Auckland vaccination centre, businesses found to still have open sign in sheets despite privacy advice

COVID-19 vaccination centres and Auckland businesses are continuing to use paper sign in sheets for contact tracing despite them not complying with New Zealand's Privacy Act.

The Auckland CBD Vaccination Centre at 35 Graham Street was found to still be using a paper sign in sheet for visitors to sign in with on Monday along with the QR code for the COVID Tracer App.

The names and contact details of each person are visible for further visitors to see.

This is despite paper sign in sheets not complying with the Privacy Act.

The Privacy Commissioner John Edwards says businesses need to display a QR code and have an alternative record keeping system, enabling them to collect contact tracing records in a privacy-protective way.

These options could include a ballot system with individual paper slips or cards for people to fill in the name, date, phone number and time. Or an employee could manually enter visitor details to ensure staff maintain control over the records and do not leave contact information visible.

"Using an open sheet or register left in a public-facing position where personal information is

visible to others is a leading cause of COVID-19-related privacy breaches," he said 

"It's important that businesses provide other methods of collecting and storing contact tracing records, but in ways which also protect the privacy of those whose details are being collected."

Edwards says he is concerned that people are gaining access to personal information from paper-based contact tracing registers and using it in ways that breach other people's privacy.

One Auckland woman recently revealed she had her privacy breached after visiting an Onehunga business.

After leaving, she received a text from an unknown number. 

The man revealed he had seen her at the business, and he got her name and number from where she had signed in on the paper sign in sheet. He proceeded to ask her on a date.

A spokesperson for the Department of the Prime Minister and Cabinet (DPMC) COVID-19 Group said the Unite Against Covid website, and business.govt.nz both provide clear information on what is required of businesses for safe and secure alternative options for record keeping.

"When businesses use a manual sign in option, they need to protect people's privacy by, for instance, making a new sheet available for each person, or by using a 'ballot box' system.

"Resources and information to support the safe and secure collection of this information is available at the Unite Against COVID-19 website. This includes printable slips, record keeping ‘ballot box’ templates, and stickers for businesses using their own boxes."

The spokesperson said guidance and information is provided to businesses, stakeholders and sectors and businesses need to be aware of them and ensure they comply.