When New Zealand switches to the COVID-19 Protection Framework tomorrow, people will have to present vaccine passes to access many public spaces and venues.
Author
Andrew Chen
Research Fellow at Koi Tū: The Centre for Informed Futures, University of Auckland
At this point, more than 2.4 million people have downloaded their official vaccine passes, which represents almost 70% of the 3.6 million people who are fully vaccinated.
The transition will likely exacerbate inequities that have already emerged during the vaccine rollout itself, and discriminate against vaccinated but "digitally excluded" people who have limited access to email or phone apps to carry a vaccine pass. People can now get their passes in person at some pharmacies, which helps but does not fully solve the problem.
Another major concern is the integrity of how we use and verify vaccine passes. Businesses and venues have different choices in how strongly they verify the legitimacy of the pass itself and whether or not they request an ID to verify the identity of the vaccine pass holder. This can make all the difference in how effective the system will be in reducing the spread of the virus.
Verifying vaccine passes
Last week, the government passed legislation under urgency to enact a "traffic light" system, which places regions under certain settings. Under red and orange settings, many venues will only be open to fully vaccinated people who can present proof of vaccination.
The vaccine pass includes a QR code which can be presented on paper or on a smartphone. So far, the government has said the minimum requirement is only to visually check the pass. The next level of verification would be for staff to use the official NZ Pass Verifier app to scan the QR code to ensure the pass is legitimate, and that the details printed on the pass match the details encoded in the QR code.
But the highest level of verification is to ask for a photo ID to make sure the person carrying the pass is the person named on it. Taking all three steps provides the highest confidence the person is vaccinated.
Understandably, some venues will consider this too much hassle or impractical. Requiring a photo ID will also discriminate against people who are fully vaccinated but may not have an ID (such as under-18s or people who have no need for one) or those who may not have a photo ID in their preferred name.
In my opinion, venues that are required to check for vaccine passes need to scan the QR code to lift confidence that the pass is legitimate. Otherwise, it is simply too easy to fake a vaccine pass.
QR Codes and data privacy
Another challenge is that individuals also need to continue scanning in with their contact-tracing app (preferably NZ COVID Tracer). These apps are generally designed as anonymous systems and all of the data stays on the user's device.
The vaccine pass verifier app inherently needs to know the identity of the person, and it operates on the venue's device, which doesn't store any of the data and works offline. This is why the two apps and functionalities cannot be combined into one.
Inevitably, people will have to provide a vaccine pass and possibly a photo ID to confirm they are allowed to enter. Then the visitor will also have to scan in to keep their own record for contact tracing. It might be annoying, but that's what we have to do to keep ourselves safe.
The official pass verifier app does not store any data, but there might be some exceptions in which certain businesses create their own apps.
Examples include ticketing, where a person's vaccination status may have to be verified at the time of purchase rather than entry to the venue. Businesses with repeat customers, such as gyms, may also want to keep a record of their customers' vaccination status to avoid having to check their pass each time they enter.
The COVID-19 protection framework legislation includes privacy protection that ensures information about people's vaccination status can only be collected, used or disclosed for the purposes of managing COVID-19, with heavy penalties for breaches.
Are vaccine passes effective?
One major question is whether the passes actually mitigate the risk to public health.
Evidence from other jurisdictions suggests vaccinated people transmit COVID-19 less than unvaccinated people, hence the effort to prevent unvaccinated people from entering venues to avoid the spread of the virus. But in a New Zealand context, it remains to be seen whether or not the vaccine passes are effective at suppressing the reproduction rate.
The government has been using vaccine passes as an incentive for people to get vaccinated by preventing unvaccinated people from accessing venues they might otherwise want to enter. But this motivation expires when we reach a sufficient percentage of people who are vaccinated - and simply aiming for a vaccination percentage raises ethical issues.
We should keep coming back to the public health reasons for why we need people to be vaccinated and why we separate vaccinated and unvaccinated individuals. And to uphold that, we have to make sure vaccine passes are used effectively.
This means, at the very least, scanning the QR code to check the passes are legitimate. And we have to reduce the barriers for people to get their vaccine pass so they aren't excluded for the wrong reasons.
Vaccine passes come at a cost. It's a cost financially to the government and taxpayers in developing the system. But there's also a cost socially in terms of exacerbating inequities, and a cost ethically in terms of privacy and restrictions on people's freedom of movement.
If we were to weaken the system to the extent that people can easily fake a vaccine pass, then we aren't separating vaccinated and unvaccinated individuals effectively and make no progress towards mitigating public health risk. That would mean the existence of vaccine passes is not justified.
Andrew has provided independent advice to the Ministry of Health and the Department of Prime Minister and Cabinet as an academic but is not paid by them.
