ITP Techblog

It's now mandatory to keep records of arrivals at many places, events and locations.

Unfortunately, 2021 hasn't been a great year for data security in New Zealand. The technology industry has a role to play in ensuring that personally identifiable information is recorded accurately, kept secure and destroyed promptly. Without the community's trust, the pandemic response will falter. Although we're 18 months in, we're a long way from the finish line.

If we want to be able to enjoy the freedoms that we had 8 weeks ago, we need to maintain high levels of compliance with public health measures. The technology industry has an important part to play in this phase of the pandemic response. Many booking systems and customer relationship management systems (CRMs) are going to be given the added responsibility of being able to quickly facilitate contact tracing. As the creators, maintainers and operators of these systems, it is our responsibility that we be the voice for user privacy.

Check that your privacy statement--you have a privacy statement, right?--has been updated to reference contact tracing. Here is the privacy statement that's recommended by the Privacy Commissioner: "Please note that we will be using our existing records to assist in the management of the COVID-19 pandemic. This means that your details (name, contact number and time and date of your visit) will be given to public health officials in the event that it is required for contact tracing."

Avoid using contact tracing information for other purposes, such as marketing. If you haven't already been collecting people's phone numbers, for example, then you shouldn't be sending them marketing text messages. 

Think about data quality 

One thing to check with CRMs is that that the data quality is of an acceptable standard. If phone numbers have been added manually, they're susceptible to typos. If you can fix this at source, then subsequent contact tracing can be that much more rapid. Your system should be able to generate a report with the information required for contact tracing.

Some systems are picky about exporting data. You should do a dry run before you receive a phone call after hours asking you for the data as quickly as possible. You want to ensure that you're only providing what's required. Contact tracers only need the individuals' names, their contact number, and the date/time that they arrived. It won't take many privacy mistakes for confidence to fall past the point of threatening the overall response. Aucklanders are rightly sick of being stuck at home.

Even if we reach a vaccination rate of 99% of those eligible, there are approximately 1 million kids who are still exposed to the virus. A major outbreak could mean thousands of unnecessary hospital visits. As data stewards, it's our responsibility to maintain the trust and confidence of everyone providing their personally identifiable information. Let's show the people of Aotearoa that we deserve their trust.

Tim McNamara is the Chair of the New Zealand Open Source Society. He holds a Masters in Public Policy from Victoria University of Wellington and has two decades of experience in the technology industry in various roles within the public, private and academic sectors. His area of expertise is natural language processing, a subfield of artificial intelligence.