Menu
The Privacy Trust Mark award identifies products and services that the Privacy Commissioner considers to be outstanding in the way they manage personal information. The award is intended to give consumers confidence that products like Rippl have used a “privacy by design” approach, and can be trusted. The award follows a thorough review by the Office of the Privacy Commissioner of the Rippl solution and the PaperKite’s privacy practices that support it.
John Edwards, Privacy Commissioner
We see this award as particularly important as it highlights Rippl as a contact tracing solution people can trust, against a backdrop of NZ solutions of very variable quality. Examples such as the harassment of a Subway customer and the stalking of a SkyCity casino visitor (as well as other equally unsavoury events) have highlighted that privacy is much more than a nice-to-have when selecting a contact tracing solution.
We very deliberately designed Rippl from day one to be privacy-first because we believed trust would be the key to adoption, and that centralised models would struggle to gain sufficient trust. Our thinking has proved to be correct, with centralised solutions in many countries being abandoned after massive investment because of privacy and security concerns, the most recent being the NHS solution in the UK.
We are very proud of the fact that Rippl doesn’t gather any personal information from users, ever, and still enables health services to contact people when needed. When health services do need to contact someone who has potentially been in close contact with a carrier, this is done anonymously. All the anonymous owners of the phones are sent an alert, which Rippl uses to silently check the local check-in history to see if they were checked in at the time of interest. Rippl then asks only those people who were there to contact health services and reveal their identity.
This is the case whether you use Rippl to scan our own Rippl QR code or a Ministry of Heath’s QR code – Rippl works without any fuss in both cases.
The beauty of our design is that the vast majority of Rippl users never have to share any contact information even with health services. They also don’t have to create an account, set a password, receive an email with a code (etc) like they do with other solutions, such as the Ministry of Health app – which many people find just too hard – and which adds unnecessary complexity and reduces maintainability and reliability.
The privacy-first design of Rippl also means that when contact information is requested it is clear why it is being requested, and there is an obvious value proposition for supplying accurate information (you have been identified as being at risk of having Covid-19 and health services can help you quickly!). This is particularly important when comparing Rippl with solutions which gather contact information every time people visit a site. Our research revealed that many people (including those from marginalised communities) were unlikely to use real contact details ahead of time – but when notified that they had been exposed to COVID-19 they would definitely contact health services. This research is supported by cases such as those in South Korea where false information was left by large proportions of visitors to clubs frequented by LGBTIQ+ people.
Rippl not only does a better job of protecting privacy, it is also a more effective solution as a result.
Last, but by no means least, our privacy-first design aligns with the Treaty of Waitangi/Te Tiriti and Māori Ethics Guidelines for: AI, Algorithms, Data and IOT.
Māori are more susceptible to a range of diseases, meaning they are more likely to contract and less likely to recover from Covid-19. Government modelling of Covid-19 has predicted (should the virus not remain contained in Aotearoa) hospitalisation rates five times higher, and risk of death 2.6 times higher, than for Pākehā. Designing Rippl to be a solution which can be trusted by Māori has therefore been a real focus for the team at PaperKite, and it drove us to provide core content in Māori, and host all data in Aotearoa).
Finally, I’d like to thank the Privacy Commissioner for recognising the effort we have put into the privacy-first design of Rippl. My hope is that with Rippl the PaperKite team has provided a prominent local example of best practice at a time when the tide is slowly turning against those who have betrayed the trust of their users, and some of the largest and most influential global organisations have realised that the protection of privacy is a major point of difference.
I’m also hopeful that this recognition will result in an increase in the number of enquiries we have been receiving from international organisations interested in exploring whether Rippl could be deployed outside New Zealand (e.g. to help if/when we create a trans-Tasman bubble). While New Zealand seems to have COVID-19 under control, this certainly is not the case for most of the rest of the world. I believe we have a duty to identify anything we can do to help.
Rippl is currently free for businesses, and permanently free for not-for-profit organisations, and anyone organising events/gatherings of any kind.
https://www.paperkite.co.nz/rippl/
If while testing you come across something that feels unintuitive let your product owner/dev team know! As much as QA is something that has to be done, it really is incredibly important. You have the power to stop a ‘crApp’ from hitting the market! It could be the difference between having a marginally successful product and a hugely successful one that you will tell your grandchildren about.
New digital project? Keen to optimise your existing digital project? We’re always keen to talk.
Made with ♡ in Wellington
© 2020 PaperKite