Crown gets a healthy telling off: Treaty principles and health information privacy

Last week, in well publicised news, the Ministry of Health was the subject of judicial criticism for its failure to respond to a request from a Whānau Ora health agency in a manner consistent with the Treaty of Waitangi principles.

The Crown has received wide acclaim over the past 18 months for its response to the COVID-19 pandemic. The shine on the response has however tarnished recently as questions are raised about the extent to which the Crown has truly engaged with the full team of Five Million, with the slow vaccination rollout taking heat for the disproportionately low vaccination rates amongst Māori.

On Monday the High Court issued its judgment in Te Pou Matakana Limited v Attorney-General [2021] NZHC 2942, a key decision declaring that the Ministry of Health’s power to disclose information under the Health Information Privacy Code 2020 in the context of the COVID-19 vaccination programme must be exercised in accordance with Te Tiriti o Waitangi (Te Tiriti) and its principles.

Despite media reports, the judgment did not in fact mandate the provision of the requested information but instead directed the Ministry of Health to urgently retake its decision within three working days. We understand that the Ministry has since indicated to TPML that having reviewed the evidence provided by TPML as well as other Māori leaders and health experts, it has concluded it would not be appropriate to adopt a blanket approach to the information sharing sough given the multiple interests at issue. Whānau Ora has indicated it is likely to bring the matter back before the Courts.

Whilst the decision arises in the particular Health Information Privacy context, the decision has implications in the Privacy space more generally as well as adding to the increasing case law around the need for the Crown to have regard to the application of Te Tiriti and its principles as informed by tikanga.

What is the background to this case?

Whānau Ora is a Government funded approach to whānau wellbeing and development which is delivered by Māori.

Te Pou Matakana Limited (TPML) is an agency commissioned by Te Puni Kōkiri (Ministry of Māori Development) to work with whānau and families in the North Island and in particular to provide assistance to whānau to address the impacts of COVID-19 restrictions. This includes the provision of vaccination related services which are designed to be provided in ways which are more culturally and physically accessible to Māori. It has a partnership of nearly 100 Whānau Ora providers across the North Island to assist in the provision of these services.

Whānau Tahi Limited (WTL)  is the information systems provider for TPML.

The applicants sought a data sharing arrangement with the Ministry to enable the sharing of information about unvaccinated Māori in the North Island with TPML, including personal details, contact details, vaccination status and vaccination booking status to enable them to increase Māori vaccination rates by targeting those who had received no vaccine doses or only one vaccine.

The Ministry initially agreed to provide vaccine status information of those who had previously received services from one of TPML’s Whānau Ora partners but declined to share the same individual data for Māori within the North Island who had not received such services. They subsequently agreed to provide anonymised mapping representations showing areas with unvaccinated communities but declined to provide individual identifiable data for unvaccinated individuals.

What did the applicants argue?

The applicants challenged this decision, arguing:

• The Ministry erred in law by incorrectly applying the legal test for disclosing health information under rule 11(2)(d) of the Health Information Privacy Code. This rule permits disclosure without the authority of individuals if a health agency believes it is not desirable or not practicable to obtain that authority from the individual AND that the disclosure is necessary to prevent or lessen a serious threat to public health or safety or the life or health of the individual concerned or another individual;

• The Ministry acted inconsistently having provided similar data to another health service provider (Healthline); and

• The applicants had a legitimate expectation the decision would be made in accordance with the principles of Te Tiriti (and this limits the scope of its discretion under r 11(2)(d). They argued the Ministry’s decision was inconsistent with both those principles and tikanga.

• The Te Tiriti principles the applicants identified in particular were:

• Options – which in the pandemic context means enabling a genuine choice of Kaupapa Māori providers (which depends on suitable resourcing in both funding and information);

• Tino rangatiratanga and partnership – in this instance, requires disclosure of the information sought and working together; and

• Active protection – the Crown has a duty to actively protect the health rights of all Māori which is heightened in the context of a COVID-19 pandemic.

• The applicants argued having regard to tikanga is an integral part of considering and applying the principles of Te Tiriti – a tikanga lens is required, not just a Pākehā legal lens, in assessing the rights of the applicants and the whanau they support (and owe kaitiakitanga obligations to).

It was not in dispute that:

• The COVID-19 immunisation programme has not delivered equitable coverage between Māori and other ethnic groups;

• There are significant barriers to Māori accessing primary healthcare services (including cost, access to services, cultural barriers, poor communication and different approaches to well-being) which is reflected in a lower percentage enrolled with primary health organisations; and

• Lack of trust in Government institutions is one of the reasons for the lower vaccination rate amongst Māori.

What did the Court decide?

Gwyn J granted the application for judicial review and granted relief as follows:

• A declaration that the Ministry erred in its consideration of whether disclosure of the information to TPML was necessary for the purpose of rule 11(2)(d of the Health Information Privacy Code 2020;

• A declaration that the Ministry’s power to disclose information under rule 11(2)(d) in the context of the COVID-19 vaccination programme must be exercised in accordance with Te Tiriti and its principles;

• A direction that the Ministry retake its decision within three working days (so by the end of Thursday 4 November) in accordance with the law and having regard to her findings (discussed further below).

How did the Court interpret rule 11(2)(d) of the Health Information Privacy Code 2020?

In reaching her decision Gwyn J noted the following:

• The Rule 11(2)d) exception to the general rule that health information not be disclosed without authority confers a discretion on agencies, where the relevant criteria for disclosure are met – there is no right of access or duty to disclose;

• There was no dispute the Ministry found it was not practicable to obtain individual authority to the release of the information due to the number of individuals, range of geographic locations and time pressure;

• There was also no dispute that the Ministry:

• found the COVID-19 pandemic constitutes a serious threat to public health and safety;
• acknowledged approaches to date were not successful in achieving equitable vaccination rates; and
• noted the need to reach all eligible people as soon as possible and increase Māori vaccination rates.

The Court accepted that actions and decisions of public agencies impacting rights to privacy and health must be proportionate and evidence-based, both in considering whether it is necessary to disclose or use information and whether the proposed disclosure or use provides a realistic prospect of preventing or lessening the health risk

The Court found however that the Ministry’s decision in this case focussed instead on wider policy context and risk of precedent setting rather than the benefits and risks of the particular disclosure sought.

The Court noted:

• A mismatch between the Ministry’s acceptance of the risk level and its decision – it accepted the threat of COVID-19 required supporting all individuals to access vaccines but would provide only anonymised data and while noting the critical need to offer two doses as soon as possible indicated a preference for coming weeks to be spent trying to use anonymised data to locate individuals;

• A “least privacy invasive approach” to a disclosure decision will be relevant if there are two equally effective alternatives and one is less privacy intrusive than the other but the door-to-door approach necessitated by the provision of anonymised data was not an equally effective alternative to being able to contact individuals directly through individual data being provided; and

• The argument that increasing vaccination rates indicated the limited disclosure permitted was effective was not sufficient as most recent statistics continued to indicate a gap of approximately 20% between Māori and the rest of the population.

What did the Court find on legitimate expectation and the principles of Te Tiriti?

On this ground the Court found:

• The Government made specific commitments to uphold Te Tiriti in the COVID-19 vaccination rollout as evidenced by public statements on the Ministry of Heath’s website;

• It was reasonable for the applicants to rely on the repeated affirmations by the Crown to apply Te Tiriti and its principles in its COVID-19 response;

• There was a legitimate expectation the Crown would have regard to Te Tiriti and its principles in reaching this decision and the Ministry failed to determine the request for the data consistently with this commitment;

• The specific words in the decision and outline of the process were less important than the context and substance of the process;

• The decision noted any proposed disclosure needed to be on a case by case basis ensuring proportionality of information sharing with the ability of the requester to deliver but did not assess the request through this lens; and

• It was difficult to see how the decision to provide only anonymised data on the basis that the Ministry might review the decision at an undefined future date could have been informed by the principles of partnership and options.

What are the key takeaways?

Whilst in some ways this is a case which is dependent on its own particular facts, it provides badly needed guidance on the interpretation of the use of the r 11(2)(d) exception which is equally relevant in the Information Privacy Principle equivalent.

The decision also highlights the increasing focus of the Courts on the practical application of Te Tiriti principles in Crown decision making generally, and in this instance more particularly in the Privacy space.

For more information in the Privacy space please contact a member of our privacy or public law team.

Disclaimer: The content of this article is general in nature and not intended as a substitute for specific professional advice on any matter and should not be relied upon for that purpose.