27 May 2020, 09:00

Privacy Commissioner John Edwards is warning the hospitality and retail sectors against using contact tracing apps or web-based solutions that ask for too much personal information, including whether a customer has had Covid-19.

Mr Edwards says his office has today published a stocktake of contact tracing apps that generally do a good job of helping a business meet their obligations under the health regulations.

“The apps we looked at work without being too intrusive or by putting sensitive information at risk. But if a bar or restaurant is asking a customer, as a condition of entry, to declare through a third-party app or website what, if any, medical conditions or symptoms they have, or any exposure to Covid-19, they could be at risk of breaching patrons’ privacy.

“It’s hard to see why a café or restaurant would need to use a service that scans and retains a copy of an identity document or keeps a record of a vehicle registration or clinical information.

“Business shouldn’t be collecting information about Covid-19 symptoms, as you need clinical expertise to be able to do anything useful with that information.”

Mr Edwards says complaints to his office could lead to liability for the business, which could be passed on to the technology platform provider. “As our stocktake of contact tracing apps shows, there’s no need to take that risk when there are privacy safe options available.”

Advice on how much information a business can ask for its contact tracing register can be found here.

For more information, contact Charles Mabbett - 021 509 735.