The government’s contact tracing app, or “digital diary” according to the Prime Minister, has gone live.
It seems that once the app is downloaded users are required to scan QR codes to log the places they have visited, rather than using Bluetooth pings to locate other nearby users. Each business in the country, including restaurants and bars, will have their own unique QR code, issued by MBIE. Reports indicate that the Privacy Commissioner has been consulted.
What is unclear is whether the app will operate on a decentralised or centralised model. According to a report on 7 Sharp last night the data will be held exclusively on the user’s phone i.e. a decentralised model, similar to what I have been advocating for. However, this morning the Director General of Health, Dr Ashley Bloomfield said on TVNZ Morning that the user’s contact details would be retained by the Ministry of Health, but other data would stay on the phone, so essentially a hybrid solution.
I haven’t downloaded the app yet, but I understand that entry of an email address is mandatory and users are encouraged to also provide their name and phone number.
Marc Daalder of Newsroom reported yesterday that location information – recorded through QR code scans – will be stored only on the user’s device and deleted 31 days after first being collected. Further, he indicated that other information will be stored by the Ministry of Health for “the duration of the New Zealand government’s Covid-19 pandemic response, then it will be deleted”. How long might that be?
The message from Radio New Zealand is slightly different. They say that the QR codes will be used, “in the event they need to reached for coronavirus contact tracing” and that “the information will be stored for 31 days by the Ministry of Health, which uses Amazon Web Services in Sydney to store the data, before being automatically deleted.” What they do not say is whether the user has full control over the release of information on their phone? I trust that is the case. Further, they do not indicate exactly what data will be stored by the Ministry of Health.
Downloading of the app is voluntary. In order to be successful, the public need to feel secure that their private information is safe and can’t be misused. Uptake of the Singaporean app has been disappointingly low. Likewise, with the Australian app, while uptake has been slightly better, the app has been plagued with technical and other issues. Both these apps employ the centralised model which New Zealand seems to have avoided.
I’m all for having a good contact tracing app in New Zealand but we still need more clarity around just how this app works and the public need to be assured that individuals’ privacy is not at risk.
