ManageMyHealth Anonymous Email Tip
Marcus made this Official Information request to Privacy Commissioner
The request was refused by Privacy Commissioner.
From: Marcus
Dear Privacy Commissioner,
I was having a read of this article which references an anonymous email received by the Office of the Privacy Commissioner back in June 2025.
https://businessdesk.co.nz/article/law-r...
It states the following about the aforementioned email:
> The tipster alleged names, email addresses and passwords were "exposed by the Manage My Health platform"
Would you be able to release a copy of this email for public viewing?
Yours faithfully,
Marcus
From: OIA
Privacy Commissioner
Thank you for your message. The office is closed until Monday, 12 January
2026. We will acknowledge your request when the Office reopens. Please
note that the the OIA response time is extended to allow for the holiday
break. Under the OIA, 25 December – 15 January (inclusive) are not counted
for the purposes of the 20 working day timeframe.
Ngâ mihi
OIA Team
From: OIA
Privacy Commissioner
Kia ora
Please find attached the Privacy Commissioner’s response to your official
information request.
Aku mihi
Sharyn Leonard
Executive Assistant (Legal) | Kaiâwhina Mâtâmua – Ture
Office of the Privacy Commissioner Te Mana Mâtâpono Matatapu
PO Box 10094, Wellington 6140
privacy.org.nz
[1][IMG]
Privacy is about protecting personal information, yours and others. To
find out how, and to stay informed, [2]subscribe to our newsletter. Have a
privacy question? [3]AskUs
Caution: If you have received this message in error please notify the
sender immediately and delete this message along with any attachments.
Please treat the contents of this message as private and confidential.
Thank you.
References
Visible links
1. https://www.privacy.org.nz/resources-and...
2. http://privacy.org.nz/subscribe/
3. http://www.privacy.org.nz/ask
From: Marcus
Hi Sharyn,
Thanks for responding and I acknowledge that privacy requirements around anonymous tips means that the Privacy Commissioner is required to maintain secrecy.
I am curious if the anonymous tip received by the Office of the Privacy Commissioner is the same one detailed here (https://www.georgenews.org/p/the-slipper...) or something else entirely.
With that, I'm wondering if you have knowledge of an email being received that contains two PDF attachments: the first being 3 pages titled "Security Incident Report: Exposure of PII via Manage My Health Platform" and the second being 52 pages long?
You'll have to forgive me for being a bit cheeky but I figure if you don't have any knowledge of such an email, it should be fine to reject this request under Section 18 (e) of the Official Information Act (information does not exist) as Section 206 (1) of the Privacy Act would seem to suggest that you only need to maintain secrecy of matters that come to your knowledge. In short, I'm wondering if something that doesn't exist counts as a matter you need to keep secret about.
I understand if you need to invoke Section 10 of the Official Information Act or would reassert Section 206 of the Privacy Act but I figure it's worth a try :)
Yours sincerely,
Marcus
From: OIA
Privacy Commissioner
Tçnâ koe
Please find attached the Privacy Commissioner’s response to your official
information request.
Aku mihi
Sharyn Leonard
Executive Assistant (Legal) | Kaiâwhina Mâtâmua – Ture
Office of the Privacy Commissioner Te Mana Mâtâpono Matatapu
PO Box 10094, Wellington 6140
privacy.org.nz
[1][IMG]
Privacy is about protecting personal information, yours and others. To
find out how, and to stay informed, [2]subscribe to our newsletter. Have a
privacy question? [3]AskUs
Caution: If you have received this message in error please notify the
sender immediately and delete this message along with any attachments.
Please treat the contents of this message as private and confidential.
Thank you.
References
Visible links
1. https://www.privacy.org.nz/resources-and...
2. http://privacy.org.nz/subscribe/
3. http://www.privacy.org.nz/ask
Things to do with this request
- Add an annotation (to help the requester or others)
- Download a zip file of all correspondence (note: this contains the same information already available above).
Offensive? Unsuitable?
Requests for personal information and vexatious requests are not considered valid requests for Official Information (read more).
If you believe this request is not suitable, you can report it for attention by the site administrators
Report this request
Marcus left an annotation ()
For anyone interested, I think that the anonymous tip is not credible based on my reasons stated here: https://bsky.app/profile/utf9k.net/post/...
That said, there's still the possibility that this anonymous tip is a different anonymous tip.
Link to this