In the past two weeks, Aotearoa has experienced its first ‘resurgence’ of COVID-19 in the community, following a 102-day period without community transmission.

Whether or not this latest outbreak was inevitable and/or whether future outbreaks are also likely to ‘pop up’ from time-to-time as the world continues its battle to contain COVID-19 can remain the subject of debate for another day.

One thing that is clear though is that a swift and effective public health response to such outbreaks requires an efficient contact-tracing regime, through which the ‘perimeter’ of the outbreak can be identified with accuracy and confidence, obviating the need for a more widespread and draconian lockdown.

In order to work effectively, a contact-tracing solution needs to be employed by a significant proportion of the general population, and needs to be in use before the outbreak hits. Encouragingly, the use of the official New Zealand COVID Tracer app has picked up exponentially since the beginning of ‘Lockdown 2.0’, and looks set to become part of the new normal of life in the post-COVID world.

However, there are other solutions available that may also become a part of everyday New Zealand life, including the use of a Bluetooth-enabled credit-card sized ‘COVIDCard’, which is the subject of trials as to its effectiveness – and helps plug the ‘gap’ in respect of the not insignificant number of those who don’t have access to an up-to-date smartphone and therefore cannot make use of the official COVID Tracer app.

Whatever the technological solution that is deployed, finding a solution that actually works must be a priority. New Zealand’s economy – and society generally – clearly benefits from the lifting of social and economic restrictions that the status of elimination affords us.

How will a contact-tracing system ‘work’? In short, uptake is the key. The more people who use the solution regularly, the easier it will be for the Ministry of Health’s contact-tracing team to do its job: trace quickly and accurately the potential spread of the virus, so that those at risk of infection can be managed appropriately.

And how do you encourage uptake? Trust.

As the Privacy Commissioner has been keen to point out, any contact tracing technology involves significant privacy implications for the individual. The movements and interactions of each individual who uses the COVID Tracer app or a COVIDCard will be collected by the government to an extent that has never been seen before.

While few people hold the view that the solutions proposed will – in practice – intrude into our personal lives to such an extent that the sounds of George Orwell spinning in his grave will be heard from Timaru and Tokoroa, it will only take one misuse of the information collected to undermine the trust necessary to ensure that the solutions are a success. Any impediment to uptake must be itself ‘eliminated’ such that the greatest number of people are using the solution, without reservation, as is possible.

So perhaps ironically, we need a contact-tracing solution that ‘leaves no trace’ – that is, at least until we need one. If we ‘take only photos’ (of QR codes) and ‘leave only footprints’ (digital ones available only to those who ‘need to know’), the trace that we do leave will do just enough for the contact-tracers to do their jobs, and no more.

This is where privacy law has an important role to play. Contrary to some commentary regarding the ideal response (which suggest throwing privacy law out the window), a solution designed with the principles of privacy law in mind is an enabler when it comes to contact-tracing, rather than a barrier. This is because a solution designed with privacy as its backbone will meet public expectations in terms of the key questions of what, how, and why personal information is being collected and used to achieve the objectives of contact-tracing, thereby engendering the trust in the solution that is critical for its uptake.

The solution:

should only collect so much personal information as it needs to in order to fulfil its purpose
should collect personal information in a way that is fair and does not unreasonably intrude on an individual’s personal affairs
must protect the information with security safeguards that are reasonable in the circumstances
must only keep the information for so long as is necessary
must only use the information for the purposes for which it is collected
relies on transparency, in that it must be clear to individuals exactly how their information will be used.

All of the above principles are consistent with the existing information privacy principles set out in the Privacy Act 1993 (soon to be replaced by the Privacy Act 2020 – see here for more details). And all of them are crucial to delivering a solution that the ‘team of 5 million’ is able to trust and rely on – thereby leading to the uptake that will make the solution effective, reliable and comprehensive.

Throwing privacy law ‘out the window’ is counterproductive in this regard: if we cannot be certain that our personal information will be treated with the respect it deserves, and only used by the government in the very limited – but necessary – circumstances of contact-tracing, it will be hard for even the persuasive Dr Bloomfield to convince us to engage with the solution.

There will of course be some who remain steadfastly of the view that the solutions offered are ‘not for them’. And it’s difficult to envisage a solution which completely mitigates the risk of human fallibility – if you are the type who forgets your wallet as you’re walking out the door, chances are you might forget to take your COVIDCard with you. It is also important to remember that technology – any technology – can only ever be part of the solution. The art of contact tracing with a virus as tricky as COVID is as much Sherlock Holmes as it is CSI.

However, building a solution with privacy in mind will help eliminate one more barrier to the critical mass of uptake of the technology necessary to inform the social science that is contact tracing, in the least intrusive way possible.

If you have any questions around privacy, including compliance with The Privacy Act 2020, please contact Hayden Wilson, Hayley Miller or Campbell Featherstone.