New Zealand's Manage My Health breached privacy rules on data retention
( October 30, 2026, 01:28 GMT | Official Statement) -- MLex Summary: Manage My Health breached New Zealand’s health privacy rules by collecting hospital information without patient consent and retaining information for too long, a regulator has found. In a statement on Friday, New Zealand’s Office of the Privacy Commissioner announced that it has published a final report into the 2025 data breach that compromised the personal information of 126,000 Manage My Health users. In a final report released on Monday, Privacy Commissioner Michael Webster recommended deleting registered but “unactivated” accounts after three months and contacting dormant account holders after 12 months to check whether they want to retain their accounts. Monday’s report concludes the two-phase inquiry into the data breach, following the publication of the first report in May.Statement follows. Report is attached....
Prepare for tomorrow’s regulatory change, today
MLex identifies risk to business wherever it emerges, with specialist reporters across the globe providing exclusive news and deep-dive analysis on the proposals, probes, enforcement actions and rulings that matter to your organization and clients, now and in the longer term.
Know what others in the room don’t, with features including:
- Daily newsletters for Antitrust, M&A, Trade, Data Privacy & Security, Technology, AI and more
- Custom alerts on specific filters including geographies, industries, topics and companies to suit your practice needs
- Predictive analysis from expert journalists across North America, the UK and Europe, Latin America and Asia-Pacific
- Curated case files bringing together news, analysis and source documents in a single timeline
Experience MLex today with a 14-day free trial.