National is being accused of "dirty politics" after an MP and a former party president confessed to leaking confidential information about patients infected with Covid-19.
Disgraced MP Hamish Walker has admitted sending media the patients' private information — an act that National Party leader Todd Muller had earlier described as "unacceptable".
Walker was given the information by former National president Michelle Boag.
Privacy Commissioner John Edwards described the pair's actions as "outrageous, unbelievable, indefensible".
State Services Minister Chris Hipkins last night described the saga as having a "ring of dirty politics to it".
• National MP Hamish Walker, former party president Michelle Boag admit leaking Covid patients' details
• Covid-19 patient leak: Inquiry launched with Minister determined to uncover 'exactly who' is responsible and why
• Covid 19 coronavirus patients' details leaked: Investigation launched as agencies scramble
• Covid 19 privacy breach: Criminal charges 'on the table' if malicious motive behind leak of personal details
The Herald, which broke news of the privacy breach on Saturday, can now reveal the document was leaked by Walker after his statement about Kiwis flying home from India, Pakistan and Korea was labelled as "racist" by the Government.
The document contained the names, dates of birth and border facilities in which they tested positive. Walker believed naming the patients would back up his claim they came from Asia.
The document did not prove that information.
Last night, Walker said in a statement that he sent the document to show the information wasn't password-protected or stored on a secure system which only authorised people could access.
"I made serious allegations against the Government's Covid-19 response and passed on this information to prove those allegations.
"I did this to expose the Government's shortcomings so they would be rectified. It was never intended that the personal details would be made public, and they have not been, either by me or the persons I forwarded them to."
State Services Minister Chris Hipkins launched an urgent inquiry headed by former solicitor-general Michael Heron, QC, on Monday, saying the leak was "totally unacceptable" and possibly criminal.
It's understood Walker confessed to National leadership on Monday afternoon - before the inquiry was announced - and they didn't know of Boag's involvement until yesterday afternoon.
Walker said he had received legal advice that he had not committed any criminal offence.
He "sincerely apologised" for how he handled the information and said he was sorry for the impact on the affected individuals.
Boag, his source, said the patient records were sent to her private email address through being the acting chief executive of the Auckland Rescue Helicopter Trust (ARHT). She resigned from that role yesterday.
"I very much regret my actions and did not anticipate that Hamish would choose to send it on to some media outlets but I am grateful that the media involved have chosen not to publish the eighteen names that were contained within it."
Boag said she took "full responsibility" for her actions and hoped Aucklanders would continue to support the ARHT.
"My actions were mine alone and should not reflect at all on the professionalism, integrity and outstanding reputation of the Rescue Helicopter staff."
Muller stripped Walker of his Forestry, Land Information and Associate Tourism portfolio responsibilities last night.
"I have expressed to Hamish my view that forwarding on this information was an error of judgment."
Hipkins said the inquiry would continue, despite the confessions, to establish whether there could be improvements into how the data was stored but believed it could speed up the investigation.
"This is a very disappointing situation. It does have a ring of dirty politics to it and I think that would be very sad for the forthcoming election campaign."
Hipkins said MPs should be responsible if they received information they shouldn't and there "should be lines in the sand".
Privacy Commissioner John Edwards said last night that he believed the deliberate leak of the information was illegal and in breach of the Privacy Act. He looked forward to the inquiry's findings, he said.
Edwards added that New Zealanders should expect better from their politicians, and that it was deeply disappointing "for anyone to use that kind of sensitive personal information as a kind of political stunt and leverage".
Before National knew their own MP was the leaker, Muller and health spokesman Michael Woodhouse had been very critical of the privacy breach.
"This is unconscionable and unacceptable that those suffering from the incredibly dangerous virus now have to suffer further with their private details being leaked," Woodhouse said.
"The Government needs to get to the bottom of this, and quickly."
Muller told RNZ the breach was "quite staggering" and "unacceptable".
"Is it a deliberate leak or is it accidental? It doesn't really matter at a level ... it's loose, it's shabby and it's a reminder these guys can't manage important things well."
Public health experts who played a prominent role in the response to the pandemic were quick to condemn the privacy breach.
Auckland University professor Shaun Hendy said the news "makes me sick" while Dr Siouxsie Wiles said the breach was "heartbreaking".
"It's horrendous that personal patient information was able to be leaked like this. But Michelle Boag's conduct is utterly despicable," she said.
"It's heartbreaking trusted powerful people are working so hard to undermine what New Zealand has achieved. They are putting us in great danger."