A major ransomware attack on New Zealand’s Manage My Health patient portal exposed sensitive health records and highlighted weaknesses in the country’s privacy regime. While the Office of the Privacy Commissioner has launched a formal inquiry, New Zealand’s Privacy Act 2020 lacks meaningful financial penalties for failing to protect personal data, unlike stronger deterrents in countries such as Australia. Critics argue that this enforcement gap may reduce incentives for organizations to improve data security.
