New Zealand

The Privacy Commissioner issued compliance notices after finding both agencies failed to meet rule 5 of the Health Information Privacy Code at the time of the December 2025 cyber attack on Manage My Health. Health NZ's deadline is 29 January 2027 and Manage My Health's is 31 August 2027.

Auckland District Court convicted Mr McEwen on four charges of breaching an FMA stop order and imposed a seven-year banning order barring him from being a director or promoter of, or involved in managing, a New Zealand company and from providing financial advice services. The FMA had made a permanent stop order against him in December 2023. The page does not state any fine or sentence.

The FMA cancelled the firm's financial advice provider licence after finding it had modified supporting documents sent to lenders for six clients' loan applications, had not disclosed a referral arrangement involving payments to a third party, and could not produce the original records. The FMA also raised concerns about access to clients' personal information. Exact cancellation date not stated on the page (dated 30 March 2026).

The Auckland High Court ordered SkyCity to pay an agreed civil pecuniary penalty of $4.16 million NZD plus a contribution to DIA's legal costs. SkyCity admitted all five causes of action, covering risk assessment, the AML/CFT programme, monitoring, enhanced customer due diligence and terminating relationships, with failures running from February 2018 to March 2023.