Vaccination certificates can be a useful tool to stop the spread of Covid-19, although they’re not a magic shield: they reduce risk rather than eliminate it.
But they are also government-issued identity cards that, if we’re not careful, could enable the government to track our movements and who we meet with. That means we need to think through the details and implications carefully.
After 19 months of the strain and anxiety caused by the pandemic, it’s easy to accept things that we hope will speed our return to normality. It’s hard to find the energy to conduct thought experiments, but bear with me.
Imagine it’s five years ago. You leave the house to go to work. When your bus arrives, you don’t just swipe your payment card, but have to show the driver a government identity card they scan to check it’s really you. When you arrive in town, you want a coffee and have to show your ID card again. The same again, to enter your office. And again if you visit a cinema or restaurant after work. And on the bus home.
* Covid-19: What we know (and don’t know) about vaccine certificates
* Covid-19: Hard to make vaccine certificates completely ‘fraud-proof’, but extra ID checks will help
* In trying to get out of a Covid-19 emergency, are we now triggering a privacy crisis?
Each time your ID is scanned, it not only tells the business who you are, it tells the Government exactly where and when your ID was scanned. Everyone’s ID is scanned so it knows who was there with you. Your ID card isn’t like a driver’s licence, which proves you have passed a test and have the right to get behind the wheel of a car. Your ID card is your licence to work, to exist in society.
Now imagine the uproar there was when the Government-imposed this ID card with no public consultation. No information provided to us about what it would do with this data on our movements. No information about which government agencies it would share this data with. Or how long it would retain this data. Or how it might analyse this data to draw inferences about what you’re interested in.
Details of the database this information is saved in isn’t published for independent scrutiny. The advice from the Privacy Commissioner is kept secret. The Privacy Impact Assessment isn’t published.
The Government also keeps secret the expert advice on whether ID cards are consistent with the non-discrimination obligations under the Human Rights Act, and whether it is a reasonable limitation against our rights to freedom of movement and association.
Sadly, we don’t have to use our imaginations any more, because this is actually what’s happening in Aotearoa New Zealand today. You haven’t previously had to identify yourself to a café owner to buy a coffee, but now you will, as the Prime Minister has said that businesses scanning vaccination certificates will also be told your name.
Far more troubling is what the Minister for Open Government – also the Covid-19 Minister – isn’t telling us: what data it will capture each time our certificate is scanned. Supermarkets, doctors and pharmacies are excluded, but it hasn’t ruled out having certificates scanned to catch a bus or train, and the logic of requiring them when people are close to each other suggests doing this.
You might be in favour of that, but do you want that information retained by the state? None of the advice or assessments described above have been published by the government. The Government has provided no criteria for when we’ll stop having to carry them. The New Zealand Council for Civil Liberties has written to the Prime Minister seeking answers but has not received a reply.
In a democracy, you might hope the Opposition would be asking questions about this in Parliament. You might hope that at daily press conferences, reporters – the eyes and ears of the public – would be pressing ministers for details of this tool that could so easily be misused.
This hasn’t happened. Justified anxiety about Covid is leading to complacency about the kind of society we’re creating.
The Government will say that some information will be published when a bill is introduced to Parliament. That we can make submissions to a select committee that will have 48 hours to consider the matter.
But if you think this sounds like a done deal, your hearing is working just fine. Cabinet has decided; the Government has a solid majority.
Vaccination certificates can be useful. But we agree with the Privacy Foundation that they should be done in a way that reduces to an absolute minimum the data collected, and not exceed what’s needed to achieve the Government’s lawful purpose.
If the purpose is only to verify the authenticity of a certificate, only the fact that a certificate was verified (or not) should be collected. Not a place or time. Retaining more data would indicate the Government has other purposes for this ID card.
You can be in favour of introducing certificates that will exclude those who can’t get vaccinated. You can even be in favour of government ID cards, although many would argue that a key aspect of individual liberty is protecting your privacy from the state.
But in a democracy, the government needs people to trust the system they’re being forced to use. Earning that trust means minimising data collection, maximising privacy, and being open about what exactly they’re doing and why.
Andrew Ecclestone is deputy chair of the New Zealand Council for Civil Liberties.