9 Dec 2020, 09:00

Privacy Commissioner John Edwards supports the Bluetooth tracing upgrade to the NZ COVID Tracer app because it protects privacy and will help to keep New Zealanders safe from community outbreaks of Covid-19.

Mr Edwards says New Zealanders can have confidence they will retain control of the information collected on the NZ COVID Tracer app.

The NZ COVID Tracer app uses the Apple and Google Exposure Notification Framework which was developed in accordance with Privacy by Design principles. Apple and Google developed the framework to help governments deal with the Covid-19 pandemic. No personal information is shared with Apple or Google.

The privacy safeguards in the app’s Bluetooth tracing function means a phone keeps a coded record of other phones with the app which come near it, but it does not collect any identifying information. This information remains on a user’s phone for 14 days and is not disclosed to the Ministry of Health unless a user gives their permission.

This update to the app follows an earlier privacy-friendly adjustment – the removal of the requirement for people to register their details when downloading the app onto their phones.

“The privacy protections in the app show the Government is mindful that it has to have the trust and confidence of New Zealanders in the fight against Covid-19. An important part of this bargain is to have strong privacy safeguards in our contact tracing system,” Mr Edwards said.

“Public confidence is paramount to having effective tools for contact tracing. New Zealanders want to help defeat this virus, but they also want to trust that their personal information will not be misused or lost.

“It is not mandatory for New Zealanders to download and use the app, but the more people who choose to opt in, the better is our contact tracing. Getting people to use the Bluetooth tracing function depends on people having trust in the system.”

Bluetooth tracing works by generating randomised ‘keys’ which are exchanged with nearby smartphones. The keys don’t contain any information about the user so no personal or identifying information is exchanged. Bluetooth keys are stored securely on the phone and only the phone knows which keys belong to the user. People who have come into contact with someone who later tests positive can be notified without the infected person, the Ministry of Health or Apple or Google knowing who they are.

For more information:

Charles Mabbett - 021 509 735 / charles.mabbett@privacy.org.nz