Introduction

The NZ Council for Civil Liberties is in favour of people getting vaccinated against Covid 19. It’s clear from data on hospitalisation rates that doing so either prevents people from becoming infected, or reduces the severity of the infection. In the current febrile political atmosphere, where questioning the government’s approach is seen by some as an attempt to undermine it, it’s important to get that statement on the record up front: unless you’re genuinely one of the very small number of people who can’t get vaccinated for medical reasons, you owe it to yourself and the rest of us to get vaccinated against this deadly disease. Getting vaccinated will also help protect the largest segment of the population that is unable to be vaccinated at this time: young children.

But from a civil liberties perspective, there’s a big difference between encouraging people to get vaccinated, and the state mandating that people have to do so in order to keep their jobs. There’s also a significant difference between asking people to keep a diary of where they’ve been in order to assist contact tracing, and mandating that you show proof of vaccination (and identity) to enter shops, cafes and gyms. The introduction of such measures are political choices that clearly have an effect on our rights and freedoms. These political choices are, in this country, made in the context of legal frameworks designed to protect our rights and freedoms. These can be interpreted according to the circumstances we are facing, but they were, in turn, built upon certain ethical foundations. 

In this article we first talk about some of the ethical frameworks that can be used to analyse the choices that need to be made. Then we look at the human rights issues – how the requirements will interact with the Bill of Rights Act and the Human Rights Act, as well as the privacy issues.

Ethical frameworks

Associate Professor Angela Ballantyne, of Otago University and the government’s Covid-19 Immunisation Implementation Advisory Group, was interviewed on TVNZ’s Q&A programme last weekend, and presented with great clarity three different ways the government might be approaching these ethical and political choices.

Utilitarian

There’s a utilitarian approach: the ends justify the means. In that case, we need to be really clear what the end is, the goal the government is working towards. But we don’t know what that is. We don’t know if the end goal is elimination of Covid-19 in Aotearoa New Zealand. And if it’s not elimination, that suggests government acceptance of the disease becoming endemic. But decisions around endemic diseases mean political choices about what is the acceptable rate of people dying from it and what the government is prepared to do to achieve that ‘acceptable rate’. The government hasn’t been up front about this, and this is unacceptable and patronising.

From a utilitarian perspective, unless we know what the goal is, there’s nothing to judge whether the means of achieving it are legally and ethically proportionate, or politically acceptable. Until the change of policy following the August outbreak, the goal was elimination, and the means of achieving it were laid out in guidance on activities and movement at different alert levels. The government was willing to pour money into keeping businesses afloat and people employed. It put effort into housing people.

Since the shift from elimination, we don’t know what the end goal is: the government has not been open with us. But it is introducing measures that are arguably greater infringements on our rights than the restrictions on movements when elimination was the goal. Are these more proportionate than other combinations of carrot and stick? If the goal is public health and safety, why hasn’t the government announced a programme of mass public investment to increase the rate of airflow inside schools, offices, shops, cafes, etc? The evidence suggests this is likely to be effective at reducing transmission rates, but instead the government has opted for limitations on our ability to participate in society.

The freedom to go and buy some clothes, or get a scone in a café, will become a privilege open to those who have been vaccinated, not a right we all enjoy. You can agree these means may justify an end, but what is the desired ‘end’? Compare this to climate change, where we know what the goal is – keeping global average temperature increases to no more than 1.5ºC – and we can have a debate about what are the best means for achieving this. ‘Best’, of course implies choices about who bears the costs, and what is proportionate and ethical as well as effective. I might prefer everyone becoming vegetarian, but you might think that is a disproportionate infringement on your liberties and will impose disproportionate burdens on farmers; some people might advocate population control whereas others would say that’s likely to be racist in practice and redistribution of wealth would work better.

Public health – least infringement

The second perspective put forward by Dr Ballantyne is that of public health ethics: the idea of least infringement needed. The government can restrict people’s individual liberties by saying they can’t access certain places, but that needs to be justified by the extent to which the benefits not only outweigh the risks, but that they’re the least restrictive measure possible to achieve your goal. For example, it may be that wearing a mask is more effective than showing a vaccination certificate to see a film at a cinema.

But this means we need an open discussion, based on the available evidence, on what is the most effective way of reducing transmission of the virus, so that we know what are the most proportionate, least infringing steps to be taken. Protecting the collective health of the public is key, but that comes not just from deciding what the proportionate trade-offs are at the level of individual liberty or compulsion, but also what the alternative macro-level policy options are open to the government. Should we keep the borders closed? Should we spend more or less on a programme of retrofitting ventilation? Require masks or vaccination certificates?

The government seems to have decided to keep the Covid Tracer app separate from the vaccination certificate app. This is important, because it means that the Google/Apple bluetooth exposure notification tool will be kept, which can assist with contact tracing. But it does mean that for every place people visit, they should expect to scan the venue’s QR code to create an entry in their contact tracing diary, and then open a separate app to display their vaccination certificate for checking by the venue operator. It will be interesting to see whether this remains the case, or if public dissatisfaction leads to the two tools being merged to reduce the friction people will experience entering premises. If that does happen, the exposure notification tool will have to be removed, since Google and Apple require that this tool is not linked to people’s identities. This would have an impact on contact tracing and the ability to track down and break chains of transmission through isolating infected people.

Moral rights

The third framework is one of moral rights: if you’ve made a wrong choice you no longer have the liberty to enjoy certain privileges you may have come to take for granted. This effectively underpins our criminal justice system: do something that Parliament has decided is unacceptable and you will face consequences, possibly including the loss of your freedom of movement. The Prime Minister has come close to suggesting this when she said, “If you’ve done the right thing to keep yourself and others safe, to look after one another, you should feel safe, you should be protected from those who haven’t made that choice.”

As Dr Ballantyne pointed out though, it’s a really big step to say that because someone has chosen not to take a voluntary health measure, that they are no longer able to participate in some aspects of our society. It is a significant shift to say that going to the pub is now a privilege that the government allocates as opposed to an entitlement that we have as part of our civil liberties. Reducing the issue to individual moral responsibility also overlooks the situation for people who are unable to make the ‘right choice’, like those people without transport who cannot get to a vaccination centre, or who can’t get time off from work or childcare responsibilities to get there.

Human rights framework

We should be clear that being vaccinated is a voluntary health measure and that vaccine mandates infringe on this. Section 11 of the New Zealand Bill of Rights Act says, unequivocally, that “Everyone has the right to refuse to undergo any medical treatment.” Section 19 of the same Act says that “Everyone has the right to freedom from discrimination on the grounds of discrimination in the Human Rights Act 1993.” The prohibited grounds of discrimination set out in section 21 of the Human Rights Act include a person’s health status.

That makes it sound simple, cut and dried: you can’t be made to be vaccinated, and the state can’t stop you entering a Work and Income office, or a school, university or cinema, whether on the basis that you haven’t been vaccinated or that you have been infected with the SARS-Cov-2 virus. Similarly, the Bill of Rights Act sets out our rights to peaceful assembly (section 16), our right to meet whomever we want (section 17), and our right to move freely around the country (section 18).

But the Bill of Rights Act recognises that the rights set out in the law, and the society we want to live in, won’t always be possible to achieve if we allow one right to be upheld at the expense of another right.

Demonstrably justified in a free and democratic society

Section 5 of the NZ Bill of Rights Act sets out that dealing with these sometimes-conflicting rights can be done by Parliament limiting the rights and freedoms set out in the Act. But when it does so, the limits must be “reasonable”, “prescribed by law” and only go as far “as can be demonstrably justified in a free and democratic society”. Section 7 of the Act recognises that in a democracy it is critical that we understand the government’s reasoning for any legislation that would introduce limits on our rights. It requires that when any legislation containing provisions inconsistent with any of the rights and freedoms in the Bill of Rights is introduced, the Attorney-General has to provide Parliament with a report on these provisions. The Attorney-General also provides reports on legislation where they decide the proposals are consistent with the Bill of Rights Act. For example, the reports on how the government’s legislation so far to help it deal with Covid-19 can be found on the Ministry of Justice website.

When we consider vaccination mandates and vaccination certificates as the government’s preferred tools for responding to the transmission of a deadly virus, we have to consider their impacts and ask if they are “reasonable” and if they would limit our rights only as far “as can be demonstrably justified in a free and democratic society”?

The method for determining whether an infringement of our rights is a justified limitation involves asking a series of questions:

1. Does the limitation serve an important public purpose?
2. Is the limitation rationally connected to that purpose?
3. Is the limitation proportional to that purpose? (Does it impair the right by no more than is reasonably necessary, and do the benefits outweigh the limitation of the right?)

As emphasised by the different ethical frameworks explained by Dr Ballantyne, we can again see why it is so important for the government to be open about its goals with respect to the virus, as these are strongly connected to the ‘purpose’ of the limitations on our rights. The task of answering these questions is most closely linked to the second ethical framework described above.

While we may not know whether the government’s goal is elimination, or merely an ‘acceptable’ number of deaths as the disease becomes endemic, the public purpose driving the introduction of mandates and certificates is to prevent or limit the spread of the virus that causes Covid-19.

It probably helps after this point to split out the answers to these three questions for the two different proposals: vaccination mandates and certificates.

Vaccination mandates and limitations on rights

In relation to vaccination mandates, the right the government is talking about limiting is the section 11 right to refuse medical treatment. The government is basically saying ‘we’re not making vaccination mandatory, but we are removing your protection from the consequences of choosing not to get vaccinated.’ You don’t have to get vaccinated, but if you don’t – and you work in certain kinds of jobs – you won’t be able to argue that you’ve been unfairly dismissed from your job. While technically the government isn’t removing your right to choose whether to get vaccinated, given the major impact losing your job can have on your ability to keep a roof over your head, pay your bills, and feed your family, this is a pretty severe limitation on your freedom of choice around medical treatment. Indirectly, the government’s proposals probably also breach people’s rights to be free from discrimination on health (and possibly religious and other) grounds.

But the answer to the first question is clearly ‘Yes’. The limitations implied by the government’s proposals do serve an important public purpose. The first duty of any government is to keep the public alive and well (which is why the right to life is the first right set out in the Bill of Rights Act). Vaccination does prevent the spread of the virus. Mandating that workers who will be coming into contact with the public – some of whom may not be vaccinated – will help both the worker and the member of the public.

In relation to the second question, vaccination mandates are rationally connected to the purpose of preventing or limiting the spread of the virus. In order to properly understand that, we need greater openness from the government – it needs to publish its modelling data and assumptions.

The third question is the key, and where people may well disagree. Is the proposed limitation on someone’s freedom of choice regarding medical treatment a proportionate response to the purpose of preventing the virus spreading? Whether the limitation is proportionate depends on the severity of the disease, and possibly also on the effectiveness of alternative policy options that would be less likely to limit someone’s rights.

Covid-19 a serious disease

What is proportional for a deadly disease that is highly transmissible may well be disproportionate for a milder illness. Covid-19 is a disease that is clearly on the severe end of the spectrum. At least 5 million people around the world have died from it. As of 28 October 2021, the confirmed Covid-19 deaths in the USA are running at a rate of more than 4 people per million (1,400 people per day). Last January they peaked at more than 10 people per million (3,400 people per day). In the UK the figures were even worse: more than 18 per million (1,240 per day) at the peak in January, and 152 people per day this last week.

So, the argument that limiting freedom of choice regarding getting vaccinated against a disease that is killing people on this scale is, in the view of many people, proportionate. For them, the benefits do outweigh the limitation on people’s freedom to choose which medical treatment to undergo.

But if that is the case, and the criteria is roughly speaking ‘people who come into proximity to the public’ while working, we maybe need to ask why the criteria aren’t ‘people who come into proximity with other people while working’. And if that’s the logic, we’re going to see the vaccination mandates extended to public servants who aren’t in public-facing roles, as well as to MPs, judges, the police, and others.

The High Court has already found that limiting freedom of choice on whether to be vaccinated against SARS-Cov2 is proportionate, at least in relation to a Customs worker at the border.

Are there other options?

But the other question regarding whether a vaccination mandate is a proportionate limitation on a person’s rights, is whether other less restrictive measures to achieve the purpose of preventing or limiting the spread of the virus would be as effective. Other measures might include greater incentives for, and facilitation of, people getting vaccinated voluntarily. There are significant gaps in the provision of vaccination services, as demonstrated by people in Tairāwhiti feeling the need to crowdfund a vaccination van. Other alternative measures could include extending mask wearing mandates, and increasing other measures to protect health and safety in the workplace such as increasing the rate at which the air in a room is replaced with fresh air from outside.

The key question is whether these other measures would be as effective at limiting the spread of the virus as mandating that particular groups of people be vaccinated if they want to retain their jobs? This does not seem likely.

Many people in Aotearoa New Zealand have good reason to be hesitant about being directed to do things by the state when they are told to do things ‘for their own good’. Mana whenua have a long and bitter history of the Crown and its servants acting against their interests, and of being negligent in their duty of care. Successive governments have demonstrated that they have been quite content to sacrifice the health of many people in order to keep government spending at lower levels.

Consequently, while NZCCL has concluded that vaccination mandates serve the important public purpose of limiting the spread of a deadly virus, and – with the caveat that we need more information published on the modelling – are likely to be rationally connected to that purpose. While they are – in the circumstances presented by Covid-19 – one possible response to that purpose, they also represent a significant failure by the state in its duty of care to us all, and in particular a failure of the kāwanatanga in relation to te Tiriti o Waitangi.

Vaccination certificates and our rights

The government has so far kept secret the details of its proposals for vaccination certificates to be used within Aotearoa New Zealand. More information is available about ‘vaccine passports’ for international travel, but NZCCL is more concerned at this time with the certificates the government wants people within the country to carry and present in order to enter specified places or attend certain types of event.

The rights that will be directly affected are our right to freedom of association (section 17 of the Bill of Rights Act), possibly our freedom of peaceful assembly (section 16), and our freedom of movement (section 18) – particularly if certificates are required to use public transport and taxis. Indirectly, certificates could breach our right to be free from discrimination (on grounds of both health and political opinion). Axiomatically, a vaccination certificate is an instrument of discrimination, but all identity cards – and we should be clear that vaccination certificates are a form of identity card – come with the risk of inappropriate other discriminations, such as those relating to race, ethnicity or nationality, and gender.

One of the most significant rights not articulated in the Bill of Rights Act is our right to privacy – or more accurately, our right to control the collection, processing and sharing of data about us. But the vaccination certificate system outlined by the government is a recipe for gathering significant amounts of data on each of us, unless it respects the principle of only collecting the minimum data needed to achieve the lawful purpose.

It is deeply problematic that we still do not know what the government’s purposes for vaccination certificates are. The headline purpose is clear: to assist in limiting the spread of the virus by only permitting vaccinated people to enter certain kinds of places or to attend certain kinds of events. But we don’t know if the government has other purposes in mind, which it will cite as providing a reason for collecting, retaining and possibly sharing a greater range of data.

Information provided by the Ministry of Health to the Dominion Post suggests that validation of a vaccination certificate will be limited to checking that the information embedded in a QR code is authentic. It also suggests that the QR code is only a pass saying the holder has had the requisite number of vaccinations, and won’t include the personal information stored in the National Immunisation Register. That’s a good thing from a privacy perspective. However the passes (and paper certificates for those who do not have a smartphone) may be revoked or limited at a later date. This makes more sense when we consider that the number of inoculations people are required to get a certificate (or pass) may increase in the future. 

It is positive that the Ministry told the newspaper that the verifier app will not store data when it scans a person’s certificate. But we don’t know what, if any, data it will pass back to the government’s back-office server, or what that database will store. If a certificate is rejected, will this be noted, so an official can take follow up action against the person presenting a false certificate? One positive thing in the comments from the Ministry of Health to the Dominion Post, is that the government intends to provide “legislative protection to prevent third-party verifier apps from collecting … information” on people’s name, address, date of birth.

We also don’t know whether the government will say it needs to retain the time that a certificate was scanned. Will it also collect the location where a certificate was scanned? We don’t know. A privacy-preserving system will not require a business to enter its NZBN number to activate the app. Nor will it require location services (GPS tracking) to be enabled on the phone in order to make the app work. But if the government’s system does require these bits of information and they are passed back to the government when a certificate is scanned, the government would know where and when you were when your certificate was scanned.

What purposes would justify this increased data collection? Possibly enforcement action against people presenting a false certificate. Possibly population-level health surveillance to track the spread of the virus in the community. Maybe there are other purposes – such a tool could help the police determine whether someone has breached bail conditions or other restrictions on their movements.

Given the significance of the system being constructed by the government, NZCCL is deeply concerned by the government’s secretive approach. It says it has consulted with the events and hospitality sectors, and with religious groups. But there has been no consultation with the public – the people who are going to be required to carry this form of identity card. No privacy impact assessment has been published by the government. Nor has the government disclosed the advice it has received from the Privacy Commissioner. The advice from officials on the implications of vaccination certificates for our rights under the Bill of Rights Act and our freedom from discrimination under the Human Rights Act has likewise not been shared with the public. 

Are vaccination certificates justified?

In light of the absence of information from the government about the purposes for collecting data from vaccination certificates being scanned, it is harder to answer the three questions used to determine whether an infringement of rights is a justified limitation.

In relation to preventing the spread of a deadly virus, the limitation on our rights created by an obligation to present a vaccination certificate is an important public purpose. But if the government outlines broader purposes, in order to justify wider data collection, will these go beyond preventing the spread of the virus?

Is the limitation rationally connected to that purpose? Whether the certificates are rationally connected to that purpose will again depend on the extent to which the government spells out other purposes besides preventing the spread of the virus.

On the limited dimension of seeking to limit unvaccinated people mixing with vaccinated people in enclosed spaces there is a rational connection between the limitation and the purpose stated so far.

The third question is more demanding still. Is the limitation proportional to that purpose? (Does it impair the right by no more than is reasonably necessary, and do the benefits outweigh the limitation of the right?)

Again, much will depend on the range of data collected when a person’s certificate is scanned, and what use it is put to beyond authenticating or rejecting a certificate, and thus someone’s attempt to enter a particular place.

The government has announced that it will not require vaccination certificates to be shown by people wanting to buy groceries from a supermarket or dairies. Nor will it be required to access healthcare or to visit a pharmacy. This shows that they are keenly aware of the fact that the certificates do infringe our liberties. These exclusions are part of its attempt to argue that the limitation on our rights is proportional, and will not affect a person’s right to life, should they choose not to get vaccinated. It is presumably also designed to restrict the extent to which the requirement will breach the right to be free from discrimination.

Right now, NZCCL does not have enough information to form a view on whether the vaccination certificate system to be introduced by the government will be a proportionate limitation on our rights. We don’t know if the system will be solely connected to the purpose of preventing the spread of the virus by limiting access to premises, or whether the government will advance arguments in favour of broader health surveillance purposes. We also don’t know the extent of the expected benefit from this system.

A briefing from the Privacy Foundation goes into greater detail about the ‘privacy by design’ principles that the certificate, verifier app and backend system should adhere to.

In addition, the system will need to provide exemptions and protection from discrimination or denial of access to services and activities for those who are unable to be vaccinated. Will the system also provide the option of people showing proof that they have been tested and received a negative result within the last 72 hours? If so, the certificate system is not just going to link to the national immunisation register, but the separate database that stores test results.

To judge over time whether the limitation has been proportionate or not, we will need to compare the benefits gained against the negative consequences. What will happen if, instead of encouraging people to get vaccinated, it has the effect of making vaccine-hesitant people less likely to get vaccinated? As Dr Ballantyne suggested, if the target is to protect the health system (and its capacity to provide care for other health conditions), we will need to be tracking how many staff are leaving the health system versus getting vaccinated. Good policy-making makes explicit early on what the criteria for success are, and how they will be measured.

When does it end?

Finally, the government has not been clear about what the criteria are for when the certification system will be ended. The legislation may well have a sunset clause in it, but these can be extended or rolled over. Already the sunset clause for the main Covid-19 Public Health Response Act has been extended. This is why we need to be clear about the criteria for shutting the system down. Other countries introduced vaccination certificates much earlier on in their efforts to encourage people to get vaccinated, when their vaccination rates were far lower than what has been achieved here. New Zealand is introducing them at a time when more than 60% of the population is double-vaccinated. Will the system be shut down when we reach 90% double-vaccinated? Will it be extended if the health advice changes and suggests that everyone gets a third vaccination? What will happen if the evidence for efficacy of the vaccines suggests that we will all need booster shots once a year? If the certificate system is retained when the virus is endemic, will the decision to shut down the certificate system be linked to keeping the mortality rate below the ‘acceptable’ level?

As a useful briefing from the Ada Lovelace Institute points out, governments that spend large amounts of money on building IT systems rarely shut them down. The post-9/11 security infrastructure at airports has not been dismantled after 20 years. Effectively, building a system like this runs the risk of creating path dependency: once an infrastructure exists, it will make certain future choices more favourable, and block others. It is already clear from the few documents already disclosed by the Ministry of Health about the related systems for authenticating yourself with the Ministry to generate your vaccination record that it sees these systems, and obviously vaccination certificates, as key stages in building ‘social license’ for online storage and sharing of our medical information. Some people may well welcome this, but the evidence from the UK is that there was significant public and medical professional disquiet at the government’s proposals to shift people’s medical records from systems controlled by their GPs into a centralised government system that it would then permit private companies to access in so-called ‘pseudonymous’ form.

Conclusion

It is very easy after 18 months of a worldwide public health crisis for people to accept measures that will help them ‘return to normal’. But we need to remain vigilant about the kind of society these measures, that may seem attractive or necessary in the short term, lead to in the long term. Frameworks such as the Bill of Rights Act help with this. The re-establishment of an independent Bioethics Council would help not just with the current situation, but many of the challenging issues we face as technology increases the range of what is possible.

But the real protection against abuse comes from governments being more open with the public, respecting our right to information, and trusting us to be able to consider these difficult trade-offs instead of just pushing new laws through Parliament at high speed. Our country’s successful response to Covid-19 so far has built upon foundations of high public trust in the government, and the government trusting the public to do the right thing. Vaccination mandates and certificates are a significant shift away from the government trusting the public. If the government isn’t open with us about its new stick-like carrots and when it will shut them down, it may find that it has lost the high levels of public trust it has previously benefited from. This will damage both our response to the Covid-19 pandemic and our society.