Contribute to Newsroom and support quality NZ journalism
A new law tries, but might not entirely succeed, in keeping contact tracing data safe from other state uses. Photo: Emile Donovan
Covid-19
The new law covering vaccination and the use of tracing data is at best rough and at worst potentially flawed.
Former Prime Minister and constitutional law expert Sir Geoffrey Palmer claimed in his 1987 book that New Zealand had “the fastest law in the west”. With no second parliamentary chamber to scrutinise legislation, and with the Labour Party’s dominance after the last election, last week provided an example.
The Covid-19 Response (Vaccinations) Legislation Act (the Act) amended the Covid-19 Public Health Response Act 2020, the Employment Relations Act 2000 and affects other laws such as the Privacy Act 2020.
With no select committee examination that would have allowed public input, the Bill was introduced on Tuesday November 23, put through all its stages the same day, and received the royal assent, turning it into law, on Thursday. At best it is somewhat rough at the edges, but at worst potentially flawed.
Laws – especially those that affect practically everyone – should be clear and comprehensible to ordinary people and not just legal experts. However, if we were to give some of the examples below to students in an exam, we would be at risk of being murdered or suffering serious bodily harm (hopefully metaphorically speaking). One such example is the protection of Covid-19 contact tracing and vaccination information.
To its credit, the Government responded to public pressure, by providing for Covid-19 contact tracing information to be off-limits for other purposes, including normal law enforcement, to encourage the honesty needed to tackle the more serious pandemic danger. The Privacy Act and Health Information Privacy Code (HIPC) were insufficient on their own to protect this contact tracing data as they contain exceptions where there is a belief on reasonable grounds that disclosure of the information is necessary for law enforcement purposes.
The Act now stipulates that “Despite anything in the Privacy Act”, contact tracing information can only be used for contact tracing, enforcement of Covid-19 orders or for the purposes of the Health Act. Likewise, with information collected or obtained for the purpose of determining whether a person is vaccinated or has complied with the Covid-19 Public Health Response Act or a Covid-19 order made under it. It may only be used for these purposes or the purposes of the Health Act.
Criminal offences are created for contravention of these protections – backed up with serious penalties, six months’ imprisonment and fines up to $12,000 – plus the ability to complain to the Privacy Commissioner. Employers, especially, need to be cognisant of these. For example, using contact tracing records for the purposes of disciplining an errant worker for absences from work would constitute an offence.
However, the Health Act exception potentially weakens the apparent protection. Section 22C of this Act, for instance, permits the disclosure of health information (this would include vaccination status and contact tracing information) in several contexts. One of these is where disclosure would be permitted by the Privacy Act or a code such as the HIPC. So, we have now come full circle.
And it doesn’t end there. Section 22 C also allows disclosures to a range of other persons. Some are understandable, for instance employees of district health boards or medical officers of prisons. Individuals themselves (or where under 16 years of age their representatives) can also authorise disclosure of their data. The list, however, includes an assortment of others including probation officers, social workers, and constables in connection with their powers, duties and functions. This leaves the back door wide open for police, for example, to use contact tracing information to prosecute someone accused of a non-Covid related offence (burglary or assault for example).
There are even larger policy concerns. It is questionable whether the security implications of supplying the vaccine passport in the form of an editable PDF were considered (would a simple JPEG have been better?). Nudging New Zealanders to use Google and Apple’s digital wallet infrastructure to store the vaccine pass (effectively supporting their monopolies/oligopoly and supplying them with personal data) is also problematic. We may shoot from the hip with our laws but are they on target?
Gehan Gunasekara, Dr Marcin Betkier and Kathryn Dalziel are from the Privacy Foundation New Zealand. Gehan Gunasekara is an associate professor in commercial law at the University of Auckland Business School and chair of the foundation.
Help us create a sustainable future for independent local journalism
As New Zealand moves from crisis to recovery mode the need to support local industry has been brought into sharp relief.
As our journalists work to ask the hard questions about our recovery, we also look to you, our readers for support. Reader donations are critical to what we do. If you can help us, please click the button to ensure we can continue to provide quality independent journalism you can trust.
Post comments with a
Newsroom Pro subscription.
Subscribe now to start a free
14-day trial.
With 12 days to go until a new mayor is declared for Auckland, Labour-backed Efeso Collins is forced to go after Wayne Brown, who has passed him in the polls
Tim Murphy
National and Labour will be equal parts happy and annoyed with latest poll
Jo Moir
The energy network of the future might unleash the power of neighbourhoods
Alan Brent and Soheil Mohseni
Health ministry only accepts identity documents from Australia and NZ
Matthew Scott
New studies confirm waning immunity over six months after vaccination, imposing greater urgency around booster shots
Matthew Scott
Vaccination incentives rather than requirements before international travel are best, group says
Sam Sachdeva
The new ‘traffic light’ Covid protection system will support businesses to mandate vaccinations for staff, lawyer says.
Anuja Nadkarni
Cabinet has agreed to the use of “vaccine passports” in NZ – likely to be a digital Covid-19 vaccination certificate containing a QR code.
RNZ
Start your day with a curation
of our top stories in your inbox
With thanks to our partners
Start your day with a curation of
our top stories in your inbox
While you’re here would you like to sign up to any of our other email newsletters?
Every morning, get a snapshot of Newsroom’s top 10 stories delivered to your inbox.
Catch up on the week’s top stories, written by our award winning authors.
Love sport? Keep up with the play with LockerRoom’s weekly newsletter dedicated to shining a light on NZ women in sport, curated by Suzanne McFadden.
Award-winning author and writer Steve Braunias brings you the best literary coverage in NZ with reviews, essays, and yarns to entertain and inform you every Saturday.
Dummy text
