Duties and functions

New Zealand’s Covid Vaccination Legislation: The Fastest Law in the West


The new law covering vaccination and the use of tracing data is approximate at best and potentially flawed at worst, writes Gehan Gunasekara of the University of Auckland

Former Prime Minister and constitutional law expert Sir Geoffrey Palmer claimed in his 1987 book that New Zealand had “the fastest law in the West”. Without a second parliamentary chamber to review legislation and with Labor Party dominance after the last election, last week provided an example.

The Covid-19 Response (Vaccinations) Legislation Act (the Act) amended the Covid-19 Public Health Response Act 2020, the Employment Relations Act 2000, and affects other laws such as the Privacy Act 2020.

In the absence of a review by a select committee that would have allowed public input, the bill was introduced on Tuesday, November 23, went through all of its stages the same day and received royal assent, turning it into law. , Thursday. At best it’s somewhat rough around the edges, but at worst potentially faulty.

Laws – especially those that affect virtually everyone – must be clear and understandable to ordinary people, not just legal experts. However, if I were to give some of the examples below to my students on an exam, I would risk being murdered or suffering serious bodily harm (hopefully, metaphorically). One of those examples is the protection of Covid-19 contact tracing and vaccination information.

To its credit, the government has responded to public pressure, scheduling that Covid-19 contact tracing information be banned for other purposes, including normal law enforcement, to encourage the honesty needed to face the danger of a more serious pandemic. The Privacy Act and the Personal Health Information Protection Code (HIPC) were insufficient on their own to protect this contact tracing data, as they contain exceptions where there are reasonable grounds to believe that disclosure of information is necessary for law enforcement purposes.

The law now states that “despite everything in the Privacy Act”, contact tracing information may only be used for contact tracing, enforcement of Covid-19 orders, or for the purposes of of the law on health. Likewise, with information collected or obtained for the purpose of determining whether a person is vaccinated or has complied with the Covid-19 Public Health Response Act or a Covid-19 Order issued under it this. It may only be used for these purposes or for the purposes of the Health Act.

Criminal offenses are created for violating these protections – with severe penalties, six months in jail and fines of up to $ 12,000 – as well as the ability to file a complaint with the Privacy Commissioner. of privacy. Employers, in particular, need to be aware of this. For example, it would be an offense to use contact tracing records to discipline a stray worker for absences from work.

However, the exception in the Health Act potentially weakens the apparent protection. Section 22C of that law, for example, allows for the disclosure of health information (this would include immunization status and contact tracing information) in several contexts. One of them is where disclosure would be permitted by the Privacy Act or a code such as the HIPC. So, we have now come full circle.

And it does not stop there. Section 22 C also permits disclosures to a range of other persons. Some are understandable, for example employees of district health boards or prison doctors. Individuals themselves (or in case of less than 16 years their representatives) can also authorize the disclosure of their data. The list, however, includes an assortment of others, including probation officers, social workers and police officers in relation to their powers, duties and functions. This leaves the back door wide open for police, for example, to use contact tracing information to prosecute someone accused of an unrelated Covid offense (such as burglary or assault).

There are even bigger political concerns. It is questionable whether the security implications of providing the vaccine passport in the form of an editable PDF have been taken into account (would a simple JPEG have been better?). Getting New Zealanders to use Google and Apple’s digital wallet infrastructure to store the vaccine pass (effectively supporting their monopolies / oligopoly and providing them with personal data) is also problematic. We can shoot hip with our laws, but are they targeted?