Chapman Tripp – High Court Decision on Hacked Data – It Must Be Deleted

Chapman Tripp - High Court Decision on Hacked Data - It Must Be Deleted

The recent High Court judgment against Radio New Zealand (RNZ) follows the approach in Slater v APN in relation to hacked information and is likely to influence future Broadcasting Standards Authority (BSA) and Media Council decisions.

Background

When the Waikato District Health Board (WDHB) refused to pay the instigators of the May 2021 ransomware attack, the media was brought more into play as a source of leverage. The hackers leaked some data directly to media sources then released more on the dark web and told media how to find it. 

RNZ, along with many other media organisations, checked out the site to verify the hackers’ claims and – in the process – found that a child had spent nine weeks in Waikato Hospital because Oranga Tamariki couldn’t find a suitable placement.  

Oranga Tamariki’s methods and competence were the subject of much debate at the time so RNZ considered there was a public interest in running the story and went ahead with it despite strenuous efforts by WDHB to prevent publication, or at least delay it until the child’s family had been notified. 

WDHB sought an interim injunction to stop RNZ and “unnamed defendants” from using the information and requiring that they delete it. The “unnamed defendants” included other media. 

Judgment

As RNZ had consented to the injunction, the High Court provided limited analysis for granting it. The Judge reasoned that:

  • there was a serious question to be tried against the unknown hackers, but didn’t specify – in relation to news organisations – whether the matter at issue was breach of confidence or invasion of privacy
  • the public interest argument was not met as somehow the information was more of public interest than in the public interest, and
  • public policy arguments required that the hackers didn’t benefit from the hack, which created downstream implications for the media. 

In short, the Judge merged the hackers’ position with the media’s position. This merger meant that the Judge failed properly to analyse the breadth of the orders, which did not just apply to RNZ but to any media organisation that had accessed the information. 

Why it matters

The courts have now shown a willingness to issue prohibitive injunctions against anyone who has the hacked information. Arguably this may have a bearing on the use of information from whistleblowers or any other illegally obtained information, even without the same blackmail issues. 

The judgment also is likely to have a bearing on complaints to the BSA and Media Council. Certainly, that is the Privacy Commissioner’s intention. He has said that he will file a complaint with both bodies in the hope of obtaining tougher media standards and codes over the use of unlawfully obtained information. 

Scroll to Top