Monday 13 September 2021

Minister's Response to Open Letter for Contact Tracing Record Protections

Earlier this month, we wrote an open letter to Minister Chris Hipkins calling urgently for legislative protections for contact tracing records, particularly in light of the introduction of mandatory recordkeeping. You can read the response from the Minister in original PDF format here, but I have extracted the text out for accessibility:

Dear Andrew,

Thank you for your email of 2 September 2021. We appreciate the engagement you and the other signatories have exhibited in raising issues that concern you related to actions taken to assist with contact tracing as part of the public health response to the COVID-19 pandemic.

As you know, mandatory record-keeping has been introduced requiring that, from 7 September 2021, the person in control of a workplace of a business or service must have systems and processes in place to ensure, so far as reasonably practicable, each person aged 12 years or older who enters the workplace either scans the QR code for the workplace or otherwise makes their own contact record (Electronic Records); or provides a contact record that the person in control of the workplace collects (Other Records).

In our previous correspondence we have covered that Electronic Records are kept on a person’s own device, and it is only upon the request of a contact tracer that information may be transferred to the Ministry of Health as authorised by the Health Act and used in the management of Covid-19. Other Records may only be used for the same limited purpose and are required to be stored by the business or service provider and after 60 days deleted, unless transferred to a contact tracer.

The Government considers that the wording used in the Alert Level Orders, together with the relevant provisions in the Health Act 1956, provides that information collected in contact tracing records (whether in electronic or hard copy form) are to be used and disclosed solely for the purposes authorised by relevant legislation, including for contact tracing purposes and the “effective management” of COVID-19.

A range of general law powers and remedies are available under New Zealand to prevent the use of information collected in contact tracing records from improper use by businesses and government agencies (even if a warrant had initially been obtained) for purposes broader than is specifically authorised in the Orders and Health Act. For example, the Courts have established processes to ensure that only data and information that is relevant and lawfully obtained may be used in law enforcement investigations. Individuals affected by any misuse of information may have access to the processes provided for by the Privacy Act 2020, the New Zealand Bill of Rights Act 1990, and the Judicial Review Procedure Act 2016.

Continuous improvement of New Zealand’s legal framework is important and necessary. The Government remains interested in what other countries have done, particularly where the use of technology in their systems is more developed than ours. That seems to be particularly important given the global nature of the pandemic, the desirability of operating as consistently as possible with best practice and meeting our international obligations, as we work towards reopening our borders. Other countries’ responses reflect their particular circumstances and culture. Their legal frameworks are not the same as ours and a similar approach may not be necessary or considered appropriate here.

There are significant differences between New Zealand’s and Australia’s constitutional and legal frameworks. It is critical that our legal framework, as it applies to technology, and the rights and interests we have developed, remains fit for purpose in the COVID world. That is important not only for the current contact tracing purposes, but also because we are increasingly likely to want to rely on solutions provided by technology to ensure that contact tracing can be carried out and the information transferred faster and more effectively (both within New Zealand and eventually overseas, as appropriate, when borders open up) without that being any more onerous than required for individuals, businesses and organisations, and government agencies.

The Government has signalled the importance it attaches to removing barriers to people feeling confident to use the COVID Tracer App to store sensitive personal information about themselves and their daily activities so that can be used to speed contact tracing. That is evident in the privacy-by-design approach that has been taken to the architecture of the App, and the way in which relevant data is collected, stored, and deleted.

It might be that there could be additional benefit in providing legislative provisions in a more clear, transparent and easily accessible form. I will raise this with officials for further consideration.

I have asked officials from the Department of the Prime Minister and Cabinet to meet with you and a select number of other authors of this letter to discuss these matter further. I look forward to hearing the result of these discussions.

Yours sincerely,
Chris Hipkins
Minister for COVID-19 Response

No comments:

Post a Comment