Adam Bandt (Melbourne, Australian Greens) Share this | Hansard source

I move:

That this bill be now read a second time.

The national COVID plan underpinned by the Doherty Institute modelling is very clear that the ability to decrease public health restrictions such as lockdowns relies on high rates of vaccination and high-quality testing, tracing, isolation and quarantine measures.

In other words, without effective contact tracing, high rates of vaccination will not be enough to move us toward a COVID-safe future.

Central to successful contact tracing are the COVID check-in systems that also increasingly will enable premises and businesses to check the vaccination status of customers and visitors.

Every state and territory in Australia has a check-in system in place to help manage the COVID-19 pandemic.

People across the country are required to check-in when going about their daily lives to facilitate effective contact tracing and to help manage COVID-19 outbreaks.

The Commonwealth parliament should support effective contact tracing and encourage the use of check-in systems.

For these systems to work effectively, though, there needs to be a high degree of confidence by the public in the integrity and privacy of these systems.

Most importantly, people need to know that data from the systems won't be used for a purpose other than ensuring public health.

Disappointingly, personal data gathered from check-ins has been used in some jurisdictions by the police for reasons unrelated to COVID-19.

And despite the country-wide use of check-ins, Australia does not have a nationally consistent approach to preventing law enforcement from accessing COVID-19 check-in data.

Individual states and territories have different protections in place, with some allowing personal information to be accessed for unrelated law enforcement purposes via a warrant, while other states and territories have prohibited it.

This inconsistency serves to undermine the effectiveness of COVID-19 check-ins as people cannot trust that their information will only be used for contact-tracing purposes.

There is significant concern in the community and amongst legal and privacy advocates about this situation.

The Office of the Australian Information Commissioner has called for a nationally consistent approach to data, stating:

The OAIC considers that personal information collected for contact-tracing purposes should not be used for other purposes such as law enforcement or even direct marketing. Allowing personal information to be used for other purposes may undermine the effective and efficient contact-tracing system, for example, by discouraging individuals from giving accurate information.

A number of government MPs and senators, including Senator Paterson, the member for Goldstein, Senator Rennick and the member for Mackellar—and, I believe, also some from the opposition—have also expressed concerns about data gathered for health purposes being used by law enforcement and how it can undermine trust and contact tracing.

Indeed, the opposition have also raised concerns, with the shadow Attorney-General calling for a nationally consistent approach.

So I believe there is an opportunity for this parliament to come together to address this problem and quickly pass through this parliament a bill to protect everyone's data and privacy.

This Greens' bill, the Privacy (COVID Check-in Data) Bill 2021, will introduce a ban on using COVID-19 check-in data for enforcement related activity purposes by preventing Commonwealth, state or territory authorities from using or providing COVID-19 check-in data for such law enforcement purposes.

It will end the current situation of confusion, inconsistency and loopholes that enable law enforcement to access such data and that threaten to dissuade people from checking in as the country opens up in the weeks and months ahead.

I will now outline the key elements of the bill.

Section 4 sets out the objects of the bill, making clear that the main purpose of the bill is to support the effective management and control of COVID in Australia by providing stronger privacy protections for COVID check-in data to encourage public acceptance and use of COVID check-in apps and enable faster and more effective contact tracing. That object should be supported and supportable by everyone in this parliament. We want the COVID check-in apps to work and we want as many people as possible to use them.

The bill defines, in section 5, a COVID check-in app as any mobile app that is made available or has been made available to the public by or on behalf of a Commonwealth, state or territory authority for the purpose of facilitating COVID contract tracing. This includes any mobile apps that were available before the commencement of the act.

The bill defines COVID check-in data as data relating to a person that has been collected or generated through the operation of a COVID check-in app.

Importantly, this includes data that has been collected or generated before the commencement of the act.

To align with other legislation, de-identified and enforcement related activity have the same meanings as in the Privacy Act 1988.

The Privacy Act 1988 defines de-identified as:

… personal information is de-identified if the information is no longer about an identifiable individual or an individual who is reasonably identifiable

That act defines enforcement related activity very broadly as: from prevention, investigation and prosecution of crimes or other breaches of the law including surveillance, imposition of fines and matters in relation to the courts.

Finally, the bill defines a mobile app as an app that is designed for use on a mobile device.

There may be other ways that people record check-in data across the country, but mobile devices are very popular, and it is beyond doubt that the Commonwealth has the power to regulate mobile devices.

Section 6 is the crux of the bill and it provides very simply that a Commonwealth, state or territory authority must not use or disclose COVID check-in data for the purposes of enforcement related activity.

This ban does not apply to a Commonwealth, state or territory authority using or disclosing data that the authority has obtained from a source that is not directly or indirectly from a COVID check-in app or de-identified statistical information.

The Attorney-General has said this is a matter for the states, but this really is a proper field for the Commonwealth to regulate. As I said earlier, it is the Commonwealth that has driven the national plan, and the Information Commissioner at the federal level has called for national standards.

But critically, as Australia opens up again, people will move between states and territories more freely. That is, indeed, a core feature of the national plan. As they do so, people should not worry about information being used differently depending on what state or territory they're in.

The constitutional basis of this bill is based on the implied nationhood power, but also further support for the powers in the bill are found in section 51(v) of the Constitution which relates to telegraphic, telephonic and other like services and 51(ix) of the Constitution which relates to quarantine.

The bill also has effect as if it were expressly confined to giving effect to Australia's obligations under the International Covenant on Civil and Political Rights, and in particular article 17 of the covenant, in relation to COVID check-in data.

So while much of the law enforcement activity is in the realm of the states, there is a firm constitutional basis for the parliament to pass this bill, put in place this ban and protect COVID check-in data so that everyone is guaranteed that when they scan that QR code it is being used for COVID purposes and nothing else.

In the middle of this pandemic the Australian people, including though our laws and constitutions, have handed over and been willing to do significant things, including checking in wherever we go. Our Constitution also gives enormous powers to our law enforcement agencies. But in return for all of this people expect our law enforcement agencies to protect us and protect our rights. They also expect that these new practices that we've all agreed to, to scan in, won't be used or abused for other purposes.

But too often we know that law enforcement agencies will try and access any information that they can and often overstep the mark, and that can harm the people that they're supposed to protect.

That is all the more reason why law enforcement agencies should be subject to standards that are set in law, and high standards, including those in this bill.

Most importantly this bill will ensure that people have confidence in using check-in apps, the importance of which will only grow as we try to keep COVID and future variants and viruses at bay.

In my remaining time I'd like to read a statement from the member for Clark, who is seconding this bill: 'I'm pleased to second the member for Melbourne's bill, which prevents COVID-19 check-in data being used for law enforcement purposes. Check-in apps have obviously been an important tool for managing the pandemic around the country. Most Australians understand this and have been using these apps reliably and in good faith. But most Australians would also be appalled to see their check-in data being used for any other purpose, in particular law enforcement, because they never gave approval for their data to be used in such a way. Indeed, many people would not have used the check-in app if they had known their data would be used for any purpose other than responding to COVID-19. Australians have placed a lot of trust in governments over the pandemic and have sacrificed many personal liberties and freedoms, and that trust must be reciprocated.' That's the end of the statement from the member for Clark.

In conclusion, we should pass this bill before we rise. I thank members of the crossbench who have expressed their support for this. I know this has support amongst many members of the government and the opposition, and I hope these protections are in place before we break for the end of the year.

See this speech in context