New Zealanders generally are very protective of their personal privacy. They do not like officialdom to know any more about them than is absolutely necessary and have traditionally been sceptical of attempts by governments trying to gather more personal information. 

Musings by successive governments from time to time since the 1980s about the practicality and inevitability of some form of individualised standard number or national identity card for everyone have been consistently and soundly rejected by public opinion. Yet, at the same time, there has been an almost seamless uptake of an individualised IRD Number; a National Health Number; specific numbers for Ministry of Social Development and Accident Compensation services. Now, through the Smart Start programme introduced a few years ago it is possible to track a person’s full interactions with all range of government services, literally from the cradle to the grave. 

Although our national wariness of a universal individual number to replace each of these specific numbers remains this is not because we are resistant to the potential advantages in terms of service delivery, but more because we are still fundamentally wary of the information being collected being misused by authorities. And, for good reason – there are still too many instances where personal information collected by government agencies for one specific purpose is being shared inappropriately or misused for some other purpose. The recent case involving Accident Compensation staff is the latest example. 

An important principle underpinning our privacy law has been that information collected by the state can only be used for the purposes for which it was collected, no matter its potential relevance to other agencies. Over the years, successive Privacy Commissioners have been extremely vigilant in defence of this principle, even when governments have attempted to push out the boundaries for well-intentioned reasons. While this has caused annoyance and frustration from time to time and occasional dark mutterings about the need to curb the Privacy Commissioner’s enthusiasm, the principle is a sound one, which has so far stood the test of time. 

It may be about to be tested in a way and on a scale not envisioned at the time when the original Privacy Act was being developed in the early 1990s, through the government’s just introduced vaccine pass. 

The introduction of a vaccine pass has been an inevitability for some time, as a precondition for New Zealand being able to resume a measure of normality as it adjusts to living with Covid19, and for New Zealanders to be able to travel once more. Most other countries have been moving in a similar direction for some time now, meaning New Zealand would have truly become the hermit kingdom had it not done likewise. 

But while inevitable and necessary – at least in the short term while the virus remains rampant – the introduction of the vaccine pass is not without significant issues that need to be carefully considered, to prevent its misuse. 

The Covid19 Minister has described the pass as “official proof of vaccination and a ticket to enjoy the extra freedoms that will come with the COVID-19 Protection Framework”. That is unobjectionable in so far as it goes, but the devil is always in the detail. The more pressing question relates to how the pass will be used, and any threats to personal privacy within that. 

According to the Minister, the pass “will mean people will be able to do the things they love, like going to concerts and music festivals, nights out at bars and restaurants, and going to the gym and sports events”. However, it will not be required for essential services like supermarkets, petrol stations, or pharmacists, although the wider retail sector will have some flexibility about whether to require customers to use the vaccine pass. 

Two main potential problems lie within this approach. The first relates to consistency and enforcement. Given the flexibility implied for the retail sector, it is certain there will be cases of some retailers adopting tougher requirements than others, and much public aggravation as a consequence. Rather than this ambivalent approach to the retail sector, the government would have been better off to either exclude the retail sector altogether or make the presentation of the vaccine pass a mandatory pre-condition of entry to all stores. As there are currently some retailers, including some of the so-called essential services, that are acting as though we are still in Alert Level 4 and imposing tougher restrictions than they need to, there is a real risk of the requirements around the vaccine pass being extremely variable and inconsistent, if left to individual retailers to decide for themselves. That is a recipe for public confusion and frustration, which the government would be unwise to ignore. 

This raises the issue of enforcement. If individual retailers are to be effectively left to make up their own rules about use of the vaccine pass, where does responsibility for enforcement lie? It is not reasonable to ask the Police to be involved, despite what the government says. That leaves enforcement potentially in the hands of individual retailers and their security guards, which is a further recipe for inconsistency and abuse. In other contexts, the government has consistently said it does not believe in leaving the administration of the law in private hands, so it needs to seriously rethink its approach to the retail sector before going too much further. 

The second major potential problem relates to the way in which the information in the vaccine pass will be used. Ideally, the pass is equivalent to a driver’s licence which is a permit to drive a motor vehicle. Likewise, the vaccine pass is a permit to undertake certain activities or enter certain premises. Its scope needs to be restricted to that function. It should not be used for building up client and customer databases about who has and who has not been vaccinated, for example. The role of the pass must be kept purely functional, a ticket to freedom to paraphrase the Minister, and nothing more than that. 

Any future attempt to adapt the vaccine pass to contain wider information about the holder’s other vaccination or general health status that might be of interest to a service provider must also be resisted as totally inappropriate and beyond the comparatively limited scope of the vaccine pass. There is always a tendency to extend the scope and prolong the life of interventions like the vaccine pass long after they have become unnecessary. In that regard, it is good that the pass will have to be renewed every six months and the hope has to be that it can be phased out for domestic use before too long, although obviously it is likely to be a long-term requirement for international travel as that resumes. 

The vaccine pass is an important part of life returning to a degree of normality, a necessary evil if you like. The rules around its use therefore need to be simple, but circumscribed. That we are prepared to accept it at all shows how far New Zealanders’ attitudes have shifted during the pandemic. But it would be unwise for the government to assume that means our traditional determination to protect our personal privacy has softened and no longer matters.