Covid-19: vaccine certificate data will be protected by law and will work offline

The Vaccination Certificate Verification application under development by the Ministry of Health will protect a person’s private data.

No data will be stored on the app which will be available later this month when proof of vaccination is required.

The ministry’s national digital services manager, Michael Dreyer, said in a statement that the system was “designed to keep people’s details private.”

“When they present their vaccination certificate at a location, no details will be stored by the official verification app of the Ministry of Health. No one on a site or any government organization will be able to access data on vaccination certificates used on the site. “

READ MORE:
* Covid-19: What we know (and don’t know) about vaccination certificates
* Covid-19: Difficult to make vaccine certificates completely ‘fraud-proof’, but additional identity checks will help
* New Zealand introduces mandatory record keeping to assist contact tracers, but is data sufficiently protected?

Government officials had remained silent on the potential impact on the privacy of vaccine certificates, raising concerns in some quarters about the impact they could have.

Privacy advocates have questioned whether personal data would be stored, such as name, address, date of birth, gender or, most importantly, the location and time that a person got scanned. his certificate. They also wondered if other agencies, such as the police, would have access to the data – but many of those concerns have now been allied.

Concerns remain about how a third-party verification app might be used and what data it might store.

But Dreyer said the ministry was seeking “legislative protection to prevent third-party verification apps from collecting this information.”

University of Auckland researcher Andrew Chen said legislative protection is important when it comes to third-party applications.

He said it was helpful for third parties to create verification apps, for example in the event industry where a vaccine certificate could be merged with a ticket, saving time at the entrance to the event.

“The legislation should make it so that an application can be audited or something like that,” Chen said.

A person’s vaccination certificate will be a QR code, with their own encrypted personalized key. The verification app will have its own public key, allowing it to scan and verify the QR code.

Chen said people would be able to extract the public key after the app was released, so it made sense for health officials to release it before release, allowing third parties to develop their own apps. Associated with legal data protection, he said third-party apps could help.

The application will benefit from additional protection as it will always work offline, without an internet connection.

Some people were concerned that an internet connection would give access to personal information on the app.

Drey er said “the verification application will be able to be used without an internet connection. Proof of vaccination is securely encoded in the QR code ”.

Chen said this raised questions about whether the QR codes would actually be a vaccination certificate or a health pass.

While they sound the same to an ordinary person, Chen said there are some subtle differences that could be significant along the way.

“Details are still missing, which will likely come in the coming weeks,” Chen said. “Is it a certificate or a pass?” It would be nice to know. If it is a pass, does it expire soon enough, otherwise there could be a risk. “

If QR codes are a pass, they’ll just give someone permission to enter a place.

But if they did not contain information about the vaccination, for example what vaccine was given and when, then it would not necessarily be considered a certificate.

Chen said it is important to know the basics of vaccination information as new evidence of the vaccine’s waning effectiveness emerges.

There could be a time when a person was no longer considered immune to Covid-19, and their certificate or pass should therefore expire.

He said if someone is given a booster dose, a new QR code should be generated whether a certificate or pass is used.

Andrew Ecclestone, of the Council for Civil Liberties, said he would also like more information on the ministry’s backend application for vaccine certificates.

“I think one of the key documents that we need to see available as soon as possible is the Privacy Impact Assessment of the Verification Application and the Privacy Impact Assessment of the Verification Application. main government database, ”Ecclestone said.

“And the advice they received from the Privacy Commissioner is pre-existing, isn’t it?” Although they are still working on the privacy impact assessment, we know that they have received advice from the Privacy Commissioner. They should reveal it.

Ecclestone said he was happy that business and app events didn’t store any data, but would like more information on whether the data is returned to the Department of Health.

The ministry also confirmed that the vaccine verification app and the Covid Tracer app will not be merged.

Dreyer said “it is important to maintain the anonymity of the Covid Tracer app”.

“Adding vaccination certificates would require adding more stringent identity checks and verifications in Covid Tracer to prove who is using the app to show their certificate.

“This would likely compromise the app’s strong privacy position at this time.”

Dreyer said Google and Apple also indicated that it was not possible to merge the two apps as it would violate their own privacy policies.

He said more details on security and privacy standards would be revealed in the coming weeks.

Chen said other information was needed as well, such as whether someone should provide photo ID with a certificate and how the exemptions would work.

For example, Chen said he would like to know how they would work for children.

“You know, will a 10 year old get an exemption, and could you ask people if they’re 12 and prove their age?” They may say that anyone under the age of 18 is exempt from needing a vaccination certificate, but we don’t know that yet. “

Ecclestone said exemptions for children were a significant problem because they could also exacerbate inequalities for Maori and Pacific populations.

There is also no information on how the exemptions might work for the few people who have genuine medical reasons for not getting the vaccine.

Vaccination certificates should be available by the end of November.