New Zealand the wild west of contact-tracing
Strangely, the Government is making glacial progress on a nationwide digital contact tracing solution while at the same time requiring “DIY” contact-tracing data collection by almost every business and organisation in the land.
Progress on the nationwide app to support contact-tracing has had all the forward momentum of a car with the handbrake applied, but the Government has justified that with the need to address concerns about data sensitivity, privacy, and accuracy.
Nonetheless, it has been quick to delegate the collection of contact-tracing information to thousands of New Zealand organisations, requiring them to collect details of all employees, visitors, and customers in order to operate at level 2.
Many of those organisations are less than ready to handle and protect sensitive and private data and are already labouring under weighty burdens imposed by Covid-19.
So what do cafes, councils and construction companies do when told they must find a way to collect details that a public health unit could use for contact tracing? Solutions range from the rudimentary pen and paper suggested by WorkSafe, through to a multitude of apps and databases flooding the market.
Even a basic “sign-in register” is far from harmless, with the risk of catching Covid19 from a ballpoint pen the least scary part. The recent case of an Auckland woman whose details were misused by a restaurant worker shows just why we should worry about who can see our information. But we should also think about what will happen to tens of thousands of pieces of paper, Excel spreadsheets and rich databases full of our personal data in the long term.
Our data will be held with varying degrees of security and used in ways that range from trustworthy to reckless.
Regardless of how they work (and you will possibly never know) you will be feeding your details into myriad contact tracing solutions multiple times a day, because that is the price of doing your everyday business.
One app I used this morning to order my coffee explicitly states that it can track my location and use my data for “analytics”. The Government has just handed this app company a database which it could only have dreamed about — who buys what, when and where?
Contact-tracing solutions that could be in use for months are not governed by much in the way of clear standards or oversight, save brief guidelines from Government and specific advice for hospitality businesses from the Privacy Commissioner. The better operators will only keep our data for the allowable two months and act as trustworthy guardians but many will not or cannot.
In 2016, I was part of the Data Futures Working group that conducted workshops on how comfortable New Zealanders were about sharing their data. The bottom line, reflected in the Draft Guidelines for Trusted Data Use (2017), is most wanted to know how sharing their data would benefit them, their community, and wha¯nau, and how their data would be kept secure.
Neither of these questions have been answered by the Government. Exactly how does “outsourcing” the contact tracing to businesses and organisations help us manage the next Covid-19 wave? We are expected to trust this fragmented data collection, with no evidence our trust is well placed.
While Government has shown great concern for issues of data privacy and trust (and rejected mandatory participation) in developing its own app, it has seemingly suspended those concerns when requiring businesses and organisations to act on its behalf in level 2.
New Zealanders must either make their own assessment of each contact tracing system put in front of them to decide whether they trust it, or just hope for the best.
It is not clear whether Government’s digital contact tracing solution will arrive in time to replace the fragmented situation that is emerging. But the loss of trust created by a slow and contradictory approach to digital contact tracing will take some time to rectify.