NZ is introducing mandatory record keeping to help contact tracers. But is the data protected enough?

From 11:59pm on Tuesday September 7, every person in Aotearoa New Zealand over the age of 12 will be required to keep a record of their whereabouts, either by scanning QR codes or signing paper registers many businesses and event organisers will have to provide.

Mandatory record-keeping is part of an effort to strengthen contact tracing, in response to low numbers of people who were scanning or signing in before the current Delta outbreak and lockdown.

The new rules will lead to significantly more data being collected. The government has reassured the public that any data collected for contact tracing would only be used for that specific purpose, but there are concerns other government agencies could ask for such information for law-enforcement purposes.

I have been calling for strong privacy protections, enshrined in law, since January, when Singaporean police accessed contact tracing data for criminal investigations.

In an open letter to COVID-19 response minister Chris Hipkins, signed by more than 100 academics and civil society organisations, we argue the public health response order that implements the new rules does not provide sufficient privacy protection.

Particular concerns about the potential use of contact-tracing data for other purposes include:

• by police and government agencies with enforcement powers for investigatory or enforcement purposes

• by private sector agencies for marketing purposes

• by employers for purposes other than health and safety

• and by individuals coercively against others.

Read more: Police debacle leaves the McGowan government battling to rebuild public trust in the SafeWA app

The role of protections for contact tracing records

Penalties under New Zealand’s privacy laws are relatively low (up to NZ$10,000) in comparison with Australian laws that protect contact-tracing data (up to A$250,000 or five years’ imprisonment).

Better protection of contact-tracing data should be a relatively simple to introduce, and we have Australian law from which to draw inspiration. This would improve people’s confidence that their contact-tracing records will only ever be used for this purpose, and will help increase participation.

Before New Zealand’s current lockdown, participation in record-keeping was likely too low. We don’t know how many people were keeping pen-and-paper diaries, but only 10-15% of New Zealand adults were scanning QR codes or making manual entries in the NZ COVID Tracer on a regular basis.

Read more: New Zealanders haven't been scanning in enough, and that contributed to the need for a full lockdown

Detailed record-keeping is important for contact tracers to figure out where and when people may have been exposed to an infectious person and to draw up a list of locations of interest as quickly as possible.

It is hard to remember exactly where you’ve been during the 14 days before a positive COVID-19 test. But it might make the difference between contact tracers being able to identify locations of interest and the virus continuing to spread in the community.

What it means for businesses

The list of businesses to which the new requirement applies is long and listed specifically under schedules 2 and 3 of the public health response order).

The onus to scan in won’t be on customers but on business owners. Supermarkets, dairies, hardware stores, food banks and petrol stations are exempt, but the new rules allow people to keep a record in their own diary, so they don’t have to use QR codes or any pen-and-paper option provided by a business.

We need most adults to participate in record keeping to have a significant impact on the spread of new variants, like Delta.

As New Zealand prepares to move down alert levels, more businesses will be allowed to operate. Businesses for which the mandatory record-keeping rule applies will be given seven days after an alert level change to comply. In a practical sense, this means two main things:

1. Businesses will need to provide a pen-and-paper system for individuals to record their visit. I recommend a “ballot box” to help protect privacy (rather than a sheet of paper anyone can read). A template is available. These records need to be kept for 60 days (preferably sorted by date), but then have to be disposed of. They shouldn’t be used for any other purpose, or shared with anyone other than a public health official.

2. Businesses must ensure customers are either scanning the QR code (which is mandatory to display) or otherwise recording their visit. Staff should also be scanning in too, so they can check whether the systems work properly.

A new simplified QR code poster design is available from the Ministry of Health.

Enforcing mandatory record keeping

It is up to businesses to decide their policy for dealing with people who refuse to record their visit. Strictly speaking, the order requires that a record be made, and there are fines of up to $1,000 for non-compliance.

But in reality, it is likely these fines will only be applied against businesses that repeatedly and flagrantly refuse to comply with the requirements.

Businesses trying to do the right thing will need to decide whether or not to serve individuals who refuse to make a record. Businesses can refuse service as they are simply upholding the law, and can call the police if someone is being particularly difficult.

In my opinion, staff should not have to put up with poorly behaved customers or put themselves in danger. The approach should be the same as with other health and safety regulations, such as not serving alcohol to intoxicated patrons.

Even without further legislation to protect the privacy of contact-tracing data, the benefits of everyone maintaining good record-keeping far outweigh the potential costs. Good records could make the difference between containing an outbreak and the whole country having to go into lockdown. It’s a relatively cheap and simple insurance to keep our communities safe.