New Zealand’s Privacy Commissioner has announced a formal Inquiry into the cyber‑security breach affecting Manage My Health Limited, marking one of the most significant privacy investigations since the early days of the Privacy Act.
The decision, released Wednesday afternoon, invokes section 17(1)(i) of the Act — the same mechanism used in past high‑impact cases such as the 2012 ACC privacy scandal, when thousands of personal files were mistakenly emailed to the wrong recipient. Historically, inquiries of this nature have shaped national expectations around data stewardship, often prompting legislative or industry‑wide reforms.
Commissioner Michael Webster said the scale and sensitivity of the compromised information left little room for hesitation. “Given the scale of the incident, the sensitivity of the information and some of the systemic issues being identified, it’s clear to me we need to investigate the privacy issues involved,” he said.
Health data breaches have long been treated as among the most serious forms of privacy failure. From the 2015 Vastaamo psychotherapy breach in Finland to the 2017 WannaCry attack that crippled parts of the UK’s NHS, history shows that when health systems falter, the consequences are deeply personal and often long‑lasting. New Zealanders, Webster noted, “rightly expect any agency collecting, holding, using or storing their sensitive health information to maintain high standards of privacy and data protection.”
The Office of the Privacy Commissioner is currently consulting with relevant parties on draft Terms of Reference, which are expected to be published on 28 January. The Inquiry will examine whether appropriate safeguards were in place, why any failures occurred, and what steps must be taken to prevent a repeat incident.
For a country that prides itself on trust, transparency, and strong public institutions, this investigation carries weight. It signals not only accountability for a single breach but a broader reminder that digital health systems — now central to everyday care — must be fortified with the same diligence once reserved for physical medical records locked in filing cabinets.
CVNZ News will continue to follow developments as the Inquiry progresses.
