Stupidly counterproductive

Last night the government made it mandatory for businesses to collect contact records. There are obvious concerns here around abuse - for example, the police forcing the production of someone's covid app data under a production order - and these concerns are a disincentive for some people to sign in and enable contact tracing. The obvious measure, which has been used overseas, is to statutorily protect this information and forbid such abuses. The government already does this on information forcibly collected under the Statistics Act, on the basis that good statistics are better than some plod's convenience. So will they do it for covid contact tracing information? Sadly, no:

The government is dismissing calls for more protection of personal information in the Covid-19 contact tracing system.

[...]

Covid-19 Response Minister Chris Hipkins said there was plenty of protection.

"The government has been at pains to reassure people that the information they supply to assist with the critical task of contact tracing will not be used for any other purposes," Hipkins said in a statement.

But the government's word on this is utterly meaningless. For example, police are operationally independent, and neither Hipkins or any other Minister can order them not to apply for production orders or search warrants for particular types of information. If they want to do that, they need to put it in law. And their continued resistance to doing this, after being asked by so many people for so long, is beginning to look highly suspicious. This is stupidly counterproductive, and it undermines the public health response to covid and the strong public support for signing in. And if we have difficulties tracing an outbreak in future because someone didn't sign in for fear of their data being abused, the government will have no-one to blame but themselves.