The Government is actively considering making it mandatory to scan in with NZ COVID-Tracer app at ‘high-risk’ events and venues where crowds gather and the virus could seize the moment.

Can they do that? Wouldn't that be some kind of breach of our rights?

The short answers are:

Yes, they can, and No, not if there are appropriate safeguards.

The fuller answers are:

1. Can they do that?

Last year’s COVID-19 Public Health Response Act creates a power to put New Zealand, or parts of it, into ‘alert levels’, and prescribe rules for those levels.

This has already been used to make it mandatory for businesses to display QR codes, thereby improving the prospects of contact-tracing and tracking the virus.

That same power provides the necessary legal framework to make scanning mandatory.

2. Wouldn't that be some kind of breach of our rights?

The mandatory scanning is unlikely to be considered an unjustified limitation of our rights and freedoms. The High Court judgment in Borrowdale v the Director General of Health makes it clear that proportionate measures to stop the spread of a pandemic can be justified.

However, those limitations would only be warranted for the purpose of arresting the spread of COVID-19. The Government remains bound by the Privacy Act 2020 when it collects data through the COVID Tracer app. It must only collect, store, access, and share the data it collects in the ways appropriate under that Act.

If, for example, the right to access this data were used for purposes beyond contact tracing - even though the agency collecting the data may, in certain circumstances, share that data with another agency - that would likely be a bridge too far. The mandatory scanning could then be said to have been an unjustified limitation on a person’s rights.

This is not quite as much comfort as it could be, however. The law in its present form does not look entirely watertight.

While the current COVID-19 Alert Level Requirements Orders specifies that the purpose of QR codes is for contact tracing, neither the Order nor the Act specifically state that the NZ COVID-tracer app data the Government collects can only be used for contact tracing.

It’s conceivable that another agency could request the Ministry of Health to give it the data, and use it for purposes other than contact tracing. In Western Australia, WA Police forced the Department of Health to surrender data it collected from the app which the Police believed would help its investigation. The WA Government requested the WA Police to stop using and accessing data in this way. WA Police refused.

This led the WA Government to urgently pass legislation clearly stating the data could be accessed solely for the purpose of contact tracing, but too late to avert an erosion in trust of its COVID-19 response.

The possibility of misuse is very real when the legislative instrument which authorises its collection is not watertight.

Even though, reading the COVID-19 Public Health Response Act and Order together, the intent is clear that the data is to be used for one sole purpose, there is enough interpretive room for that to be misconstrued by a well-meaning Crown agency such as, say the Police.

The upshot: The appropriate safeguards could use some tightening

Although the Government enjoys a social licence to implement measures which, on the face of it, put many limitations on New Zealanders’ usual freedoms, it would be prudent to tread carefully when it comes to personal data collection.

The legal framework protecting us from the pandemic is fundamentally sound, but it does require some tuning.

An executive order that leaves open a door for a purpose other than contact tracing, also leaves open a door to risk:

• a decreased degree of trust in its COVID-19 response and lose its social licence to:
  • enforce its current measures; and
  • implement any further restrictive measures; and
• a judicial review of the empowering order which may lead a court to find that the Government exceeded its authority.

The Government would likely prefer not to find itself caught with an egg on its face thanks to well meaning, but rushed, legislative instruments that do not adequately protect the data of those mandated to scan QR codes from abuse by other Crown agencies.

Given the hard lessons learnt by WA, the Government might also turn its mind to retrospectively restricting the use of past NZ COVID-Tracer app data for only the purpose of contact tracing.

Retrospective legislation is always taken up with hesitation but protecting New Zealanders from potential Government agency overreach would be a justifiable departure.

We can take comfort in both the fact that:

• any data the Government requires us to give to enter a high-risk venue is unlikely to be used for a reason other than contact tracing; and
• if the data is used for a purpose other than contact tracing there is likely legal recourse available to us.

If you would like any advice on COVID-19 law and how it applies to you or your business please get in touch with Hayden Wilson or Linda Clark.