The government is dismissing calls for more protection of personal information in the Covid-19 contact tracing system.
Photo: RNZ / Dom Thomas
As of midnight last night, it is mandatory for most businesses and event organisers to give customers a way to record their visit.
While no one can be forced to scan in, it is being made increasingly difficult to resist and there are fears tracing data could be accessed by businesses, police or social services.
The Ministry of Health is running reassuring ads saying the digital diary on the government's NZ Covid Tracer app "is kept safe and secure on your phone, and will only be shared with a contact tracer if you allow it".
Covid-19 Response Minister Chris Hipkins said there was plenty of protection.
"The government has been at pains to reassure people that the information they supply to assist with the critical task of contact tracing will not be used for any other purposes," Hipkins said in a statement.
Covid-19 Response Minister Chris Hipkins. Photo: RNZ / Dom Thomas
"We will not budge on this."
However, many academics, Māori, Pasifika and lawyers are demanding more specific legislation.
Jacinta Fa'alili-Fidow of the Pacific Data Sovereignty Network says the collective benefit of getting the data is proven, but the Minister's reassurances are "certainly not enough".
"And we certainly don't think that the punitive measures that are in place are sufficient either."
Pacific Data Sovereignty and Chief Executive Officer of Moana Research coordinator Jacinta Fa'alili-Fidow. Photo: Supplied
She wants tougher fines for data abusers.
Simpson Grierson law firm partner Karen Ngan said the risks were real despite the Privacy Act, Bill of Rights Act and and the Judicial Review Procedure Act cited by Minister Hipkins, and the Covid privacy statement itself.
"It still doesn't stop another government agency, particularly a law enforcement agency, seeking that information from business or ... seeking a search warrant or a production order," Ngan said.
Even dealing with an approach by police on a voluntary basis would be hard to handle, she said.
"That puts business in a bit of a difficult position, because ... it's not black and white in the legislation."
Māori data sovereignty network Te Mana Raraunga data scientist Caleb Moses has signed an Open Letter with 120 others - including leading Covid-19 advisors Michael Baker, Siouxsie Wiles and Michael Plank - calling on the government to legislate.
"Considering that other countries have put legislation like this, like ... legislation in Australia that exists to put boundaries around the use of contract tracing data, it is a bit strange that Minister Hipkins has chosen not to budge on the matter," Moses said.
Western Australia rushed in laws in June "to maintain community confidence" in contact tracing after police had legally obtained some tracing data to help a murder investigation.
Conversely, in Singapore, in February, laws were passed allowing the police to access contact tracing data for criminal investigations.
The design of New Zealand's contact tracing system is less centralised and more suited to protect people's privacy, than either Singapore's or Australia's.
The Open Letter to the Beehive last Thursday that spelled out the risks was fronted by Auckland technologist Dr Andrew Chen.
Chen has been pushing the government on this all year.
"The reason why I started writing letters in January, was because I thought that we had plenty of time to try and get something in place before something bad happens, so that we can learn from that incidents that have happened overseas," Chen said.
"The fact that on Thursday, the minister said, 'We have not considered legislation' is in direct contradiction to what he said in February... So I think, yeah, it's just something that they hadn't thought about."
In February, Hipkins wrote back to Chen saying the risks were low but adding "I recognise that existing protections are not complete" and saying he was seeking advice on "legislative changes".
A media report called this a backtrack but Hipkins told RNZ "any suggestions of a backtrack are totally false".
Moses said a breach of data privacy would erode trust in the system for everyone, but especially for high-risk communities like Māori.
Fa'alili-Fidow said it was a "delicate approach to fully engaging all Pacific peoples, including those who are non resident, and this hinges on trust in a contact tracing system that will not be exploited or cause further affliction for Pacific communities".
The Privacy Commissioner's Office said it had "raised very similar issues with the Minister over the last year, and will continue to provide advice as required".
The Data Iwi Leaders Group said it did not object in principle to contact tracing being made more widespread.
"However, we believe it is vital that clear frameworks are in place to ensure this data is only collected for its intended purpose and is not being misappropriated without Māori knowledge, input or governance," chair Karen Vercoe said.
National Party deputy leader Dr Shane Reti said the Privacy Act should cover most issues, "helped by repeated ministerial affirmations".
There are 3.1 million registered users of the tracer app, using it at a rate of about a million scans a day. In total, scans number 340 million, compared with just 15 million manual diary entries over the course of the pandemic.