« On crooks and Labour voters | Main
A note about data breaches
By Steven | February 9, 2026
It’s becoming a regular thing to see hackers get hold of reams of private data and threaten to leak it. (See recently: Manage My Health and Neighbourly leaks. And in recent years: Commerce Commission and Te Whata Ora.)
Courts readily grant injunctions to prevent the disclosure of such purloined information, usually on the basis of breach of confidence; sometimes privacy or copyright or a combination of these. It’s not hard to make the case that the information is confidential and the leak unauthorised. Most agencies don’t need to prove any detriment to anyone, though it’s usually obvious. There’s rarely any public interest to factor in. And injunctions against unidentified defendants are readily available now.
A couple of points though. First, you have to wonder about the utility of such orders. Criminals gonna do crime, you know? If you are resourceful, brazen and immoral enough to steal wads of private data, you’re hardly going to quaver at a court injunction. But I guess the agencies have to be seen to be doing something.
My other point is more technical. I don’t have a problem with these injunctions. But the courts routinely apply tests that are outdated, I think. They apply a general test for injunctions that asks, Is there a serious question to be tried, who does the “balance of convenience” favour, and where does the “overall justice” lie? But in the Fahey case in 1999, the Court of Appeal has said: “Any prior restraint of freedom of expression requires passing a much higher threshold than the arguable case standard.”
That case is never cited in these data cases. (To be fair, they usually involve everyone scrambling to put together evidence and submissions in a day or two. I guess it’s also easy to overlook the free speech rights of hackers who’ve ripped off sensitive data). But these cases are about free speech. That is what is being restrained, nothing else.
When privacy is alleged, the applicants also routinely overlook the passage in our leading privacy case, Hosking v Runting, that says: “The general position, then, is that usually an injunction to restrain publication in the face of an alleged interference with privacy will only be available where there is compelling evidence of most highly offensive intended publicising of private information and there is little legitimate public concern in the information. In most cases, damages will be considered an adequate remedy.” This is intended to hike the threshold in cases where the court is granting an injunction restraining someone’s speech on the basis of a necessarily preliminary and partial look at the relevant evidence.
To be clear, in almost all these cases, that higher threshold would be satisfied, so injunctions would still be granted. But I still think it’s important that they ask the right question.
Topics: General | Comments Off on A note about data breaches