Privacy Impact Asessment for registration of overseas vaccinations
Keith Bolland made this Official Information request to Ministry of Health
The request was partially successful.
From: Keith Bolland
Dear Ministry of Health,
This page on the Ministry of Health website describes a process for registering details of vaccinations received overseas on the Covid Immunisation Register:
https://www.health.govt.nz/our-work/dise...
I request a copy of any Privacy Impact Assessment which was conducted for this process. If the process was assessed as part of a broader-scope PIA, then I request a copy of that PIA.
Many thanks.
Yours faithfully,
Keith Bolland
From: OIA Requests
Kia ora,
Thank you for your Official Information Act (the Act) request. This is
an automatic reply to let you know we received it.
Due to the COVID-19 global pandemic response, the Ministry is experiencing
significantly higher volumes of queries and requests for information. We
will endeavour to acknowledge your request as soon as possible. Further
information about COVID-19 can be found on our
website: [1]https://www.health.govt.nz/our-work/dise...
Please be advised that due dates for requests received from 29 November
2021 onwards take into account the following periods:
Christmas (25 December 2021)
Summer Holidays (25 December to 15 January)
New Year's Day (1 January 2022)
Day after News Year's Day (2 January 2022)
If you'd like to calculate the due date for your request, you can use the
Ombudsman's online calculator here: [2]http://www.ombudsman.parliament.nz/
If you have any questions while we're processing your request, please let
us know via [3][email address]
Ngā mihi
OIA Services Team
[4]Ministry of Health information releases
[5]Unite against COVID-19
show quoted sections
References
Visible links
1. https://www.health.govt.nz/our-work/dise...
2. http://scanmail.trustwave.com/?c=15517&a...
3. mailto:[email address]
4. https://www.health.govt.nz/about-ministr...
5. https://covid19.govt.nz/
From: OIA Requests
Kia ora Keith
Thank you for your request for official information. The Ministry's reference number for your request is: H202117015.
Please be advised that due dates for requests received from 29 November 2021 onwards take into account the following periods:
Christmas (25 December 2021)
Summer Holidays (25 December to 15 January)
New Year's Day (1 January 2022)
Day after News Year's Day (2 January 2022)
Your request has been logged and you can expect a reply no later than 20 January 2022 as required under the Official Information Act 1982.
Due to the COVID-19 global pandemic response, the Ministry is experiencing significantly higher volumes of queries and requests for information. If we are unable to respond to your request within this time frame, we will notify you of an extension of that time frame.
If you have any queries related to this request, please do not hesitate to get in touch.
Ngā mihi
OIA Services
Government Services
Office of the Director-General
Ministry of Health
E: [email address]
show quoted sections
From: OIA Requests
Tçnâ koe Keith
Thank you for your request under the Official Information Act 1982 (the
Act) to the Ministry of Health (the Ministry) on 2 December 2021 for:
“This page on the Ministry of Health website describes a process for
registering details of vaccinations received overseas on the Covid
Immunisation Register:
[1]https://www.health.govt.nz/our-work/dise...
I request a copy of any Privacy Impact Assessment which was conducted for
this process. If the process was assessed as part of a broader-scope PIA,
then I request a copy of that PIA.”
The Privacy Impact Assessment for the Covid-19 Immunisation Register (CIR)
is available on the Ministry’s website at the following
address: [2]www.health.govt.nz/system/files/documents/pages/privacy-impact-assessment-covid-19-immunisation-register-cir-071221.pdf.
Under section 28(3) of the Act, you have the right to ask the Ombudsman to
review any decisions made under this request. The Ombudsman may be
contacted by email at: [3][email address] or by calling 0800
802 602.
Ngâ mihi,
OIA Services
Government Services
Office of the Director-General
Ministry of Health
E: [4][email address]
show quoted sections
References
Visible links
1. https://www.health.govt.nz/our-work/dise...
2. http://www.health.govt.nz/system/files/d...
3. mailto:[email address]
4. mailto:[email address]
From: Keith Bolland
Dear OIA Requests,
Thank you for providing this information.
On page 6 of the PIA, paragraph 17 states in part:
"This Assessment reviews only the initial iteration of the CIR (Release 1). Any further releases will be subject to additional Privacy Impact Activity."
Can you please advise whether there have been subsequent releases since Release 1, and whether those releases have, as forecast, resulted in additional privacy impact activity? If so, I request a copy of those documents.
For clarity, I am particularly interested in what consideration has been given to the privacy implications of the overseas-vaccination process being built around collecting significant personally-identifiable health information through unsecured email.
Yours sincerely,
Keith Bolland
From: OIA Requests
Thank you for your Official Information Act request. This is
an automatic reply to let you know we received it.
In accordance with the Act, we'll let you know our decision within no more
than 20 working days. If you'd like to calculate the timeframe, you can
use the Ombudsman's online calculator
here: [1]http://www.ombudsman.parliament.nz/
Due to the COVID-19 global pandemic response, the Ministry is experiencing
significantly higher volumes of queries and requests for information. This
means we may take some time in responding to your request. The Ministry
regularly updates information about the COVID-19 situation and publishes
OIA responses considered to be of public interest:
[2]https://www.health.govt.nz/about-ministr...
Please also refer to the Unite Against Covid-19 website for copies of
papers, minutes, and key advice for the decisions the Government has made
relating to COVID-19.
Sometimes we may need to clarify aspects of a request. You can expect to
hear from us soon if that is the case here.
Ngā mihi,
OIA Services
Government Services
Office of the Director-General
Ministry of Health
E: [3][email address]
show quoted sections
References
Visible links
1. http://scanmail.trustwave.com/?c=15517&a...
2. https://www.health.govt.nz/about-ministr...
3. mailto:[email address]
From: OIA Requests
Kia ora Keith,
Thank you for your follow up request for official information. The
Ministry's reference number for your request is: H202200383
As required under the Official Information Act 1982, the Ministry will
endeavour to respond to your request no later than 20 working days after
the day your request was received. If you'd like to calculate the
timeframe, you can use the Ombudsman's online calculator
here: [1]http://www.ombudsman.parliament.nz/
Due to the COVID-19 global pandemic response, the Ministry is experiencing
significantly higher volumes of queries and requests for information. If
we are unable to respond to your request within this time frame, we will
notify you of an extension of that time frame.
If you have any queries related to this request, please do not hesitate to
get in touch.
Ngā mihi
OIA Services
Government Services
Office of the Director-General
Ministry of Health
E: [2][email address]
show quoted sections
From: OIA Requests
Tçnâ koe Keith,
Thank you for your request under the Official Information Act 1982 (the
Act) to the Ministry of Health (the Ministry) on 17 January 2022 for:
“On page 6 of the PIA, paragraph 17 states in part:
"This Assessment reviews only the initial iteration of the CIR (Release
1). Any further releases will be subject to additional Privacy Impact
Activity."
Can you please advise whether there have been subsequent releases since
Release 1, and whether those releases have, as forecast, resulted in
additional privacy impact activity? If so, I request a copy of those
documents.
For clarity, I am particularly interested in what consideration has been
given to the privacy implications of the overseas-vaccination process
being built around collecting significant personally-identifiable health
information through unsecured email.”
Please note, COVID-19 Immunisation Register (CIR) releases are by year and
number. The last major release of last year was 21.16 on 20 December 2021
and the first one this year was 22.2 on 16 January 2022 (release 22.1 did
not end up being implemented). Please note not all releases counted in the
number are for the CIR.
All PIA’s that have been completed in relation to COVID-19 systems and
processes are available on the Ministry’s website at
[1]www.health.govt.nz/our-work/diseases-and-conditions/covid-19-novel-coronavirus/covid-19-resources-and-tools/covid-19-your-privacy.
The privacy statement is on page 57 of the 'My COVID Record/Vaccination
Certificates PIA'.
Under section 28(3) of the Act, you have the right to ask the Ombudsman to
review any decisions made under this request. The Ombudsman may be
contacted by email at: [2][email address] or by calling 0800
802 602.
Nâku noa, nâ
OIA Services
Government Services
Office of the Director-General
Ministry of Health
E: [3][email address]
show quoted sections
References
Visible links
1. http://www.health.govt.nz/our-work/disea...
2. mailto:[email address]
3. mailto:[email address]
Keith Bolland left an annotation ()
Popping back in to add: I don't know when it changed (sometime in the last four weeks, evidently) but there is now a proper, secure form for uploading proof of overseas vaccination so the concerns this OIA reflected are moot.
Things to do with this request
- Add an annotation (to help the requester or others)
- Download a zip file of all correspondence (note: this contains the same information already available above).
Offensive? Unsuitable?
Requests for personal information and vexatious requests are not considered valid requests for Official Information (read more).
If you believe this request is not suitable, you can report it for attention by the site administrators
Report this request
Keith Bolland left an annotation ()
The reference to the privacy statement has a typo -- it's actually on page 67. Direct link to the document: https://www.health.govt.nz/system/files/...
The person handling the OIA doesn't seem to understand that the Health website directs people who got their vaccines overseas to supply evidence of those vaccinations over email, because they keep directing me to privacy paperwork for My Covid Record (which, to Health's credit, appears to be very thorough). But I am tired of trying to explain it.
Link to this