Manage My Health breach provides lessons for us all
A version of this article was first published by the New Zealand Herald on 1 June 2026. The Manage My Health breach wasn’t just a hack or a technical lapse. It was a governance failure amplified by over-reliance on vendors. That’s the message underpinning the...
Manage My Health breach could reshape accountability under the Privacy Act
One of the recommendations to emerge from the Privacy Commissioner's Phase 1 inquiry into the Manage My Health breach (which we discuss further in this article) – appearing almost as an afterthought – could fundamentally reshape accountability under the New Zealand Privacy Act. The Commissioner...
2026 OPC survey finds children’s data, AI continue to top privacy concerns
A version of this article was first published by IAPP on 21 May 2026. During Privacy Week, New Zealand's Office of the Privacy Commissioner released its 2026 consumer survey. Some interesting themes and trends are emerging, as compared to the 2025 survey. Public concern about...
Time is running out to ensure compliance with new transparency obligation
On 1 May 2026, a new information privacy principle – IPP 3A – will come into effect. IPP 3A requires organisations to give people privacy notice about the collection of personal information from third parties. Until now, the law only required organisations to give privacy...
Navigate 2025
On 25-26 June 2025, our Principal Daimhin Warner had the privilege of attending the first-ever IAPP Navigate Digital Policy Retreat in Portsmouth New Hampshire. The retreat saw a select community of leaders from industry, government, academia and civil society engage in deep discussions about developing...
Regulatory spotlight on information sharing (and what this means for you)
Government information sharing has been in the spotlight in Aotearoa NZ recently, following the release of two inquiry reports by the Public Service Commission (PSC) and Stats NZ respectively. These inquiries should give organisations pause for thought about the extent of their obligations when sharing...
OPC confirms that it will issue a biometrics code of practice in 2025
On 18 December 2024, the OPC announced its decision to press on with issuing a Biometrics Processing Privacy Code, regulating the use of biometric systems to process biometric information. This follows the release in April 2024 of an exposure draft of the code, on which...
High Court rules on abuse survivors’ data access rights
Privacy rarely reaches the courts in New Zealand. While, naturally, the courts are often called to decide on the application of common law privacy rights (otherwise known as the tort of privacy) – such as in the context of media activities – matters relating to...
Ok Computer? Time to think about Responsible AI
Did you get the chance to have a play with ChatGPT over the summer break? ChatGPT – which Microsoft is incorporating into its Bing search engine – generates incredibly convincing, human-like text*. It also provides tangible evidence of the impact artificial intelligence (AI) will have...
Trusted transparency – Connecting the dots between what you say and what you do
This year's Privacy Week theme - trust - got us at Simply Privacy thinking about the role of transparency in the trust picture. Transparency is a well-known privacy concept. It's not news that being open about how personal information will be used and shared is...