity and verification information for a period of at least five years after the end of that business relationship.

Are you explaining what you’re doing?

Whatever your identification practices, you need to be able to explain them to your customers. Principle 3 of the Act says when your agency collects personal information, you have obligations to let the person know a number of things, including the reason for collecting the personal information and what will happen to it.

To meet your obligations under principle 3, your frontline staff need to tell customers what they are doing with their identification when they hand it over. They should also be able to answer why they need it, whether they are taking a copy and how long your agency will keep it for.

If you need help training your staff on privacy, we have plenty of free resources you can use. Our Privacy ABC online module provides a quick overview of how to protect privacy when handling personal information. It can be done in 30 minutes.

All our online e-learning modules are available here.

So, in summary, when asking for a person’s identification document, ask yourself:

• Does sighting an identification document verify the person’s identity?
• What is my reason for taking a further step by making and keeping a copy?
• If I decide I need to make and keep a copy, how long do I need to keep it for?
• If I am keeping a copy as evidence of having seen the ID, should I obscure or delete details such as date of birth and ID number?
• Have I informed the person I am making and keeping a copy?
• Have I informed the person how long I will be keeping it for before disposing of it?

Image credit: New Zealand passport via Wikimedia Commons

IPP5 – storage & security, IPP9 – retention

Back

Source:

Reviewed for relevance April 2025.

Since 2007, companies like 23andMe.com and Ancestry.com have made at-home DNA testing kits accessible to the masses. Through a simple online order, you can receive a kit, provide a saliva sample and return it to the company for analysis. Genetic data is highly sensitive given that, other than in the case of identical siblings, it is utterly unique to you.

Direct-to-consumer (DTC) genetic testing kits are billed as an inexpensive, non-invasive method of gaining personalised insights into your health, discovering distant family members and learning your genetic origins.

Some companies that sell DNA kits make dubious claims about what their tests can show and consumers who receive home DNA kits often sign onto opaque terms and conditions which allow their genetic information to be used in ways which would make most people deeply uncomfortable.  

According to recent estimates, some 26 million people across the globe have used DTC DNA kits. The largest provider of this services, Ancestry.com, stated that by May of this year they had examined 15 million DNA samples. New Zealanders have a higher rate of testing than people in many other nations. A spokesperson for Ancestry.com told Stuff in 2018 that he believed testing was popular in New Zealand because many Kiwis wished to “find some connection to a bigger story, a bigger sense of belonging to the world.”

How do these tests work?

Although there are many types of at-home DNA tests available, the most common one helps consumers link up with distant relatives and discover their genetic roots.

Human DNA is 99.9% identical in all people. The remaining 0.1 percent contains what are termed single-nucleotide polymorphisms (SNPs). SNPs account for all variation between people including our height, build, hair type, eye colour and so forth.

DTC DNA companies analyse samples collected from the public and compare the unique patterns of an individual’s SNPs to reference groups from around the globe. That comparison indicates how closely your pattern of SNPs resembles broad groups such as Western European, Northern African, East Asian and so forth. Once tests have been examined, consumers receive reports (such as the one below) which outline the percentage of their genes which seem to emerge from different countries.

Accuracy issues

Some experts have levelled criticism regarding the accuracy of take home DNA tests. Criticisms include that these companies generally don’t share their data, their methods are not externally validated and some consumers have submitted their DNA to multiple organisations and received back differing results. Such tests are perhaps best described as giving a probability of where your genes come from rather than a precise picture.

Many genetic markers may be found in multiple populations around the world. This means that trying to neatly categorise groups of people into groups like “European” or “West African” may gloss over massive intragroup variability. Experts argue that human genetic variation does not neatly fit into arbitrarily defined borders. Reporting from Vox highlighted that studies of DTC genetic testing showed that it  may in fact “reinvigorate age-old beliefs in essential racial differences.” In other words, help to reinforce the idea that there are fundamental differences between people of different skin colours.

A report received from 23andMe by Vox journalist Danush Parvaneh outlining the broad categories of his genetic background. Source: Vox YouTube Channel

Opaque terms of services and sharing results with law enforcement

Dr Andelka Phillips is a senior Lecturer at the University of Waikato’s Faculty of Law and a Research Associate at the Centre for Health, Law and Emerging Technologies (HeLEX) at University of Oxford. She has focused her research on the regulation of the direct-to-consumer (DTC) genetic testing industry. One of Dr Phillips’ main criticisms of the industry is the extremely long and complex terms of service that consumers must agree to as part of submitting their saliva samples.

Dr Phillips’ reviewed contracts for 71 of these companies which revealed some disconcerting clauses. Seventy-two percent of contracts included a clause allowing the company to alter terms (without the agreement of the consumer) with 28 contracts including a condition to alter terms at any time.  Nearly half of reviewed contracts allowed for disclosure of personal data or genetic data to third parties in certain circumstances.

Twenty-five percent of contracts permitted disclosure of DNA data to law enforcement. In 2019, it was revealed that FamilyTreeDNA, a company which had collected more than 1 million DNA samples, had been working with the FBI to investigate violent crime.

Privacy considerations associated with these tests

For users of DTC DNA kits, there are major privacy questions including: How long do these companies keep consumer’s genetic information? Who is the data shared with and for what purposes? And are you able to request for your information to be deleted from the company’s records?

Some companies in this industry have been explicit in stating their real motives for collecting people’s DNA. 23andMe, at their launch in 2007 told the San Francisco Chronicle: ““Once you have the [genetic] data, [the company] does actually become the Google of personalized health care.” Understanding variations in the human genome may assist with drug development and give DTC DNA companies valuable insights into the global pharmaceutical industry worth $1.2 trillion USD in 2018.  Drug-company giant, GlaxoSmithKline invested $300 million in 23andMe in 2018 with an eye to using the DNA company’s de-identified, aggregate customer data for drug research. As this Atlantic article noted, “you don’t make that kind of money selling $99 spit kits.”

Dubious tests conducted by some DTC DNA companies

The lack of regulation in the DTC DNA industry is apparent in the fact that some genetic testing companies offer to reveal information about people that there no scientific evidence they can deliver. Examples include tests that claim they can show whether your child has “language learning” genes, will possess innate football talent or even whether they are a “picky eater”. The evidence that DNA can reveal any of these traits is doubtful at best and more likely, completely misleading.

One savvy Canadian man decided to assess the accuracy of a Toronto-based DTC DNA lab which charged $250 dollars to conduct a check into your ancestry. He submitted three samples, two from himself and one from his girlfriend’s dog for analysis. The results he received showed that both he and Snoopy the chihuahua shared identical “indigenous” ancestry. It emerged that the tests were being used by some wealthy Canadians to fraudulently attain indigenous status and save money on some taxes.

health, data, DNA, 23andme, Ancestry.com

Back

Source:

New Zealand is generally an engaged country, and most of you reading this will be part of or will have been members of a club at some point. Whether it is a swimming, softball or rugby club or a miniature horse society, you will have been involved in one or know someone who is in one.

A common issue that arises is how those small clubs handle personal information.

Here’s a hypothetical. Let’s say Lucy makes a request for her personal information but Ethel, who is the chairperson of the Canasta Club, insists there is no need to comply with the request.

The difficult news for Ethel is that the club has obligations under the Privacy Act 1993 to provide Lucy with her personal information – for example, meeting records that may mention her and any other information.

Definition of personal information is wide

Personal information is any information which tells us something about a specific individual.

The information doesn’t necessarily need to name Lucy – she may be identifiable in other ways, like through her home address. All sorts of things can contain personal information, including notes, emails, recordings, photos and scans, whether they are in hard copy or electronic form.

This means that Ethel will need to think carefully and make an assessment about what personal information the club holds about Lucy.

In the unlikely event your club gets a letter from our office notifying you of a complaint made against your club, here are some key points to consider.

You’re not in trouble, so don’t panic

Say Lucy makes a complaint about the Canasta Club to our office because her request was not complied with. Here are two common scenarios where we may investigate.

Scenario 1 – Request for personal information

Our office needs to consider if Lucy’s right to access personal information had been interfered with. If Ethel failed to respond to Lucy’s request, we will contact the Club and ask it to either:

1. Give the information to Lucy directly if the club has no reasons for withholding the information, or
2. If the club is seeking to withhold Lucy’s information, it needs to explain which withholding grounds it is seeking to rely on (as set out in sections 27 to 29 of the Act).

This letter from our office will inform the Canasta Club that we have received Lucy’s complaint. The notification letter will set out the facts as Lucy has put to us, and identify why the complaint may raise issues under the Privacy Act.

The facts set out in the notification letter do not necessarily mean that our office is investigating the matter on those facts only. We’re also contacting the club to understand what has happened from its perspective.

The notification letter will also include a ‘statutory demand’. This means the club is required to provide any information it wishes to withhold to our office for review. We will then assess the information and determine whether the club is justified in withholding the information, or whether we think it should be released to Lucy (see sections 91(4) and 92 of the Privacy Act).

Scenario 2 – Collection, disclosure, security, and use of personal information

Lucy gave Ethel her email and mobile phone number, so Ethel can let her know about canasta in the local area. Lucy claims Ethel gave this information to Briony who rang Lucy to ask her to join her pyramid selling scheme. Lucy was annoyed Ethel had given her mobile phone number to Briony.

In this scenario, we would get in touch with Ethel to understand what’s happened, and to get her side of the story. We would then decide whether the club interfered with Lucy’s privacy.

Our office keeps things confidential

It is important to note that our office’s proceedings are privileged. This is set out in section 96 of the Privacy Act.

Section 116 also requires our office and its staff to maintain secrecy in respect of all matters that come to our knowledge in the exercise of our functions under the Act. These are obligations we take very seriously.

We therefore cannot pass on the information that the Canasta Club has about Lucy. If our office makes a finding the information should be given to Lucy, it is up to the club to do this.

Working with us is beneficial for your club

It is in the Canasta Club’s best interest to work with our office. We have no powers to force the club to provide the information to Lucy.

While our office’s recommendations are persuasive but not binding, we are here to try and assist you in meeting your obligations under the Privacy Act.

If we are unable to resolve the matter, Lucy has the right to go the Human Rights Review Tribunal.

Resolving the matter through our process means that Lucy is less likely to take the matter to the Tribunal. It also means that Lucy and Ethel can work towards mending their friendship and returning to the table to play a round of canasta.

We’re here to help you

We understand that whether playing petanque, softball or canasta, you’re not thinking much about how to keep Lucy’s personal information safe and secure, and it may be your first time dealing with our office.

If you have any questions, please don’t hesitate to ask us for help. It is not necessary to engage a lawyer. Our office is a dispute resolution focused agency – we are ultimately here to try and assist clubs to remedy a privacy issue and come to a resolution.

We also have guidance resources – such as our Priv-o-matic privacy statement generator and our AskUs FAQs – available on our website which you might find helpful.

Image credit: US airman kicks a rugby ball – Public domain.

complaints, IPP6 – access

Back

Source:

We’ve all seen the ads for genetic ancestry testing – as a way for people to trace their genealogy beyond traditional family trees and historical detail. And thanks to shows like CSI, the public might think of DNA as an investigative tool for the Police; a silver bullet that can solve any high-profile case in just minutes. But DNA can be used for much more than law enforcement activities or tracing ancestry.

The Law Commission – Te Aka Matua o te Ture – is currently reviewing the use of DNA in Police investigations. While its review focuses on Police DNA analysis and databanks, it also raises some significant questions that relate more broadly to privacy and health issues.

Genetic profiling might reveal genetic disorders

The Law Commission’s review considers how DNA profiles generated for criminal investigatory purposes may also reveal a genetic disorder, including conditions the individual may not yet be aware of. For example, testing can determine if a person has the genetic markers for Huntington’s disease, which is fatal and currently has no cure.

As doctors will be aware, genetic testing can confirm a diagnosis when symptoms are present and there is a documented family history of a particular disorder. However, some people who have a parent with a disorder will choose to be tested before presenting with any symptoms. Others choose not to be tested at all – even if it is an available option.

Medical genetics specialists will generally only make a DNA test available alongside full genetic counselling and a psychological evaluation because of the risk of harm from receiving such sensitive information if the patient is not fully prepared for it. Revealing genetic disorders without this kind of support could result in significant psychological distress for the patient.

Genetic information may affect life and health insurance

Alongside the psychological impacts of testing positive for a genetic disorder, this information may also affect a patient’s possibility of obtaining life and health insurance. Some countries have enacted legislation to restrict or ban the use of genetic information by insurance companies, so that insurance providers can’t charge higher premiums or exclude insurance cover if an individual has a genetic risk marker for particular conditions or diseases.

Future genetic testing is likely to provide even more information

Commercial genetic tests are currently marketed for tracing ancestry, and there are questions about how accurate these tests might be. But with advances in genetic science, it’s likely that commercial tests in the future could reveal significantly more information about an individual.

The Law Commission considered whether there are circumstances when Police may have a duty to disclose information about a genetic disorder to an individual. The review raised as an example malignant hyperthermia, which can cause death and can now be diagnosed by a DNA test.

If this type of information came to Police attention from a DNA sample analysed as part of a criminal investigation, should Police be required to disclose that to the individual, who may not know they are at risk? Or, if an individual makes a Privacy Act request for their own genetic profile, what are the consequences if they inadvertently learn more about themselves than they were prepared for?

Conceivably, in the future your patients may receive information about a genetic disorder or risk factor which they have tested positive for, but for which they are unprepared. They may well have many questions that you will have to assist them with.

Updating the law

There are no easy answers to these issues, but it’s important to give some thought to what the future holds. The Law Commission recommends that the Criminal Investigations (Bodily Samples) Act should be replaced with a law that is more up-to-date with scientific advances.

Other legislation or regulation might also be necessary to control what commercial DNA testing companies can test for, or how patients should be told about genetic disorders for which they have tested positive. In the meantime, general practitioners will want to be aware of the work being done in these areas and be prepared to answer questions about what DNA results might mean for your patient’s health.

First published in New Zealand Doctor on 22 May 2019.

Image credit: New Zealand Law Commission logo.

Health Information Privacy Code, health

Back

Source:

Cameron Slater, a well-known blogger, published a number of posts about business consultant Matthew Blomfield on the Whale Oil site. The posts were released between May–October 2012. There were additional publications containing personal information about Mr Blomfield on other blog sites.

The posts accused Mr Blomfield of dishonesty, theft, bribery, deceit, perjury and asserted, amongst other things, that Mr Blomfield was a psychopath, loved extortion and was a pathological liar.

The source of the information for the posts came from a hard drive that Mr Blomfield had used over a ten-year period to back up his business emails and documents. How the hard drive came into Mr Slater’s possession was not confirmed, although Mr Slater denied taking it unlawfully.

What was disclosed

Mr Blomfield claimed that at least 46 documents of his, containing personal information, were published by Mr Slater in 2012. These included business emails, correspondence with his lawyers; bank statements; photographs of Mr Blomfield, and a police adult diversion scheme form for Mr Blomfield.

The Director of Human Rights Proceedings (“the Director”) alleged that Mr Slater’s actions in disclosing personal information about Mr Blomfield had breached privacy principle 11 and had caused significant emotional harm.

Mr Slater’s defence was that in publishing this material in the blog posts, he was acting as a news medium, and was therefore exempt from the Privacy Act altogether. The news media exemption in the Privacy Act (section 2(1)(b)) provides that the news activities of any news medium are excluded from the Act’s coverage.

What counts as “news activity”

The Tribunal looked at a number of Whale Oil blog posts about Mr Blomfield and considered whether those posts could be considered to be a news activity. The Tribunal noted in its decision that the media exemption was not all-encompassing or open-ended [para 62.5].

Further, the Tribunal said it was “… not the purpose of the news medium exemption to shield a news medium from the Privacy Act where the agency fails to meet the standards of responsible news activity, including impartiality, accuracy and balance” [para 62.8].

In considering what constituted “news” the Tribunal noted “…the personal information must itself qualify as news, observations on news or current affairs before the news medium exemption applies” [para 78]. This test takes into account the fact that the Privacy Act’s primary purpose is to protect information about individuals.

There was a countervailing responsibility upon news media to act ethically and in a manner that was consistent with the public interest in fair and accurate reportage of news or current affairs [para 80].

Of the 40 or so documents published by Mr Slater, there were 12 posts in which Mr Blomfield’s personal information was accompanied by observations on news or current affairs. The Tribunal considered the application of the news media exemption in relation to only those 12 posts [para 95].

The Tribunal found that, with one exception, none of the blogs comprised news activity as defined in the Privacy Act [para 135].

Harm

Mr Blomfield submitted on the significant harm he had suffered as a result of the publication of the blog posts, including feelings of paranoia; difficulty sleeping; anxiety; concerns about personal and family safety; and a loss of confidence [para 141].

The Tribunal found that, on the balance of probabilities, Mr Blomfield had experienced significant humiliation, loss of dignity and injury to his feelings, and that Mr Slater’s actions were a material cause of the harm [para 142-3].

Remedies

The Tribunal awarded Mr Blomfield $70,000 for severe humiliation, severe loss of dignity and severe injury to feelings [para 173].

The Tribunal also made an order restraining Mr Slater from continuing or repeating the interferences with Mr Blomfield’s privacy, and an order that Mr Slater ‘erase, destroy, take down and disable’ any personal information about Mr Blomfield on the Whale Oil website or other websites within Mr Slater’s control [para 162].

A declaration was issued by the Tribunal that Mr Slater had interfered with Mr Blomfield’s privacy.

Image credit: Office of Human Rights Proceedings

Human Rights Review Tribunal, media

Back

Source:

Following the tragic events of Christchurch in March 2019, gun reform is a legislative priority. The Government recently introduced the Arms Legislation Bill to impose tighter controls on the use and possession of firearms.

Many doctors, particularly in rural areas where firearms are more common, may have found themselves in a situation where they have concerns about a patient’s access to a gun. The new Bill will provide some support to health practitioners who hold concerns about individual or public safety. It may also mean that health practitioners are asked for information by Police more often when Police are considering firearms licence applications.

Changes to the application process

The Bill will change the process for applying for a firearms licence. Under the process as proposed, applicants would be required to provide the name and contact details of their health practitioner. Police could then use this information to notify the relevant medical practitioner of the fact the individual holds a licence.

The Bill also clarifies what Police can consider as part of a “fit and proper person” test for a firearms licence. The Bill says Police can consider:

• the applicant having exhibited significant mental health issues, including attempted suicide or other self-harm;
• the applicant abusing alcohol, or having a dependence on alcohol, to an extent that detrimentally affects their judgment or behaviour;
• the applicant using legal or illegal drugs in a way that detrimentally affects their judgment or behaviour.

Health practitioners may find that they receive more frequent requests from Police, either to query an applicant’s mental or physical health, or to advise that a firearms licence has been granted. This will mean health practitioners will be more aware of their patients’ access to firearms.

Concerns about an individual who may be unfit to use a firearm

The new Bill will allow for health practitioners to disclose to Police information about an individual’s mental or physical health where the health practitioner is concerned that an individual is unfit to possess and use a firearm.

The new section 91 states that a health practitioner must consider notifying Police if they have reason to believe that their patient is a firearms licence holder and they consider that in the interests of public safety, that person should not be permitted to possess or use a firearm due to their mental or physical condition.

If a doctor decides to notify Police, they will need to tell Police:

• their opinion and the grounds on which they have come to that conclusion;
• whether the doctor believes the licence holder poses an immediate or imminent danger of self-harm or harm to others.

Police may then temporarily suspend the licence. Police may also require a firearms licence holder to undergo a further medical assessment in considering whether to revoke the licence.

Health practitioners may already be aware of their ability to disclose personal health information to Police if they have concerns about safety. The Health Information Privacy Code 1994 allows health practitioners to disclose health information if they believe it is necessary to avoid a prejudice to the maintenance of the law or there is a serious risk to an individual’s or the public’s safety. The new section in the Arms Legislation Bill provides further support for health practitioners to disclose information where they have serious concerns.

The new section does not impose any obligation on health practitioners to disclose patient information to Police. Health practitioners who disclose information in accordance with new section 91 will be protected from criminal, civil or disciplinary proceedings as long as they act in good faith.

Supporting health practitioners and protecting individual privacy

The Office of the Privacy Commissioner has engaged with Police to ensure that the new firearms legislation appropriately accounts for individuals’ right to privacy, while also addressing the important public safety concerns. The legislation is not perfect – and the Commissioner will be making a submission to the Select Committee considering the Bill on improvements that can be made.

During the development of the Bill, Police originally proposed that health practitioners should have direct access to the registry containing information about all firearms owners. The Commissioner raised concerns about this proposal because of the number of individuals who would have access to the registry, the potential for data breaches and the safety concerns. The Commissioner also noted concerns that the health sector had not been consulted in the development of the proposal. He was also concerned about the effect on the willingness of unwell people, particularly in rural communities, to seek support.

As a result of our feedback, the proposal was changed so that health practitioners would not have direct access to the registry.

If health practitioners have concerns about patient or public safety because of someone’s access to a firearm, they should feel confident and supported in their ability to share this information with appropriate agencies which can act before something goes wrong.

The Arms Legislation Bill is currently before Parliament’s Finance and Expenditure Committee. Submissions on the Bill closed on 23 October 2019. You can read the full content of the Bill here.

This article was first published in the November issue of NZ Doctor.

Image credit: Five bullets via Wikimedia Creative Commons.

Health Information Privacy Code, law enforcement

Back