There are a lot of questions surrounding the Government’s official Covid-19 app. Here’s what you need to know:
Does it track me?
Do I need to use data?
How do I download it?
These are just a handful of the dozens of questions surrounding the Government’s official Covid-19 app, which was released on Tuesday night but only officially announced on Wednesday morning. Here’s everything you need to know about NZ COVID Tracer:
What does it do?
At the moment, NZ COVID Tracer has extremely limited functionality. In fact, it current does just two things: scans QR codes from participating businesses and allows you to optionally send some personal information to the Ministry of Health.
“We shouldn’t think of it as being the digital solution that we’ve all been waiting for. It’s manual contact tracing, plus a little more information when you can get it,” Andrew Chen, a research fellow at the University of Auckland’s Koi Tū – Centre for Informed Futures, told Newsroom.
“It is not intended to automatically do anything. The use case is that you’re collecting data so that if you have Covid-19 or may have Covid-19 and a contact tracer wants to talk to you and find out where you’ve been over the last 31 days, then this might help you. If you have another way of keeping track of that information – so for example, if you are keeping a paper diary or you are using Google Maps Timeline or if you’re going around and just taking photos of places that you’ve been to – then that is a fine substitute. It does essentially the same thing.”
What happens with the data I enter?
Confusingly, the data will be treated differently depending on what it’s about.
Location information – which is only gleaned from the QR codes you voluntarily scan – is stored on your phone for 31 days and then deleted.
In order to register the app, you have to supply an email address and password, which will be securely stored by the Ministry of Health on an Amazon Web Services server in Sydney. It is also recommended (but not required) that you submit a name and phone number, which will also be stored in the same AWS server. You can also optionally provide your residential address and demographic information, such as your gender and ethnicity. All of this data can be considered personal information.
Any personal information submitted to the app will be stored on the AWS server “for the duration of the New Zealand Government’s Covid-19 pandemic response, then it will be deleted,” according to the app’s privacy policy.
“The only exception will be if the information has become part of your personal health record if you have Covid-19 or are a potential close contact, in which case the information will be held on your file after the pandemic response has ended.”
The privacy policy also notes the conditions under which your information might be used.
“We will only use and disclose personal information provided to us through this service for the purpose of the public health response to the Covid-19 pandemic, ensuring this is consistent with the Privacy Act 1993 and the Health Information Privacy Code 1994,” it states.
“The data collected via the App will not be shared with other Government agencies unless they are directly involved in assisting with the Covid-19 contact tracing activities and directly with the Covid-19 pandemic response. They will not be able to use the information for any other purposes.”
Lastly, anonymous analytics about things like how many people are using the app, the number of scans, the operating system and so on may be passed on to the Ministry of Health. This information will only be analysed in aggregate, with no identifying information about individual data points.
“In terms of privacy, negative impacts are quite limited and that’s because the app doesn’t really take that much data. So because the app is simple, because the information that is collected is limited, the privacy impacts are low,” Chen said.
Why does the Government need my personal information, like my name or ethnicity?
While the app can be used anonymously, Chen told Newsroom that the Ministry of Heath’s database of contact details is often out of date and that supplying personal information could help contact tracers get in touch if needed.
“Getting up-to-date contact details for people is actually huge. If they can actually do that for everybody, then that helps the contact tracers waste less time,” he said.
“To some extent it feels like that’s really what they’re trying to do and the QR code functionality is to encourage people to download the app and give their details.”
The Privacy Impact Statement found the Ministry of Health databases – the National Health Index (NHI) and National Enrolment Service (NES) – often have incorrect or outdated information.
“Consumers who have changed their contact details since they were last updated in the NHI or NES services, or who may not be residing at their usual address. The impact of this is that contact tracers may find it more difficult to contact the person concerned, delaying the process of managing their self-isolation, and close contact identification, or they may not be able to locate them at all,” it states.
“If the infected person or a close contact has independently submitted their contact information via the [app] then these contact details could also be accessed by a contact tracer if they had not been able to locate them promptly via the standard processes.”
The personal information you supply won’t be linked to your location data.
What does location data mean? Is the app tracking me?
The app does not use GPS location data or Bluetooth to ping off other phones. By location data, I mean the information about the places you have visited, which is only recorded when you scan a QR code. This information will likely be quite limited in scope – scanning a QR code at Mojo will likely record the location of the Mojo and the time you scanned it, but little else.
How will my location data be used?
The location data is stored on your device and cannot currently be transferred directly to the Ministry of Health. If you test positive for Covid-19, you will be contacted by a contact tracer from your local Public Health Unit (PHU) or the National Close Contact Service (NCCS), who will ask you where you have been and who you have been in close contact with. The app can help you remember that, but the location information stored on your phone can currently only be verbally recounted to the relevant authorities.
An update expected in June will allow you to send your diary of location data directly to the NCCS if needed. The updated app will also be able to check your data to see if you have been at the same location at the same time as someone else who has tested positive and then notify you.
Is this compulsory?
Downloading and using the app is entirely voluntary. However, if you do use the app and are later suspected of having Covid-19, you may be compelled to release the location data to relevant health authorities, according to the app’s privacy policy.
“If you are identified as having, or suspected of having, Covid-19 you are required by the Health Act to provide information to a contact tracer about your close contacts,” the policy states.
“You are not compelled to release the information in the form held on your device about your location details, but you would be required to provide the necessary information required by a contact tracer and the NZ COVID Tracer App may assist you in this process.”
Businesses are also not mandated to use a NZ COVID Tracer QR code.
Does this replace having to sign in at businesses and offices, using a paper sign-in sheet or other digital solutions?
Most businesses are required by Level 2 regulations to maintain their own registries of people who enter their premises. As Newsroom reported Wednesday morning, because your location data for NZ COVID Tracer is stored on your phone, this doesn’t meet those requirements. Even if you use NZ COVID Tracer, you will still have to sign in manually or through another app or web platform.
“In addition to signing in with NZ COVID Tracer, you should continue to sign in to any contact tracing register maintained by the businesses or other locations that you visit. This will ensure the business meets its contact tracing obligations and will make it easier for contact tracers to identify any close contacts if someone with Covid-19 is found to have visited that location,” the Ministry of Health website states.
Prime Minister Jacinda Ardern had previously said the app could be used by people who had concerns about businesses misusing their data, but this reasoning seems to have faded with the realisation that the app isn’t compliant with the Level 2 restrictions.
Chen worries this confusion could affect the app’s participation rate and effectiveness.
“I think that the Government needs to be clear that there are two sides to the contact tracing registers,” he said.
There are businesses that need to have contact tracing registers as stated under the Public Health Response Order and to comply with, essentially, their health and safety requirements to help keep their employees safe. And then there’s contact tracing registers for individuals, to help them remember where they’ve been. The requirements for those two different processes are not necessarily the same.”
How do businesses get the right QR code?
The Ministry for Business, Innovation and Employment has devised a portal on their online Business Connect platform by which every business can generate a unique, NZ COVID Tracer-compatible QR code based on their New Zealand Business Number.
What about all of the other apps out there?
Because NZ COVID Tracer currently operates as just a diary and does not replace contact tracing for businesses, other apps will continue to be used. The Ministry of Health has said it will work with other developers to allow them to use the MBIE-generated QR codes, creating a standardised and consistent system.
Why did it release early?
When a developer sends an app to the app store, it must first be vetted to ensure it isn’t a scam or inappropriate content. The Google Play Store is also engaging in special screening for coronavirus-related apps. The Ministry of Health likely submitted the app early to make sure it would be available on the store in time for its Wednesday morning release, Chen said.
“It makes sense that, if you are the Government and you are going to launch this app at 6:30am on Wednesday the 20th, that you would want to get it through those review processes before then. Unfortunately, those review timelines are in flux, so it’s hard to know exactly how long the review will take,” he said.
“It sounds like the developer basically submitted the app for full review, got approved and at that point they were publicly available. Not a leak and nothing nefarious at all. It was probably found a little earlier than the developers would have liked, but at the point they submitted it to the app stores, it would have been functional anyway.”
What features are on the way?
In addition to allowing other app developers to use the QR codes and making it easier to communicate your location data to contact tracing teams, a number of other features are coming or in development. The June update will also involve a daily health check-in feature, like that available on the Government’s WhatsApp channel to help track on a national scale the spread of flu-like symptoms.
The Privacy Impact Assessment that was carried out for the app notes that it could also see a Bluetooth contact tracing feature like the one used by Singapore’s TraceTogether and even a way to verify whether you are immune to Covid-19 – for example, if you have been vaccinated or have contracted and then recovered from the virus. The Government has not pledged to implement either of these features, but Director-General of Health Ashley Bloomfield told Radio New Zealand that the Bluetooth tracing could be active some time in June.
How will I know when the app changes?
The Ministry of Health will notify you by email before major updates to the app, so you can always decide whether you want to keep using it with new features.
Users “will be notified in advance of any changes being implemented to the Purpose Statement or other Privacy Notice Materials via their registered email address or a notice in the App, to enable ongoing Consumer choice about participation,” the Privacy Impact Statement notes.
“The Ministry of Health has been pretty clear that they will notify people as they add more features. It won’t be in secret that they’re suddenly adding Bluetooth functionality,” Chen said.
“So people will know and hopefully they’ll be able to make an informed decision about whether to continue using the app or to uninstall it.”
Who developed the app?
The app was developed by a New Zealand firm, Rush Digital. Rush has also worked on other New Zealand projects, like the creation of Z Energy’s app.
Do I need data or an internet connection to run the app?
You currently need an internet connection to download the app and to register the first time you use it. After that, because location data is stored on your phone, you should be able to scan QR codes without using data.
What do I need to use the app?
The app is compatible with Android and Apple smartphones, but not some Huawei devices. Android phones must be updated to Android 7.0 or later and iPhones must have iOS 12 or later, according to the Ministry of Health website.
How do I download the app?
Visit tracing.covid19.govt.nz to download NZ COVID Tracer.
Do you have more questions? Email me at marc.daalder@newsroom.co.nz and common queries will be added to this article.
