Govt app doesn’t meet Level 2 requirements

The Government's "digital diary" app cannot be used as intended without amending Level 2 contact tracing requirements for businesses, Marc Daalder reports

The Government's own "digital diary" app cannot be used as intended without amending Level 2 regulations. 

Newsroom reported on Tuesday evening that the app had been released ahead of schedule.

The app, as well as others like Wellington City Council-favourite Rippl, doesn't appear to meet the strict requirements, which mandate that certain businesses maintain a register of contacts themselves that includes names, contact information and residential addresses.

Several digital solutions, including the Government's, seek to alleviate concerns about private businesses holding patrons' data and potentially misusing it. But offices, hospitality outlets and those retail shops unable to maintain social distancing are required under the Level 2 rules to hold that data themselves - apps like Rippl and the "digital diary" which store all data on the phones of the users don't suit.

Filling in a contact tracing form before entering a food court. Photo: Lynn Grieveson

Rick Shera, an IT law expert and partner at the law firm Lowndes Jordan, told Newsroom on Tuesday that the "digital diary" as described by the Prime Minister would not be able to replace business' own sign-in sheets or other solutions without a change to the Level 2 regulations.

"There are two different things here. The [Government's app] obviously would be useful because it provides contact tracing," he said.

"So that's on their phones so if something untoward happened, then the person would be able to access their phone, presumably, with the material and then provide that to whoever the authority might be. So that's more a personal provision of information to a specific authority if something happened. That is quite separate from the requirements in the regulations, which specify that businesses must retain certain information about people who visit their premises."

"It seems like the requirements of the regulations aren't going to be met by the contact tracing app they're going to be releasing," National Party health spokesperson Michael Woodhouse told Newsroom.

"It's simply a diary and it'll not be a substitute for what the employers have to do. The contact tracing app when it was first announced was sold as something that would be able to be used for contact tracing and, therefore, by implication, a substitute for the manual registration of people's entry and exit.

"I just think they're ticking a box. They said they were going to put an app, so they can say to the public, 'Yep we did that, but we protected your privacy.' Actually, it's a useless thing. I can probably do it with my own phone, without an app, in terms of understanding where I've been. The regulation needs to be clarified, the contact tracing app is going to be useless and, in any event, if people comply with social distancing it's not necessary."

The range of information that businesses are required to collect could also be amended. At the moment, businesses must collect the residential addresses of their patrons and employees, but few are.

Amending the regulations would require a Cabinet decision, Shera said.

The company that developed Rippl says it is uncertain what the regulations are and how they're being enforced.

"We've been talking to the Ministry of Health and so have Wellington City Council. Wellington City Council have said, twice, that their contacts at the Ministry of Health have said that Rippl is compliant," Paperkite's client success director Antony Dixon told Newsroom.

"We've got the WorkSafe website, where you can get information about what's needed. You've got the Covid-19 website and you've got a website. You've got lots of places to go looking for guidance."

WCC also tweeted on Tuesday that it "has been advised by the Ministry of Health that [Rippl's] distributed register approach is acceptable. We are expecting more announcements and clarifications for businesses in this weeks digital contact tracing announcements from the Government."

WorkSafe's site doesn't explicitly mention a requirement for businesses to hold on to the data. Although the website does say businesses must keep a record, Dixon says more specific language has been recently removed. After New Zealand moved to Level 2, the site had said "apps which only store information on customers' devices do not meet" the right requirements, but this line is no longer present.

Such a requirement would explicitly rule out the Government's "digital diary" app being used as anything more than a supplementary tool.

However, Jacinda Ardern made clear on Monday that the Government app was meant not just to supplement business registers, but replace them entirely with a way to keep users' data to themselves.

"While there are other similar apps in this space, we wanted to give greater certainty about the use of the data that is collected, which this app happens to deliver," she said.

"Let me be very, very clear, this is around really what I would describe as a digital diary. Helping users when they're out and about, keeping a log of their own movements, for instance, between cafes and restaurants. That's obviously something that those businesses are doing themselves, but this is a way that people can do it that keeps the data for themselves."

Nonetheless, a Ministry of Health webpage on the new app specifies that signing in on business registers will still be required.

"In addition to signing in with NZ COVID Tracer, you should continue to sign in to any contact tracing register maintained by the businesses or other locations that you visit. This will ensure the business meets its contact tracing obligations and will make it easier for contact tracers to identify any close contacts if someone with Covid-19 is found to have visited that location," the site states.

The Ministry of Health declined to comment for this article, saying more details around the app would be released on Wednesday.

Can you help our journalists uncover the facts?

Newsroom is committed to giving our journalists the time they need to uncover, investigate, and fact-check tough stories. Reader donations are critical to buying our team the time they need to produce high-quality independent journalism.

If you can help us, please donate today.


Newsroom does not allow comments directly on this website. We invite all readers who wish to discuss a story or leave a comment to visit us on Twitter or Facebook. We also welcome your news tips and feedback via email: Thank you.

With thanks to our partners