Kia ora koutou,

It’s been some time since my editorials mentioned the COVID-19 pandemic. This is largely due to the very fortunate position New Zealand has been in, thanks in most part to our physical isolation. However, our relative seclusion has not been enough to protect us from the more virulent delta strain, and we’ve been in various levels of national and regional lockdown for the last five weeks. This week, the Auckland region moved from level 4 to level 3 lockdown, and the rest of New Zealand sits at level 2. This means the country is starting to move and work again, and with this return to greater freedom comes the need to ensure our contact tracing measures are at the top of their game. Enter renewed conversations on the privacy implications of managing a pandemic.

The government introduced mandatory record-keeping requirements, which will mean a significant increase in collecting, retaining, and sharing personal information about individual location and movement. A concerned group of academics and professionals issued an open letter to the New Zealand government expressing concerns about the privacy protections in place to support mandatory record keeping. A key concern was that the order implementing the requirements was largely silent on privacy and did not impose clear protections against the misuse of the information. Particular risks noted included the use of information by law enforcement agencies, the use of the information by businesses for marketing purposes and the potential for individuals to use the information coercively against others. Taking the view the Privacy Act alone was not sufficient to protect against misuse, the signatories recommended the government legislate to clarify contact tracing information must only be used for contact tracing purposes and set strong penalties (noting the Act contains few) to disincentivize breaches.

While the government initially rejected this recommendation, it has since softened its position, conceding at least that “more guidance” on the use of contact tracing information may be warranted. The New Zealand Privacy Commissioner issued guidance on mandatory record-keeping for contact tracing. The guidance seeks to encourage agencies to ensure they manage contact tracing information in compliance with the Privacy Act, particularly in relation to permitting the public to use methods other than the previously endorsed NZ COVID Tracer app. In addition to suggesting practical and privacy-protective ways to collect and store contact tracing information, the guidance recommends a clear focus on data minimization, use limitation, security and storage limitation. This is a positive step for privacy, but it is only guidance. Agencies that take the time to consider and apply the recommendations made by the commissioner will be less likely to misuse contact tracing information. Still, there remains no clear prohibition on the use of contact tracing information for broader purposes. We may see this undermining New Zealand’s overall pandemic response.

As we watch these pandemic privacy concerns play out both here and across the Tasman in Australia, IAPP members can get some welcome distraction by registering for our upcoming virtual KnowledgeNet session on China’s new Personal Information Protection Law. In the 14 Oct. session, jointly hosted by our Auckland and Brisbane chapters, a powerhouse expert panel of Barbara Li and Clarisse Girot will discuss the implications of PIPL with moderator Stephen Bollinger. As the commencement date for PIPL draws nearer, this is not a session to miss.

Enjoy the digest, folks; stay safe and be kind.

Ngā mihi nui