Media release: Government secrecy on vaccination certificates is dangerous

The New Zealand Council for Civil Liberties has today written to the Prime Minister expressing its deep concern about the secrecy surrounding the introduction of Covid-19 vaccination certificates. The Council has called for immediate publication of the information provided by the government to the events and hospitality sector, and the advice it has received from the Privacy Commissioner and officials who have looked at the human rights issues involved.¹

At the press conference on 5 October 2021, the Prime Minister announced that Cabinet had decided to introduce vaccination certificates. The Prime Minister said that the government was ‘consulting on this framework now’, and that the consultation included requiring certificates to be shown before entering a hospitality venue. Prime Minister Ardern further suggested the consultation also included religious organisations regarding access to church services.²

No consultation documents have been published on the websites of the Ministry of Health, Department of Prime Minister and Cabinet (DPMC) or on Covid19.govt.nz.

Thomas Beagle, Chairperson of the NZ Council for Civil Liberties, says “It is unacceptable that the government is not consulting the public and working with Māori, when we will be required to carry and provide this vaccination certificate, which is effectively also an identity card. The ability in due course to make a submission to a select committee when all the policy decisions and legal framework have already been decided by Cabinet is quite insufficient for an issue of this magnitude.”

Mr Beagle continues, “The government has boasted of its ‘high trust model’ in responding to the pandemic so far. But the decision to require people to show a vaccination certificate to enter businesses, or attend an event, is a major shift away from this. The significant ramifications of the move make it even more important that the government publishes all relevant information immediately. Government secrecy is dangerously destructive to public trust in government, at a time when it is needed more than ever.”

An OIA request to the Privacy Commissioner for the advice he provided to the government on this issue was refused by him.³ The Ministry of Health and DPMC have provided little information five months after other OIA requests to them about this issue.⁴ NZCCL calls on the government to immediately publish this advice for public scrutiny and input before the scheme is finalised by Cabinet.

The government is clearly aware of the human rights implications of introducing vaccination certificates, since the Prime Minister said they would not be required to access supermarkets, health centres or pharmacies. But we do not know if they will be required for public transport, or for access to places like Work and Income offices.

Questions the media and MPs should ask:

1. Why is the government not consulting the public on vaccination certificates? Are we less important than the businesses and religious groups who are being consulted?
2. How is the government upholding Te Tiriti by working with Māori to ensure this supports their work to keep their communities safe, and isn’t seen as another tool by a surveillance state?
3. Why has the government not published the advice from the Privacy Commissioner, officials working on the Human Rights Act and NZ Bill of Rights Act implications, and the papers considered by Cabinet?
4. Will there be any limits on who can download and use the app for scanning vaccination certificates? If so, what limits?
5. What data will be collected by the app that scans the certificates? How much of this data will be retained on the app, or will it all be deleted once a certificate has been verified as genuine?
6. What data will be logged by the government when a vaccination certificate is scanned by a venue? Will this include location, date and time of the scan? If yes to any of this, for how long will this information be retained?
7. Will any of the data logged by the government when a certificate is scanned be shared with any other government agency? Will the government legislate to prevent this data from being shared or accessed by any other agency?
8. Will the data retained by the government be shared in aggregate form?
9. Will the data retained by the government be shared in so-called ‘anonymous’ form?
10. Will the government legislate to protect people’s rights by prohibiting supermarkets, dairies, health centres, pharmacies, and other essential public services such as transport and Work and Income offices from requiring people to show a vaccination certificate?
11. Will the government put a sunset clause in the legislation to shut down the domestic vaccination certificate system?

The system announced by the Prime Minister will provide the identity of the person visiting a place to the person who scans the vaccination certificate with a government smartphone app. But the government has not said whether that information can be retained by the person who scans it. Nor has it said whether the government’s system will log the identity of the person who has their certificate scanned, or when and where the certificate has been scanned.

Thomas Beagle, Chairperson of the NZ Council for Civil Liberties, says “The government has refused to legislate to prevent the Police and other government agencies from accessing contact tracing information. Data gathered from places scanning people’s vaccination certificates would be even more tempting to law enforcement organisations, particularly if it was in real time.”

The New Zealand Council for Civil Liberties supports people getting vaccinated against the SARS-CoV-2 virus if at all possible and if they do not have a medical condition which indicates this would be dangerous for them. While we have strong reservations about vaccination certificates being required for access to events, cafes, restaurants and workplaces, we understand the public health arguments for them. Even here however, the argument is not water-tight, since the research shows that double-vaccinated people are able to asymptomatically pass on the virus: people in a venue who have had to prove their vaccination status may have a lower risk of exposure, but it is not a zero risk.^{5, 6} The government could be creating a scheme that provides a false sense of security.

The NZCCL is deeply concerned about the significant risks that a system like this could pose to people’s privacy, and freedoms of association and movement. The vaccination certificate will be linked to a person’s immunisation record, which contains not just their NHI number, but also their address and contact details.⁷ The government’s intention is that in future the same system will also record all other vaccinations a person has received. The potential for such a system to be transformed into the basis for a national identity card backed with biometric data is clear, and the Council is concerned about a casual drift towards constructing such a system.

Successive governments in New Zealand have taken steps to make the sharing of personal information between government agencies easier. The immunisation register behind the vaccination certificate will also be the database on which ‘vaccine passports’ for international travel will draw upon. As a member of the Five Eyes intelligence sharing network (with Australia, the USA, Canada and the UK), there is clear potential for increasing amounts of medical information to be shared not just domestically, but also internationally.

Thomas Beagle says that, “In a time when the government is moving to provide more and more services online and allow private companies to ‘verify’ our identity to the state, it needs public trust more than ever. The secrecy surrounding vaccination certificates has to stop immediately, and the public must be consulted on the proposals”.

________________________

Contact

Thomas Beagle

Chairperson

NZ Council for Civil Liberties

+64-21-805040

thomas@nzccl.org.nz

References

1. NZCCL’s letter is available on its website at: https://nzccl.org.nz/letter-to-pm-and-minister-re-vaccination-certificates/
2. PM and Dr McElnay Press Conference, 5 October 2021 http://www.beehive.govt.nz/sites/default/files/2021-10/Press%20Conference%205%20October%202021.pdf 
3. Privacy Commissioner OIA refusal, 24 September 2021 https://nzccl.org.nz/wp-content/uploads/2021-09-24-OIA-Response-from-OPC.pdf
4. OIA responses from Ministry of Health (https://fyi.org.nz/request/15419-public-interest-considerations-re-oia-refusal-of-info-re-vaccine-certification#incoming-62843) and DPMC (https://fyi.org.nz/request/15162-certification-of-covid-status#incoming-62135) 
5. Covid-19: Fully vaccinated people can carry as much delta virus as unvaccinated people, data indicate. British Medical Journal, 19 August 2021 https://www.bmj.com/content/374/bmj.n2074
6. New Data on COVID-19 Transmission by Vaccinated Individuals, Bloomberg School of Public Health, Johns Hopkins University, 2 August 2021  https://publichealth.jhu.edu/2021/new-data-on-covid-19-transmission-by-vaccinated-individuals  

COVID Immunisation Register (CIR) privacy statement, Ministry of Health, 16 September 2021 https://www.health.govt.nz/our-work/diseases-and-conditions/covid-19-novel-coronavirus/covid-19-vaccines/covid-19-vaccine-and-your-privacy/covid-immunisation-register-cir-privacy-statement