Te Tari Taiwhenua
Department of Internal Affairs
Purpose
1.
This paper seeks initial direction on key regulatory and policy settings for a Bluetooth-
enabled contact tracing card if the decision is made by Ministers to implement the card.
Officials from the Department of Internal Affairs and Ministries of Justice and Health are
available to discuss these matters with Ministers, if desired.
Executive summary
2.
Cabinet has appointed a group of Ministers (Minister of Finance, Minister of Health,
Minister of Internal Affairs, Minister for Government Digital Services and Minister of
Justice) to give further consideration to the technology solutions for addressing COVID-19,
including considering the use of a Bluetooth-enabled card [CAB-20-MIN-0216 refers].
3.
The Government Chief Digital Officer (GCDO) and the COVID-19 Response Public Private
Partnership (PPP) team are currently working on a proof of concept for a Bluetooth-
enabled card to support contact tracing. The intention is to report to Cabinet on 15 June
2020 with recommendations on whether to progress with implementation of this
technology solution.
4.
The proof of concept for the Bluetooth-enabled card includes field trials to test the
hardware, the first of which is currently underway in Nelson. Next week officials wil
provide the findings of the first field trial and wil give Minister’s an opportunity to decide
whether to progress with the larger second field trial.
5.
The Bluetooth-enabled card is one of two Bluetooth contact tracing options currently
being assessed. The other is Bluetooth functionality on a smartphone app. A
recommendation on whether to progress this option wil also be presented to Ministers
for consideration on 15 June 2020.
6.
For technology solutions to be effective in the fight against COVID-19 we need a system
that is consistent and integrated, based on clear principles and standards with oversight in
place. The GCDO is currently working with other agencies on a potential framework to
support these goals and wil report back to Cabinet with an approach for consideration
[CAB-20-MIN-0175 refers].
7.
Clear policy and regulatory settings can support public trust and, therefore, uptake of
technology solutions. We recommend that the regulatory and policy framework for a
Bluetooth-enabled contact tracing card be guided by the fol owing core principles:
1.
maintain and grow public trust: Building and maintaining public trust is essential to
uptake of the card. Ensuring strong privacy settings, consistency with Te Tiriti o
Waitangi, public transparency and accountability wil be important for building and
maintaining trust;
2.
as many people as possible can access and use the technology: the technology and
regulatory settings should be designed with the user in mind;
3.
non-punitive: a mandatory approach that imposes penalties is unlikely to be
effective and more likely to damage the significant public health and goodwill built
by government and health practitioners;
4.
augments non-technical measures: technology solutions should be designed and
implemented to augment existing contact tracing processes;
5.
privacy protective: taking a privacy protective approach wil be key to ensuring
people are able to use the card with confidence. Technology must also be secure;
IN-CONFIDENCE
Page 2 of 14
Te Tari Taiwhenua
Department of Internal Affairs
6.
strict limitations on downstream use: Card data should not be shared with law
enforcement. Card and register data should only be used for contact tracing for
COVID-19;
7.
strategy: we recommend that it be clear that the data is only to be used for the
COVID-19 pandemic;
8.
consistent with Te Tiriti o Waitangi: There is a significant Māori interest in using
technology to support contact tracing. The Treaty principles also point to the need
for significant Māori involvement in development, implementation, administration
and oversight of a contact tracing card; and
9.
consistent with fundamental human rights: Rights should be limited only in due
proportion to the objective. A digital y inclusive approach should be considered in
all aspects of the card and associated systems’ design.
8.
We seek your early direction on:
1.
whether locations such as businesses, workplaces, or public transport should be
able to require the card for entry, and limit entry to those who aren’t carrying one;
and
2.
whether the card and other contact tracing technology should be supported by
legislation.
9.
Progress is also being made on the marketing and branding for the card and considering
who may be best-placed to deliver the card.
10. Depending on the direction provided by Ministers from this briefing, we intend to provide
you with a further briefing by 29 May 2020 seeking more detailed decisions on policy and
regulatory settings and the other matters discussed in this briefing.
Background
Work is underway to assess a Bluetooth-enabled contact tracing card
11. On 20 April 2020, Cabinet noted that officials are assessing the option of a Bluetooth-
enabled card to support contact tracing and wil report back to the Minister of Finance,
Minister of Internal Affairs, Minister of Health and Minister for Government Digital
Services [CAB-20-MIN-0175 refers]. The Minister of Justice was added to this group of
Ministers as Cabinet on 11 May 2020 [CAB-20-MIN-0216 refers].
12. The card could support contact tracing at scale by recording when a card comes into close
contact with other cards. The cards would be identified by serial numbers and would not
store personal details. The cards would transmit rotating cryptographical y-generated
identifiers that may only be resolved back to a card serial number by the authorised
agency. Cards would store identifiers transmitted by other cards if set time and proximity
parameters are met (e.g., within 2 metres for 15 minutes). This data would only be taken
from the card and given to contact tracers if a cardholder tests positive and they provide
consent. Cardholder contact information (e.g., phone numbers) would be stored in a
separate database indexed by card serial number. Contact information would only be
accessed if a cardholder tests positive and their close contacts need to be notified. The
exact timing and mechanism for getting data off the card is still evolving.
13. The work to assess the viability of inviting all New Zealanders to carry a Bluetooth-enabled
card complements existing and planned contact tracing activities led by the Ministry of
Health (Health). The concept of a card came from the COVID-19 Response Public Private
Partnership (PPP) team. The Government Chief Digital Officer (GCDO) is working with the
IN-CONFIDENCE
Page 3 of 14
Te Tari Taiwhenua
Department of Internal Affairs
PPP team on the proof of concept for the card. The Ministry of Justice is developing advice
on the policy and regulatory framework.
Contact tracing
14. Effective contact tracing is a critical component of the strategy to eliminate COVID-19 in
New Zealand, by isolating cases quickly and stopping the spread of the virus. Effective
contact tracing al ows us to contain the disease and could prevent New Zealand from
having to have Alert Level 4 restrictions again.
15. The Health Act 1956 provides a statutory regime for contact tracing. It provides that the
purpose of contact tracing is to obtain information about the contacts of persons with
infectious diseases or suspected of having infectious diseases in order to:
1.
identify the source of the infectious disease or suspected infectious disease;
2.
make the contacts aware that they too may be infected, thereby encouraging
them to seek testing and treatment if necessary; and
3.
limit the transmission of infectious disease or suspected infectious disease.
16. Under the Act, individuals with infectious disease, or suspected of having an infectious
disease, may be required to provide the name, age, sex, address and contact details of any
contact.
Using technology to support contact tracing
17. Contact tracing is primarily a manual process, based on interviews carried out by trained
people. Digital tools, such as a Bluetooth-enabled card or smartphone app, have the
potential to support this process by enabling aspects of the system to work more
efficiently. Technology can al ow people to be contacted faster and enable targeted rapid
isolation. Identifying and contacting people who might have been exposed to COVID-19 as
soon as possible after a confirmed test means they can take steps to avoid spreading the
disease, thus avoiding the development of new clusters.
18. At this point, no technology solution is accurate enough to enable solely automated
contact tracing. Automated systems can generate false positives (classifying people as
close contacts who shouldn’t be) and false negatives (missing close contacts). The work
underway wil assess the extent to which a Bluetooth card could material y enhance
existing contact tracing processes, such as by identifying and notifying close contacts
faster.
A Bluetooth-enabled card is one option being considered
19. The Ministry of Health considers that a combination of interoperable solutions wil offer
the greatest contribution to contact tracing success. It is currently considering a range of
tools. Other options being considered or progressed include: a mobile phone application
(app), QR code
1 scanning in venues, businesses and other locations, Bluetooth-based
proximity detection using a phone app, obtaining data that is useful to contact tracing
from other sources, and enabling market delivered applications to interoperate.
20. On 13 May 2020, SWC is due to consider a Cabinet paper seeking approval to release a
mobile phone app. From 18 May 2020, the app would enable people to register and
securely share their personal contact details and scan QR codes for locations they have
1 Quick Response (QR) code is a trademark name for a 2-dimensional barcode or matrix.
IN-CONFIDENCE
Page 4 of 14
Te Tari Taiwhenua
Department of Internal Affairs
visited. On 29 May 2020, the app would be updated to al ow the QR code data to be
shared with the Ministry of Health by consent to assist with contact tracing.
21. The Ministry of Health and the GCDO are to report to you with the results of an
assessment of building Bluetooth-based proximity detection into the app and the
Bluetooth-enabled card. A briefing on the results of the first field trial of the Bluetooth-
enabled card in Nelson wil be provided next week for Minister’s to decide whether the
second field trial progresses. A report back to Cabinet is then due on 15 June 2020.
22. This paper seeks initial direction on some of the policy and regulatory settings should a
Bluetooth-enabled card be progressed. It does not assess the merits of a Bluetooth-
enabled card or compare it to the other options. Although the focus is on a Bluetooth card,
the policy and regulatory settings should in many ways be technology-neutral and your
direction in respect of them may be prove equal y relevant to the development of the app.
Core principles underpinning the work
23. Regardless of which technology solutions are progressed, we recommend that they be
supported by clear policy and regulatory settings from the outset. Clear policy and
regulatory settings can support public trust and, therefore, uptake of technology solutions.
24. We seek Ministers’ direction on some core principles to guide those policy and regulatory
settings. They wil also inform the technical development. We outline below some key
principles for your approval. If you are comfortable with this general approach, we wil
brief you on options for more detailed settings in the coming weeks.
Maintain and grow public trust
25. Uptake will be critical to the success of a technology solution. The literature suggests all
measures taken to increase uptake will increase the probability that New Zealand can
successful y control any outbreaks that may emerge under more permissive alert levels.
26. Maintaining and growing the public trust that has built up around the COVID-19 response
would be essential to uptake of the card. Transparency and accountability are key. Other
factors listed below (for example, strong privacy settings and consistency with Te Tiriti o
Waitangi) are also important for maintaining and growing public trust.
As many people as possible can access and use the technology
27. Another key factor for ensuring uptake of the card, is how easy it is for people to access
and use it. The technology and regulatory settings should be designed with the user in
mind.
28. The approach should also be digital y inclusive. The Department of Internal Affairs (DIA)
estimates more than 1 in 5 New Zealanders are digitally excluded. These New Zealanders
have struggled to connect, communicate and access essential services during the response
to COVID-19. Research in 2019 conducted by Motu shows the groups in society most at
risk of digital exclusion are: Māori, Pacific, people with disabilities, seniors (especially
those over 75 years), those not employed or actively seeking work, and those in larger
country towns
2.
29. A Bluetooth-enabled card has potential to reach more people than an app. Digital inclusion
should be considered in al aspects of the card and associated systems’ design. Digital
2 Report: Digital Inclusion and Wel being in New Zealand. Retrieved from: https://www.digital.govt.nz/digital-
government/digital-transformation/digital-inclusion/digital-inclusion-research/report-digital-inclusion-and-
wellbeing-in-new-zealand/
IN-CONFIDENCE
Page 5 of 14
Te Tari Taiwhenua
Department of Internal Affairs
inclusion is about more than technology and internet access – it is about skil s, access,
motivation and trust.
Non-punitive / Non-mandatory
30. While it would be possible to legislate so that the card is mandatory for al adults to carry,
with enforcement measures for those who do not, we do not recommend that approach.
As is discussed further below, we recommend that activating and carrying the card be
voluntary.
31. An approach that imposes penalties is unlikely to be effective and more likely to damage
the significant public goodwil built up by government and health practitioners. Also,
making the card mandatory and imposing penalties for non-compliance would raise more
significant privacy, human rights and Te Tiriti o Waitangi concerns. Similarly, we wouldn’t
recommend penalties for deliberate or intentional damage to the cards or for losing the
cards.
32. On the other hand, if there is a risk that the situation may change such that there is a
desire for use of the card to become mandatory (for example, if there were a significant
increase in the number of cases and community spread of COVID-19), it may be desirable
to signal this potential from the outset and provide for it. Otherwise, a shift could result in
a loss of trust. We understand that this situation is unlikely and consider the risks of a
mandatory approach would outweigh the possible benefit.
33. Even with no legal requirement to carry the card, and no penalties applying, the card could
become “de facto mandatory” if, in practice, it is required to enter some premises. We
discuss this further below.
Assists non-technical measures, such as manual contact tracing
34. The card and other technical measures would not replace manual processes. They should
be designed and implemented to augment existing contact tracing processes, such as
allowing people to be notified and isolated faster, and with greater accuracy, especial y if
tracing caseloads rise rapidly.
Privacy-protective
35. The card involves col ecting and/or using personal information:
1.
to distribute the cards;
2.
to maintain a central register of card serial numbers and cardholder contact
information (e.g. phone number); and
3.
to perform contact tracing when a diagnosed COVID-19 patient provides access to
the close contact data from their card. It is proposed that this close contact data
(which is made up of anonymous cryptographic identifiers that can only be
resolved to card serial numbers by the agency with the necessary cryptographic
keys) would be obtained from the card only when a person is tested. If the test
results are positive, the data would then be transferred to the contact tracing
database and used to contact close contacts.
36. Taking a privacy protective approach wil be key to ensure people are able to use the card
with confidence. Privacy requirements would general y be in accordance with the Health
Information Privacy Code. But given the sensitive nature of the information and the
importance of public confidence, we think there is a case for stronger, bespoke privacy
settings. These would be informed by the Data Protection and Use Policy. Some core
elements of a privacy protective approach are:
IN-CONFIDENCE
Page 6 of 14
Te Tari Taiwhenua
Department of Internal Affairs
1.
Data minimisation - Only col ecting the data that is needed and not retaining it any
longer than is needed;
2.
Delete data after a specific length of time - A clear requirement to delete data
after a specified length of time could increase public confidence. Existing
requirements (for example, in the Health (Retention of Information Retention)
Regulations 1996) may be longer than is needed. Data on cards should be
automatically deleted after a set period (for example, 21 days);
3.
Seek authorisation from card users at two different points: Initial notice should be
provided to individuals before they agree to link their card serial number to their
phone number and a further notice before they agree to hand over their card
before testing for COVID -19. Wording for the col ection and consent notices
should be careful y considered to ensure that users wil understand what they are
being asked to consent to and how their information wil be col ected, used,
disclosed, and deleted;
4.
Provide individuals with access to and correction of their personal information -
Where information is held in such a way that it can be readily retrieved, processes
should be put in place to make it easier for the individual concerned to access
and/or correct their own personal information held in the central register or by the
NCTS (e.g. an e-form accessible from the Ministry of Health website); and
5.
Ensure appropriate security arrangements for storage of data -
Independent
assurance should be sought that the security arrangements for the card and the
central card register and the use of the information on it are appropriate. In
addition, appropriate planning should be undertaken to ensure that arrangements
are in place so that steps can be taken immediately to minimise the effect of any
data breach.
Strict limitations on downstream use
37. A particularly important part of a privacy-protective approach would be strict limitations
on downstream use. Exactly what information the cards wil contain is yet to be
determined. But they wil contain information that, when matched with the contact
register, shows who a person has been in contact with. Given the importance of people
feeling confident using the card, without feeling that they are subject to unwarranted
state surveil ance, we recommend that card data not be used for law enforcement
purposes and that this be clearly communicate
d3. The data held on the cards and the
central card register should only be used for contact tracing for COVID-19. Anonymised
data could also be used for public health research in accordance with existing
requirements.
Exit strategy
38. To support uptake, increase public trust, and assist with human rights, privacy and
consistency with Te Tiriti o Waitangi, we recommend that it be clear that the card data is
only to be used for the COVID-19 pandemic, and potential y for public health research.
3 Other areas which may need to be explicitly excluded to ensure public trust include for the purposes of
welfare payments or social benefits, family and child proceedings, visa or immigration purposes, employment
purposes, or any civil action.
IN-CONFIDENCE
Page 7 of 14
Te Tari Taiwhenua
Department of Internal Affairs
39. However, the infrastructure, supply-chains and cards could be useful to support
government response to future epidemics. We recommend that the infrastructure (e.g.
technology, systems and possibly legislation) be permitted to be preserved so it is
available if needed in the future, for example to respond to future epidemics.
Consistent with the Te Tiriti o Waitangi
40. The development of the technology and the policy and regulatory systems should be
consistent with Te Tiriti o Waitangi and the Crown’s commitment to the Māori/Crown
relationship.
41. There is a significant Māori interest in using technology to support contact tracing
because:
1.
as described in the Charter of Te Mana Raraunga (the Māori Data Sovereignty
Network), data is a living taonga and is of strategic value to Māori;
2.
Māori are more likely to have difficulty accessing digital technology;
3.
health inequities mean Māori are likely to disproportionately suffer the effects of
an outbreak of COVID-19 and therefore have a strong interest in effective contact
tracing; and
4.
any enforcement regime could create a risk of racial bias (to the extent it involves
use of discretion).
42. The principles of Te Tiriti also point to the need for significant Māori involvement in
development, implementation, administration and oversight of a contact tracing card:
1.
partnership: the Crown has an obligation to act reasonably, honourably and in
good faith to ensure it makes informed decisions on matters affecting Māori
interests. This proposal sits high on the scale of Māori interest, therefore requiring
a high level of Māori involvement;
2.
active protection and equity: the Crown has an obligation to act fairly towards
Māori and non-Māori. The principle of equity complements the duty of active
protection and can require positive intervention to address disparities. Addressing
disparities in digital inclusion and health access and outcomes requires positive
intervention; and
3.
options: kaupapa Māori health options should be supported and protected. As
noted below, there could be a role for Māori health/social sector agencies
administering aspects of the system.
43. Our proposed approach to engagement is discussed below.
Consistent with fundamental human rights
44. In order to combat COVID-19, some limitation on rights, such as the rights to privacy and
freedom of movement, may be justified. But rights should be limited only in due
proportion to the objective. A non-punitive, privacy protective approach is most consistent
with human rights obligations. If successful, the card wil also assist us to operate our
epidemic response at the lowest possible alert level, thereby imposing the least possible
restrictions on the liberty of people in New Zealand.
Key decisions to inform development of policy and regulatory settings
45. This section seeks your initial direction on some key issues that wil inform the policy and
regulatory settings.
IN-CONFIDENCE
Page 8 of 14
Te Tari Taiwhenua
Department of Internal Affairs
46. The policy and regulatory settings should give effect to the high-level principles and meet
the public health objective of al owing the health sector to contact people who might have
been exposed to Covid-19 quickly enough to help break the chain of transmission. Could
there be situations in which use of the card is strongly encouraged or even required?
We recommend a voluntary approach
47. As noted above we favour a voluntary approach to the card. We don’t recommend that
people be required by law to carry the card. We also recommend that people be given a
choice as to whether to hand over their card for the data to be taken from it when they
take a test or test positive. This is the same as is proposed for the app being developed by
Ministry of Health. Under the Health Act, a person may be required to provide details of
close contacts. However, they would not have to do this by providing the data from the
card or the app and could choose to provide the information in another format.
48. We favour a voluntary approach as it is more consistent with privacy, human rights and Te
Tiriti. We are also concerned there could be resistance to a mandatory card, which could
harm the level of public support for it.
Use of the card in locations
49. The technology for the card is stil being developed but it may be possible for a business
venue to scan customers in using the card (for example, by scanning a QR code on the
card). The business could then make the data accessible to contact tracers in the event
they need it. Contact tracers would identify the need for it through traditional methods
(such as interviews with a person who has tested positive). Even in the absence of that
feature on the card, businesses (e.g., supermarkets) could require that a card be sighted,
or record a card’s serial number as a condition of entry to the premises.
50. Such a system could be useful for businesses, employers, consumers and employees. It
could replace a more onerous, or less privacy-protective form of visitor register (noting
that some businesses are required to enable contact tracing of people who enter their
premises at some Alert levels or under other legislative requirements). We are already
seeing commercial y developed QR code reading apps being used for similar reasons.
There also may be locations where it seems particularly desirable for people to carry the
card. This could be because the people there are at high risk (e.g. rest homes, hospitals) or
they involve casual contacts for which a person would not have personal details (e.g.
public buses, bars).
51. However, requiring the card for entry raises significant issues in terms of human rights,
privacy and Te Tiriti. The card could easily become de facto mandatory. This could mean
that some people are excluded or unable to access services they need because they can’t
access technology or due to their distrust of government or privacy protections. This
would be inconsistent with a voluntary, non-punitive approach. It also raises practical
issues that likely impact on the usefulness of a card. For example, people may be more
likely to swap or borrow cards if the card is required for entry.
52. Many of these same concerns apply to other forms of technology that could support
contact tracing, such as the app being developed by MoH and commercial y-developed QR
code reading apps. Our view is that no form of technology should be required for entry to
locations. There should always be other options.
53. We welcome your initial direction on whether we should:
1.
engage with stakeholders on whether premises should be permitted to require the
cards (or other form of technology) for entry (e.g., the need for it and how
concerns could be addressed) and report back to you; and/or
IN-CONFIDENCE
Page 9 of 14
Te Tari Taiwhenua
Department of Internal Affairs
2.
consider regulatory settings that would prevent the cards (or other form of
technology) being required for entry.
54. We will also consider whether there is a case for locations to use the cards to record who
comes in (either by recording the serial number or using technology to record the rotating
cryptographic identifier) and how concerns about privacy, surveil ance and Te Tiriti
compliance could be mitigated. We will consider whether there is a risk that al owing
locations to col ect card data could decrease some people’s trust in the card and therefore
affect public acceptability and uptake.
Who would deliver the card and have oversight of its use?
55. In any situation, rapid implementation of the card and other contact tracing technology
will have clear technical and operational challenges, and potentially significant social,
privacy and human rights implications. Therefore, it wil be necessary to ensure the card
system has adequate structures and safeguards in place to support public confidence
through transparency, accountability, and clear operational objectives.
56. Existing oversight mechanisms will have an important role:
1.
the Privacy Commissioner considers complaints about breaches of privacy. Once it
passes and comes into force, the Privacy Bill will give the Commissioner additional
enforcement powers, such as the ability to issue compliance notices. It wil also
require agencies to notify data breaches;
2.
the Human Rights Commissioner deals with complaints about unlawful
discrimination;
3.
if not resolved through the above avenues, people can take privacy and
discrimination complaints to the Human Rights Review Tribunal;
4.
the GCDO’s functions include a system oversight role to provide Ministers and other
key stakeholders with confidence that the system of assurance supporting digital
government outcomes is effective
5.
the Health and Disability Commissioner deals with complaints about health and
disability services and providers; and
6.
the Waitangi Tribunal deals with claims brought by Māori relating to legislation,
policies, actions or omissions of the Crown that are al eged to breach the promises
made in the Treaty of Waitangi.
57. Other oversight could come from government departments (in terms of monitoring and
evaluation) and reporting to Cabinet. Recently the Minister of Health announced that he
would appoint an expert group (under Section 11 of the Public Health and Disability Act
2000) to help provide assurance that contract tracing work is on track. Terms of Reference
for that expert group are being developed currently.
58. GCDO is working on a separate report to Cabinet with an analysis of the COVID-19
technology response oversight requirements from an al -of-government perspective, a
proposed governance structure, and a COVID-19 Technology Response Plan [CAB-20-MIN-
0175 refers]. This could potential y be a group that is used to provide oversight of any
implementation of the Bluetooth-enabled card. A draft Cabinet paper wil be sent to
Ministers this week for their consideration.
59. Given the privacy, human rights, Tiriti o Waitangi and other ethical issues raised by using
technology to assist contact tracing, new oversight functions may be desirable. Such
functions could include:
IN-CONFIDENCE
Page 10 of 14
Te Tari Taiwhenua
Department of Internal Affairs
1.
scrutinising and evaluating the implementation, uptake and effectiveness of the
card as it is rol ed out;
2.
investigating complaints about how the card is used (e.g., unintended uses) or
reviewing the use of the cards; and
3.
research into how the service is perceived by the public, especial y vulnerable
groups and Māori.
60. We are considering whether these functions could be carried out by existing oversight
mechanisms, including the new Ministerial Committee, or whether there may be a need
for something additional, such as an advisory board with civil society membership and
significant Māori representation.
61. Consideration is also being given to the mechanism by which the card could be delivered.
Various organisational forms are being considered, including a business unit in a
government department, a new and time-bound Departmental Agency hosted by a
Government Department, an agency Joint Venture, and a Public Finance Act Schedule 4A
company.
62. Oversight and governance bodies should have expertise that include tikanga, privacy,
ethics, technology, human rights, and Te Tiriti o Waitangi. In recognition of the principles
of rangatiratanga, partnership and equity under Te Tiriti, Māori should have a central role
in oversight and governance.
63. We wil report back to you on oversight for use and delivery of the card.
9(2)(f)(iv)
IN-CONFIDENCE
Page 11 of 14
Te Tari Taiwhenua
Department of Internal Affairs
4.
9(2)(f)(iv)
Next Steps
70. The PPP Team has already been reaching out to interested groups as it has progressed its
work. Over the coming weeks, officials also propose engaging with:
1.
independent statutory watchdogs, such as the Privacy Commissioner and Chief
Human Rights Commissioner;
2.
representatives of Covid-19 vulnerable groups;
3.
representatives of businesses and trade unions;
4.
Māori, utilising existing structures and relationships wherever possible;
5.
NGOs (e.g., Internet NZ, Privacy Foundation, Transparency International); and
6.
independent advisors, such as Stats NZ’s Data Ethics Advisory Group.
71. We are working to the fol owing timeframe:
1.
briefing to Ministers with results of the first Bluetooth-enabled card field trial in
Nelson – by 22 May 2020;
2.
briefing to Ministers seeking more detailed decisions on policy and regulatory
settings – by 29 May 2020;
3.
proof of concept is expected to be completed – early June 2020;
4.
advice to Ministers on whether to proceed to implementation – mid June 2020;
5.
legislation passed (if desired) – early July 2020;
6.
initial rollout (if agreed) – mid July 2020;
7.
final tranche of cards distributed – by end August.
72. Officials from DIA, Justice and Health are available to meet to discuss this briefing.
IN-CONFIDENCE
Page 12 of 14
Te Tari Taiwhenua
Department of Internal Affairs
Recommendations
73. We recommend that you:
1.
Note that a briefing on the findings of the first Bluetooth-enabled card field
trial will be provided next week, for Ministers to consider whether a larger
YES / NO
second field trial should progress.
2.
Note the
Ministry of Health and the GCDO are to report to you with the results
of an assessment of building Bluetooth-based proximity detection into the app
and the Bluetooth-enabled card. A report back to Cabinet is due on 15 June
YES / NO
2020.
3.
Note that we recommend that any technology solution for contact tracing be
supported by a clear regulatory and policy framework.
YES / NO
4.
Agree that the regulatory and policy framework for a Bluetooth-enabled
contact tracing card be guided by the fol owing core principles:
a. Maintain and grow public trust
YES / NO
b. As many people as possible can access and use the technology
YES / NO
c. Non-punitive
YES / NO
d. Privacy-protective
YES / NO
e. Strict limitations on downstream use (e.g. data should not be used
YES / NO
for law enforcement)
f. Augments non-technical measures, such as manual contact tracing
YES / NO
g. Exit strategy – data is only for COVID-19
YES / NO
h. Consistent with the Te Tiriti o Waitangi
YES / NO
i. Consistent with fundamental human rights
YES / NO
5.
Note that there is potential for a Bluetooth-enabled contact tracing card (or
other technology) to be required by businesses and venues for entry and that
YES / NO
this could lead to the technology becoming “de facto mandatory”.
6.
Direct officials to:
a.
YES / NO
engage with stakeholders on whether premises should be permitted
to require the cards for entry (eg, the need for it and how concerns
could be addressed) and report back to you, AND/OR
b.
YES / NO
consider regulatory settings that would prevent the cards being
required for entry (without offering other means to satisfy visitor
register requirements).
IN-CONFIDENCE
Page 13 of 14
Te Tari Taiwhenua
Department of Internal Affairs
9(2)(f)(iv)
8.
Note that officials will report back to you on seeking more detailed decisions
YES / NO
on policy and regulatory settings and the other matters addressed in this
briefing by 29 May.
Ann-Marie Cavanagh
Deputy Chief Executive, Digital Public Service
Hon Kris Faafoi
Minister for Government Digital Services
/
/
IN-CONFIDENCE
Page 14 of 14
