Nick McKim (Tasmania, Australian Greens) Share this | Hansard source

by leave—I move Australian Greens/Centre Alliance amendments (1) to (13) on sheet 8960:

(1) Schedule 1, item 2, page 12 (after line 16), at the end of section 94H, add:

(4) A person commits an offence if the person engages in conduct that is intended to coerce another person (including by physical intimidation or imposing a financial disadvantage) into doing any or all of the following:

  (i) downloading COVIDSafe to a communication device;

  (ii) having COVIDSafe in operation on a communication device;

  (iii) consenting to uploading COVID app data from a communication device to the National COVIDSafe Data Store.

Penalty: Imprisonment for 5 years or 300 penalty unit s, or both.

(2) Schedule 1, item 2, page 15 (after line 3), at the end of section 94P, add:

   Commissioner to assess compliance with deletion obligations

(4) The Commissioner must:

  (a) conduct an assessment of the data store administrator's compliance with the obligations in this section, to verify that all COVID app data from the National COVIDSafe Data Store has been deleted; and

  (b) as soon as practicable after completing the assessment, prepare and give to the Health Minister a written report of the assessment.

(5) The Health Minister must table a copy of the report in each House of Parliament within 15 sitting days after the Commissioner gives a copy of the report to the Minister.

(6) The data store administrator must provide the Commissioner with any assistance reasonably required to conduct the assessment. This section does not limit the Commissioner's other powers under this Act.

(3) Schedule 1 , item 2 , page 20 (line 27) , omit " subsection (2) ", substitute " subsections (2) and (4) ".

(4) Schedule 1 , item 2 , page 2 1 (after line 11) , at the end of section 94Y , add:

   COVIDSafe data period ends if human biosecurity emergency ceases

(4) Despite subsections (1) and (2), if:

  (a) the Biosecurity (Human Biosecurity Emergency) (Human Coronavirus with Pandemic Potential) Declaration 2020 ceases to be in force on a day (the emergency declaration expiry day ); and

  (b) the Health Minister:

     (i) has not already determined a day under subsection (1); or

     (ii) has determined a day under subsection (1) that is later than the emergency declaration expiry day;

the Health Minister is taken to have determined the emergency declaration expiry day as the day under subsection (1).

Note: The Biosecurity (Human Biosecurity Emergency) (Human Coronavirus with Pandemic Potential) Declaration 2020 is made under section 475 of the Biosecurity Act 2015. The period for which the declaration is in force can be extended under section 476 of that Act.

(5) Schedule 1 , item 2 , page 21 (line 30) , omit " 6 month period ", substitute " 3 month period ".

(6) Schedule 1 , item 2 , page 21 (line 32) , omit " 6 month period ", substitute " 3 month period ".

(7) Schedule 1 , item 2 , page 22 (lines 2 to 3) , omit " 6 month period ", substitute " 3 month period ".

(8) Schedule 1 , item 2 , page 22 (lines 7 to 8) , omit " 6 month period ", substitute " 3 month period ".

(9) Schedule 1 , item 2 , page 22 (line 10) , omit "3 months ", substitute "1 month ".

(10) Schedule 1 , item 2 , page 22 (line 17) , omit " 6 month period ", substitute " 3 month period ".

(11) Schedule 1 , item 2 , page 22 (line 19) , omit " 6 month period ", substitute " 3 month period ".

(12) Schedule 1 , item 2 , page 22 (lines 27 to 28) , omit " 6 month period ", substitute " 3 month period ".

(13) Schedule 1 , item 2 , page 22 (line 30) , omit "3 months", substitute "1 month ".

These amendments range across a number of provisions contained in this legislation. The first of these amendments creates an additional coercion offence. A number of behavioural economists and others have proposed making things like government payments, tax breaks and other financial rewards and financial disincentives dependent on people using the app. The exposure draft bill would not have captured these issues, but the bill, as changed by the government from the exposure draft to the one that we're currently considering, will catch many of those coercion concerns that the Australian Greens and Centre Alliance have.

However, the current provisions on coercion would still fail to capture non-commercial forms of coercion, such as those relating to, for example, family violence and abuse, and our amendment would make it clear that no form of coercion is legal or lawful under the act. This includes discounts, payments or other financial incentives that may be contingent on a person downloading or using the app, and it would also make it clear that people aren't allowed to be asked to show that their mobile device has the app loaded, in order to avoid discriminatory or abusive treatment.

The second of these amendments relates to privacy verification of data deletion. As an independent regulator, the Information and Privacy Commissioner has discretion as to how and what duties they execute under the powers of this bill. This means that the Information and Privacy Commissioner's final report may or may not contain or report on whether they are satisfied that the data store administrator has complied with the legislation regarding compliance and deletion of the COVIDSafe app and its data. So this amendment will include provisions requiring that the Information and Privacy Commissioner inspect and verify that the data deletion obligations at the end of the app's period of operation have been complied with by requiring the data store administrator to confirm and report to the commissioner that the data has been deleted as required by the app. The amendment provisions will also require that the Information and Privacy Commissioner provide a report to the minister on compliance with deletion obligations as soon as is practicable and for this report to be tabled in both houses of parliament by the minister within three sitting days of receiving it.

The next amendment goes to the end of the COVIDSafe data period. This is quite a significant amendment because we do have concerns with the way that the government has approached the sunset provisions of this legislation, which is effectively to leave it in the hands of the health minister in terms of when the operation of COVIDSafe ends and the data is deleted. This amendment will ensure that the act and all activities covered by the act—including, use, communication and storage of COVIDSafe data—sunset as soon as the human biosecurity emergency declaration ends or by the trigger currently in the act, whichever is sooner and also provide that the collection of data for the COVIDSafe app and the state of emergency under the Biosecurity Act all cease at the same time. This is aimed at ensuring the app and the collection of data do not exceed the declared state of emergency under the Biosecurity Act.

I just want to speak to this at a little bit more length because the dataset collected by this app does, I think everyone would acknowledge, contain potentially very sensitive personal information. We're obviously living through a global pandemic, and this bill, I believe, will pass through this chamber with unanimous support. But if the pandemic has eased off to the extent that the declaration of a human biosecurity emergency is over, there is simply no reason for this data to still be maintained. The minister can extend the declaration if he wishes, but if we're through this pandemic to the extent that the declaration ends, I cannot possibly see how the government has an argument to keep this app in operation and to retain the extremely sensitive personal information that is collected by this app. So this amendment is critical, in our view, and it links the sunset of this bill, once it becomes an act, to the end of the declaration.

I'll say again: if the emergency declaration lapses and if we're through the pandemic to the extent that the government does not believe we need to be living under a human biosecurity emergency declaration, the Australian Greens—and I won't speak for Centre Alliance, but they are co-sponsoring this amendment—believe that there is no reason that the data that is collected by this app should remain. We believe that it should be deleted in order to minimise the chances of this information being hacked or the information otherwise being made public or provided to people that it should not be provided to.

The next amendment is around the privacy verification of data deletion, and, again, as an independent regulator, the Information and Privacy Commissioner has discretion as to how and what duties they execute under the powers of this bill. That means that the Information and Privacy Commissioner's final report may or may not report on whether they are satisfied that the data store administrator has complied with the legislation regarding compliance and deletion of the COVIDSafe app and its data. This amendment will include provisions requiring the Information and Privacy Commissioner to inspect and verify that the data deletion obligations at the end of the app's period of operation have been complied with by requiring that the administrator confirm and report to the commissioner that the data has been deleted as required by the app and for the Information and Privacy Commissioner to provide a report to the minister on compliance with deletion obligations as soon as is practicable and for this report to be tabled in both houses of parliament by the minister within three sitting days of receiving it.

The final amendment on this sheet relates to the reporting period. In the version of the bill that we're debating, the government has introduced biannual reporting on the operation and effectiveness of the COVIDSafe app. Given the relatively short lifetime planned for this app—or, we hope it will be a short lifetime—and the understandable concerns people hold regarding the privacy of their data being held in the national data store, we think it appropriate that this data be reported on every three months or within one month of making a determination under section 94Y.