Privacy Commissioner John Edwards says Hamish Walker's actions were "very disappointing".
Walker has resigned as an MP after he confessed to passing private details of Covid-19 patients to the media.
A privacy breach of active Covid cases was reported by the Weekend Herald, which the Government called serious and possibly criminal.
An inquiry has been launched, headed by Michael Heron QC.
"It really is indefensible behaviour to receive that level of sensitive information and distribute it media outlets," Edwards told Newstalk ZB. "There is no legitimate purpose for holding those individual's sensitive health information in that way."
Edwards believed the deliberate leak of the information was illegal and in breach of the Privacy Act, he said.
"There is a Queen's Counsel appointed to investigate the whole circumstances of the matter and he will be able to consider some of those questions more, whether there are charges that can be pursued and I look forward to his report."
But it was too early to comment on the specific legal advice that Walker had received.
New Zealanders should expect better from their politicians, Edwards said, and it was deeply disappointing "for anyone to use that kind of sensitive personal information as a kind of political stunt and leverage".
"It's a very serious matter. It could be very distressing; it could be harmful for those individuals.
"If he had concerns about the way in which that information was being managed he could've taken them up with me or any number of other people."