The Office of the Privacy Commissioner has released information about disclosure of information related to COVID-19.
The information is presented as a series of questions and answers.
These include whether an event organiser has to give attendee information to the health authorities if asked when there's a notifiable disease case (yes) and whether the other people who attended the event can be told there has been a suspected or confirmed COVID-19 case (the "right thing to do" is to give attendee contact information to the health authorities).
Another question is whether an employer can tell employees that a colleague might have a notifiable disease.
"Under the Privacy Act, there is a general obligation not to use or disclose personal information, unless an exception applies," the Office states/
"One of the exceptions that permits the use or disclosure of personal information is where you believe that the use or disclosure is necessary in order to prevent or lessen the risk of a serious threat to someone’s safety, wellbeing or health.
"Under this exception, when dealing with an employee who may have contracted a highly contagious disease, it may be prudent to advise other employees so they can monitor themselves for possible symptoms, isolate themselves from the workplace and take steps to protect themselves. It may not be necessary to identify the source of the exposure but there will be times when that will be unavoidable in the context, such as in a small organisation or office where only one person is absent on sick leave."