The Privacy Commissioner is warning phone application developers to ensure platforms they are creating for the COVID-19 response are not asking for more information than what is necessary.
Contact tracing plays a pivotal role at alert level 2. With more people out and about, visiting different businesses and often coming into touch with strangers, the opportunity for transmission grows. Phone applications have subsequently been developed to help users record their movements.
While the Ministry of Health has released its COVID Tracer app - which allows users to keep their own data without it automatically being sent to a larger repository - other app developers have also got on board to assist with the response.
Privacy Commissioner John Edwards warned developers and businesses using other apps to register customers that only necessary information should be collected.
"I am concerned that developers might be putting retailers and hospitality services at risk by offering a service that gives them more information than they need," he told Newshub.
"I am really just trying to encourage the smart people who are able to build these platforms and devices to make sure they are collecting the minimum necessary to meet the public health needs."
Edwards said due to the alert level 2 rules requiring establishments like bars and restaurants to collect some basic contact data, Kiwis will have to put up with providing some information.
"That is the great trade-off that we are all making to beat this virus. The contact tracing requirements for the Ministry of Health mean that if you do go to a bar or a restaurant you have to give over some information, your name and you contact details."
"But what we are trying to do is make sure that those services don't take more information than they need to. A couple of app developers have got a bit over-enthusiastic. One provided a capability within their app to scan identity documents, another wanted people to put their vehicle registration."
He said developers or businesses don't need to be asking about health information "such as whether they had any symptoms".
"You don't need to give that information to go and have a drink at a bar or to book a table at a restaurant," Edwards said.
"If you don't need it, you shouldn't collect it... the more you collect that you don't need, the greater risk it's at. Also, it exposes people to the risk of ill-informed decisions. You can't expect a bar-owner or a restauranteur to be taking this clinical information and understanding the relevance of it and whether they need to do something with it."
On Wednesday, the Privacy Commission released a stocktake of applications, highlighting how each work and what information they collect to help the public they understand what they are using. He recommended Kiwis look at the list provided if they are concerned about an application.
"If it's not there, you might want to either ask us about it or choose one of the ones that is on the list," Edwards told Newshub.
Anyone who feels their privacy may have been breached can contact the Commission.
