Notes from the Asia-Pacific region: What NZ's MMH breach reveals about accountability

In an October column, I discussed the compliance notices issued by New Zealand's Office of the Privacy Commissioner related to the Manage My Health data breach. The OPC's recently published phase 2 inquiry report provides further insights into what went wrong, and some important lessons for organizations well beyond the health sector. 

One theme that emerges out of the OPC's various reports and findings on this breach is the circumstances in which a technology provider can become independently accountable for complying with the Privacy Act 2020.

Under section 11 of the Privacy Act, an organization that processes personal information solely on behalf of another organization is generally not treated as holding that information for the purposes of the act. Responsibility instead sits with the organization on whose behalf the information is processed. This broadly reflects the controller-processor approach taken in overseas privacy laws.

In the phase 2 inquiry report, the OPC found that MMH's technical matching process resulted in hospital information being imported into records that patients could not access through the portal. Health New Zealand had not instructed MMH to include these records in the matching process. By making that decision independently, MMH was acting on its own account. On this basis, the OPC found MMH breached the collection rules under the Health Information Privacy Code. In other words, section 11 was found not to apply.

This finding is particularly interesting given the OPC's earlier recommendation to amend section 11 of the Privacy Act so that processors would also be directly subject to Information Privacy Principle 5 security obligations. Currently, organizations remain responsible for ensuring that their processors provide reasonable security safeguards, even where the processor controls the systems and infrastructure involved. The OPC's suggested amendment would address this gap by making processors independently accountable for information security.

The MMH finding and the proposed legislative amendment address different issues. The former clarifies when a processor may already have direct obligations under existing law. The latter would extend direct security obligations to processors even when they act solely on their clients' instructions.

Together, they highlight the potential need for a more fit for purpose approach to managing the increasingly complex controller-processor arrangements taking place.

Section 11 reflects a relatively straightforward model in which one organization determines how personal information is used and another processes it on that organization's behalf. But modern cloud platforms, software-as-a-service providers and AI services increasingly complicate that distinction. 

Providers may make significant decisions about system architecture, data flows, retention and security, often with limited visibility or control for their customers. Yet the customer generally remains legally accountable for protecting the information. There is a reasonable argument that accountability should more closely reflect who actually controls the relevant processing activities and risks.

This is a useful reminder that contractual descriptions of controller and processor roles do not necessarily determine legal accountability. What matters is what the parties actually do, and who makes decisions about the processing of personal information. 

Privacy professionals should be looking beyond contractual arrangements and examining how processing relationships work in practice. Who determines what information enters a system? Who sets matching rules, retention periods and other processing parameters? Can the provider make changes without client approval? And how would the client know? These questions should feature in privacy impact assessments, vendor due diligence and ongoing contract management.

As reliance on outsourced platforms and AI services grows, the gap between legal accountability and practical control is becoming increasingly difficult to justify. The MMH inquiry demonstrates that both controllers and processors need to do more to articulate and demonstrate clear accountability, transparency and responsibility.