Rex Patrick (SA, Centre Alliance) Share this | Hansard source

by leave—I move amendments (1) to (4) on sheet 8956 together:

(1) Schedule 1, item 2, page 11 (after line 1), at the end of section 94F, add:

(3) A person commits an offence if:

(a) the person copies data from the National COVIDSafe Data Store; and

(b) the copied data is transferred to a database outside Australia or to another person who is outside Australia.

Penalty:   Imprisonment for 5 years or 300 penalty units, or both.

(2) Schedule 1, item 2, page 17 (line 24), omit "to cease if", substitute "where".

(3) Schedule 1, item 2, page 18 (line 6), omit "subsection (5)", substitute "subsections (4) and (7)".

(4) Schedule 1, item 2, page 18 (lines 10 to 32), omit subsections 94U(3) to (5), substitute:

(3) If the Commissioner of Police or the Director of Public Prosecutions:

(a) has been informed of the Commissioner's opinion under paragraph (2)(a); and

(b) is satisfied that an investigation relating to the matter, or proceedings for an offence relating to the matter, will be jeopardised, or otherwise affected, by continuation of the Commissioner's investigation;

the Commissioner of Police or the Director of Public Prosecutions, as the case requires, must give a written notice to that effect to the Commissioner.

(4) If the Commissioner has not received a notice under subsection (3) within 14 days of informing the Commissioner of Police or the Director of Public Prosecutions of the Commissioner's opinion under paragraph (2)(a), the Commissioner may continue the investigation discontinued under paragraph (2)(c).

(5) However, if the Commissioner receives a notice under subsection (3) after that 14 day period, the Commissioner must discontinue the investigation upon receiving the notice.

(6) If the Commissioner of Police or the Director of Public Prosecutions:

(a) has given a notice under subsection (3); and

(b) is satisfied that an investigation relating to the matter, or proceedings for an offence relating to the matter, will no longer be jeopardised, or otherwise affected, by continuation of the Commissioner's investigation;

the Commissioner of Police or the Director of Public Prosecutions, as the case requires, must give a written notice to that effect to the Commissioner.

(7) Upon receiving a notice under subsection (6), the Commissioner may continue the investigation discontinued under paragraph (2)(c) or subsection (5).

These amendments, moved by Centre Alliance, will make sure that the COVID app data cannot be copied and used overseas. Currently the bill prohibits retaining data outside Australia; however, these amendments make it explicit that it's an offence if persons copy the app data and transfer it outside of Australia.

The amendments will also ensures that the Privacy Commissioner does not lose the opportunity to investigate a breach while waiting to know if the Director of Public Prosecutions or the Commissioner of Police intends to pursue the matter. The bill currently only lets the Privacy Commissioner pursue a breach when the Director of Public Prosecutions or the Commissioner of Police are satisfied that an investigation will not jeopardise their investigation. However, if the DPP or Commissioner of Police are not timely with giving the Privacy Commissioner the okay, the opportunity to pursue the matter may be lost due to the short duration of the bill's time frame. These amendments will enable the Privacy Commissioner to continue an investigation until the Director of Public Prosecutions or the Commissioner of Police issues a notice that the Privacy Commissioner's intentions will jeopardise their investigation. Basically, this puts a positive obligation on both the DPP and the Commissioner of Police to make a timely assessment so that the Privacy Commissioner is not left waiting for a long period of time.