Earlier this month New Zealand experienced the most destructive cyclone this century. On 14 February 2023, the New Zealand Government declared a National State of Emergency to assist in the response to Cyclone Gabrielle. This declaration triggered the Civil Defence National Emergencies (Information Sharing) Code 2020 (Civil Defence Code), under the Privacy Act 2020. The Code provides agencies with broader discretion when handling personal information during a national emergency, as some of the Privacy Act’s usual controls relating to the collection, use and disclosure of personal information are temporarily suspended.

As of 2pm on Wednesday 22 February, 346 people remain uncontactable. The sharing of private information during a State of Emergency is to prioritise saving lives in what is proving to be a very difficult recovery.

Scope of the Civil Defence Code: what can agencies do?

The Civil Defence Code makes it easier for agencies to share information with one another during an emergency. The Code modifies the information privacy principles relating to the collection, use and disclosure of personal information in the context of an emergency.

Before collecting, using or disclosing personal information on the basis of the Code, an agency must reasonably believe that the following criteria is met:

• The person about who, the personal information relates to may be involved in the emergency.
• The collection, use or disclosure is for a purpose that directly relates to the Government or local government management of response to, and recovery from, the emergency.
• In the case of disclosure, the personal information is disclosed to only to those agencies specified in the Code.

Although the Civil Defence Code is brief, it is pragmatic and enables agencies to respond quickly. It aims to help identify people who are involved in the emergency, assist people with obtaining essential services, and coordinate the management of the emergency.

The Privacy Commissioner has commented that the Code “[makes] it easier for government agencies and local government teams to work together in a safe, planned way.”^[1]

Who does this apply to?

The Code applies to the collection, use or disclosure of personal information of an individual by an agency who believes on reasonable grounds that the individual concerned is involved in an emergency and the collection use or disclosure of the information is for a “permitted purpose” (see below).

Importantly, when it comes to disclosure of the information collected, it can only be disclosed to:

• a public sector agency (eg Crown entities, central government agencies, and local government);
• an agency that is, or is likely to be involved in, managing or assisting in the management of the emergency; or
• an agency directly involved in providing repatriation, health, financial or other humanitarian assistance services to people involved in the emergency, so long as the person disclosing the information has reason to believe that the individual concerned would want the disclosure to occur.
• Note: This may include private businesses involved in the telecommunications, energy, health and finance industries, who are responding to the emergency.

Timeframes

The National State of Emergency was extended on 20 February 2023 for another seven days. The Code will remain in force for 20 working days after the expiry or termination of the National State of Emergency.

Limits of the Code: what do agencies need to watch out for?

The Code only applies to the collection, use and disclosure of personal information for a “permitted purpose”. This is defined as a purpose that directly relates to the government or local government management of response to, or recovery from, a national state of emergency. In all other cases, the Privacy Act should still be complied with (unless of course some other Code issued under the Act applies).

The Privacy Commissioner encourages agencies to notify individuals about the use of their information following the event. This is because agencies may be relying on the Civil Defence Code in circumstances where an individual would ordinarily be required to authorise the collection, use or disclosure of their information.

If you need advice about whether your agency’s collection, use or sharing of personal information is covered by the Code, please contact one of our privacy law experts.

Special thanks to Madeleine Holmes for her assistance in writing this article.

 

[1]      Office of the Privacy Commissioner | What the state of national emergency means for privacy rules.