"The assurances that have been provided by yourself and other government officials are insufficient to prevent misuse," reads the letter.
"Last year, we saw several cases of pen and paper records being misused by individuals to stalk others, and a number of businesses re-using data from pen and paper records for marketing purposes.
"The signatories to this letter collectively strongly recommend that the Government adopt legislation to clarify that data collected for contact-tracing purposes must only be used for contact-tracing purposes."
It cites recent examples in Singapore and various Australian states where contact-tracing data had been used for law enforcement purposes, despite previous assurances.
"While their centralised data approaches are different to how NZ Covid Tracer works, the risks still exist, particularly with pen and paper records being in more widespread use. We also note that individuals perceive risks with government agencies other than police. For example, overstayers may be worried about Immigration NZ misusing this data."
It was counter to our collective interest to discourage those individuals from participating in recordkeeping, said the letter.
"Contact tracing is a crucial tool in our response to Covid-19, and the collection of information to support contact-tracing processes should be encouraged. The potential for misuse of that information may dissuade people from participating, and therefore could negatively impact contact tracing and our ability to respond to the current and future outbreaks."
It said a Ministry of Health report into contact-tracing technologies last October showed a significant proportion of people held concerns over being tracked by the Government and privacy issues.
"It is in our collective interest to have protections that provide individuals with confidence to participate in recordkeeping. The benefits far outweigh the costs," said the letter.
The letter said based on discussions with officials from the Ministry of Health and the Department of the Prime Minister and Cabinet, there was an expectation the Order would include clear protections against misuse of the data collected under the mandatory recordkeeping policy.
Instead the only protection in the Order required contact records collected for the sole purpose of enabling contact tracing to be held for 60 days and then destroyed.
It also believed the current financial penalties for breaches were too low and called for stronger penalties to deter misuse.
The letter has copied in the director general of health Dr Ashley Bloomfield, the health ministry's deputy director-general of data and digital Shayne Hunter and Privacy Commissioner John Edwards.
The Privacy Commissioner today said he also desired a tightening in privacy law involving personal data collected through contact tracing.
"We are on record as supporting more stringent legislative protections for information collected for contact tracing purposes," said Edwards.
One of those behind the open letter today turned to social media saying he was not against collecting data but wanted confidence it would be stored and applied appropriately.
"To be clear, I believe the benefits of mandatory recordkeeping outweigh the risks (and so we should all do it), but we should still mitigate those risks where we can," said Auckland University Centre for Informed Futures researcher Dr Andrew Chen.
He published a reply from the Covid-19 Response Minister.
"On behalf of Hon Chris Hipkins, Minister for Covid-19 Response, thank you for your email. The Minister has noted your comments and has asked his officials for advice on the matters you have raised. You can expect a response from the Minister in due course."
