The government and the Ministry of Health have five weeks to deliver New Zealanders a vaccine certificate system that will prove their vaccination status.
These new certificates, which need to be launched and in New Zealanders' hands by the end of November to meet the government's stated deadlines, will be the key to the new covid-19 protection framework traffic light system that will replace the alert level system when New Zealand hits 90% of eligible population vaccinated.
Yet only a very partial picture of the vaccine certificates has emerged so far.
We do know that these digital certificates will be hosted on the new My Covid Record web platform that was launched this month. It is already possible to log into that platform to check your vaccination status.
We also know there will be two separate certificates for domestic and international use.
The international certificates will be based on the European Union digital covid-19 certificate (EU DCC) standard, which will work with the separate IATA travel pass app intended for use for international travel by Air New Zealand in February.
This is about where the trail goes cold as the health ministry is declining to share further information about this essential and urgently required element in opening up.
Despite questions posed by BusinessDesk, and no doubt many others, the ministry is electing to keep many details under wraps about the certificates New Zealanders will soon have to rely on to enter businesses, attend festivals, and travel abroad.
Here are five things we currently don’t know about vaccine certificates, that we need to know:
1/ Will they be ready in time to open up for Christmas?
Short answer: possibly.
The ministry and government continue to state both domestic and vaccine certificates will be available via My Covid Record by the end of November. The ministry asserted to BusinessDesk last week that it was on track to hit the November date.
But on Friday, the government's covid-19 website was stating domestic certificates would be available "from mid-December" before that page was changed to say "from later this year", casting further doubt on the timeframe.
The December mention earlier on Friday. (Image: BusinessDesk)
2/ Who is building the vaccine passport system?
Short answer: we don't know.
BusinessDesk asked the ministry which technology companies are involved with building the My Covid Record website, the domestic vaccine certificates, and the international vaccine certificates. The ministry declined to address these questions, along with others related to data privacy.
“Development of the vaccination certificates continues. This work is on track for the certificates to be available in mid to late November,” said Michael Dreyer, group manager national digital services.
“We’ll be providing more details about the certificates in the coming weeks.”
While the ministry continues to insist both domestic and international certificates will be ready in November as promised by prime minister Jacinda Ardern, it will not say which technology companies it has contracted to build the software and IT systems.
HiNZ reported in September that Microsoft had worked on “the digital identity solution”.
“Microsoft is not directly involved in that vaccination certificate work,” a Microsoft spokesperson told BusinessDesk.
“Microsoft is not directly involved in the actual My Covid Record service itself, which is not on our platform.”
They said Microsoft is involved in the health identity service that "can be used to enable people to sign up to My Covid Record".
The ministry has declined to confirm which technology companies it is working with on certificates.
Rush Digital, the Auckland software company that helped build the NZ covid tracer app, has confirmed it was not involved with vaccine certificates.
My Covid Record sources data stored in the national covid-19 immunisation register (CIR) a relatively new system built by Salesforce.
The ministry of health also left things quite late to build the Book My Vaccine vaccination booking software.
To its credit, that system did work.
3/ What data will domestic certificates contain?
Short answer: we don’t know, but less than international certificates.
NZ’s international vaccine certificates will not be used to enter places in NZ. The ministry has opted for two separate certificates.
“The amount of data in an international certificate is not appropriate to share in a domestic setting,” Dreyer earlier told BusinessDesk.
He said there was “additional data” contained in international certificate QR codes.
“Domestic certificates on the other hand contain very little personal information and are for the purpose only of being able to enter venues that require proof of vaccination.”
It is unclear if this means all the data from My Covid Record will appear as personalised data in either certificate, but it’s also unclear if domestic certificates will contain any personalised data at all, or if data will be anonymised.
There is no clarity on what data is being used in domestic certificates or how it is being stored, which is raising data privacy concerns. The government will be under pressure to make clear if personal data such as name, NHI number, or home address is being stored in the QR codes, and if that data is secure.
We don’t yet know if venues will need to scan vaccine certificates, but if they do, it is unclear if these venues will then have logged any data from the QR codes.
By extension, we don’t know if such scanning would collect data on behalf of the government.
My Covid Record stores personal vaccination data; after all, that is its purpose. Has the ministry of health built a system that holds personal data but when scanned in public places remains private or anonymised?
The transparency around how data is shared within the older NZ covid tracer app suggests the government may not know the answer yet with regards to vaccine certificates if the system is not yet ready.
4/ How will they work to get into a venue?
Short answer: probably via QR code scanning.
We know New Zealanders will be able to present a QR code version of a vaccine certificate on their smartphone using My Covid Record or on paper. People who do not have a smartphone will still need to register for My Covid Record on a computer or smartphone and print their certificate on paper.
It is not clear if the venues people enter will have to scan these certificates.
On Oct 5, deputy director-general data and digital at the ministry of health Shayne Hunter presented slides to media about My Covid Record and vaccine certificates which contained the detail, “event organiser scans QR code with app to verify”.
“We are building a little app that will actually verify it, so that’s to make sure it hasn’t been, um, fraudulently created,” he said.
But when BusinessDesk asked the ministry directly about scanning on Friday, a ministry spokesperson said: “Those sorts of details will be announced in the coming weeks.”
It might be that presentation of certificate is enough, but a match to photo ID may also be needed.
What's to stop a person taking another person's phone and certificate to a gig?
The NZ covid tracer app is a simpler set-up as it requires visitors to scan a displayed QR code, with no device or input needed by the venue.
If every compliant venue in the country needs to have somebody on the door to scan every visitor in and check they have a vaccination it will increase workload and stress for staff policing the system.
By extension, will scanning of the NZ covid tracer app still be encouraged?
5/ Will venues adopt them?
Short answer: yes, if they want a crowd, but it will mean extra work and hassle.
On Friday Ardern announced New Zealand will move to its new covid-19 protection framework once 90% of eligible New Zealanders are fully vaccinated.
A traffic light system of green, orange, and red will be used regionally, and all will require people to present vaccine certificates as proof of vaccination to enter many public places.
Vaccine certificates won't be mandated, but restrictions will apply to places, businesses, or venues that choose not to adopt the system.
If places opt to use certificates, under green and orange settings no limits will apply to hospitality, gatherings at places such as churches and marae, indoor and outdoor events, close contact businesses, and gyms.
If venues decide not to use certificates, restrictions on numbers will apply alongside various social distancing rules.
The government may not have mandated the use of vaccine certificates, but it is incentivising venues and businesses to adopt them by restricting those that don’t, similar to the way it will place social restrictions on those who are not jabbed.
The rules on vaccine certificates are confirmed for the new traffic light framework. If NZ does not reach the 90% rate of full vaccination in each district health board area, NZ will not move to the new framework.
So, if vaccine certificates are ready on time by the end of November, they may sit unused nationally in the old alert level system until the 90% target is met and the new framework is adopted.
On the other hand, what if NZ reaches 90% and vaccine certificates still are not ready?
On Tuesday, deputy prime minister Grant Robertson told the AM Show, “in the worst of all worlds, if we had to, we could use a paper-based system for a period of time” if the certificates were not ready by November. To do so could be messy and confusing, and it's unclear how it would work.
The government's plan to switch to the traffic light system appears to be aligned with the expected readiness of digital vaccine certificates.
