Privacy Commissioner John Edwards wants to establish whether any of the 18 people whose data was leaked want to pursue a case against those who breached their privacy.
John Edwards raised concerns about the distribution of patients' details in April. Photo: Supplied / Office of the Privacy Commissioner
Edwards is investigating the Covid-19 patient privacy breach to see whether any further action can be taken following the release of a report that's confirmed political motives and National Party players were behind the leak.
The inquiry, headed by Mike Heron QC, has laid the blame for circulating the private details of patients with Covid-19 on outgoing National MP Hamish Walker and the National Party's former president Michelle Boag.
None of the media outlets which received the leaked patient details published them.
Edwards told Checkpoint the affected patients were among his major concerns.
"I'm very interested in finding out whether any of the individuals whose information was included [in the data breach] are interested in pursuing remedies because if they are, then I would certainly begin an investigation."
Listen
Edwards said he also wanted to explore the original basis for the distribution of the data, how the policy was conceived and executed and whether it was reviewed in a timely way.
He said he had first raised concerns about the distribution of patients' details with the Ministry of Health in April.
He intended to widen his probe into other emergency services who received the data.
The primary concern was the distribution list and then secondly, the security measures around the data, such as passwords.
He said he could only investigate the actions of an agency, not members of Parliament.
Michelle Boag Photo: RNZ / Kim Baker-Wilson
If someone complained about Boag he would have to consider that further. Boag received the data on behalf of the Auckland Rescue Helicopter Trust for whom she was acting chief executive.
She and the trust could both be held liable, but Edwards said that wasn't up to him.
"I don't have any ability to dole out penalties or punishments."
His role was to see if there was any substance to a complaint, and if there was, he could try to bring resolution between the parties. If there was no resolution, he could refer the complaint to the director for Human Rights Proceedings who could bring a case to the Human Rights Tribunal which could award damages of up to $300,000.
Edwards said he was aware that there was a lot of urgency and concern around the early stages of the pandemic and lockdown.
"I need to be a little bit sensitive about the kind of hindsight I bring to that but also it is important that all the agencies involved take the lessons from this for the next time we have this kind of experience."