House debates

Tuesday, 12 May 2020

Bills

Privacy Amendment (Public Health Contact Information) Bill 2020; Second Reading

4:29 pm

Photo of Mark DreyfusMark Dreyfus (Isaacs, Australian Labor Party, Shadow Attorney General) Share this | | Hansard source

Another issue that I raised with the Attorney-General during discussion about this bill relates to the funding of the Office of the Australian Information Commissioner. In short, I do not think that the evidence of the Attorney-General's Department at last Wednesday's COVID-19 Senate select committee hearing that the commissioner requires no additional resources to fulfil her new oversight responsibilities is credible. In fact, it is incredible. You do not have to take my word for it. Just last October, the Information Commissioner told Senate estimates that her office is already underresourced. The Attorney-General has advised me that his department is engaging with the commissioner to ensure that she has the necessary resources to perform the important oversight functions provided for in this bill, the Privacy Amendment (Public Health Contact Information) Bill 2020. While I welcome that engagement and look forward to receiving an update over coming days or weeks, there is no question in my mind that additional funding is urgently required. The only question is how much.

It is also important to remember that for years the government has refused to appoint a standalone information commissioner, a standalone freedom of information commissioner or a standalone privacy commissioner. Instead, one person currently occupies all three of these important and demanding roles. As I've said repeatedly, this is unacceptable. In light of the new responsibilities that this bill would confer on the Office of the Australian Information Commissioner, now more than ever the government needs to appoint a standalone, dedicated privacy commissioner. The appointment of a full-time and properly resourced privacy commissioner rather than a commissioner forced to split her time between three different and demanding roles would make a further valuable contribution to building public confidence in the COVIDSafe app. It should not take a public health crisis for the government to show that it takes seriously the privacy of Australians.

In conclusion, let me be as clear as I can. I have downloaded the government's contact-tracing app, and I want other Australians to download the app, too. But I understand, and my Labor colleagues understand, that many millions of Australians have legitimate concerns about downloading the app. Those legitimate concerns should not be derided or minimised. Those concerns must be taken seriously and, to the extent possible, addressed. I believe this bill goes a long way towards addressing a number of those concerns. But it does not address every concern, and there are many issues that cannot be addressed by legislation alone. Ultimately, those concerns can only be addressed by the government.

If we are to come anywhere near the Prime Minister's target of at least 10 million Australians downloading the app, perhaps the most important thing that the government can do now is to be open and transparent with the Australian people. To gain the trust of Australians, the Morrison government must trust Australians. Publishing the source code for the app was a good start, but it was only a start. The government must be as transparent as possible about everything to do with the COVIDSafe app, whether it be providing additional technical information in relation to the app or being upfront about how the app is working in practice.

The government should be transparent about other matters, too. For example, the government should explain why it awarded the COVIDSafe data storage to Amazon Web Services instead of an Australian cloud service provider. And it should provide concrete assurances to the Australian people that the inexplicable decision to award this contract to Amazon does not mean that the data collected by the COVIDSafe app could, or will, be accessed by anyone outside Australia.

The government should also provide the Australian people, including older and culturally and linguistically diverse Australians and Australians with disabilities, with clear, easy-to-understand and accurate information about the app.

Finally, and most obviously, Australians will have no reason to download or keep using the app if the technology does not work or if the technology is not secure. For that reason, the government must urgently address the technical and security concerns that have been raised about the app by technology experts and members of the public.

I'd like to once again thank the Attorney-General for the constructive way in which he has engaged with Labor when it comes to this bill. I commend the bill to the House, and I move:

That all words after "That" be omitted with a view to substituting the following words:

"whilst not declining to give the bill a second reading, the House:

(1) notes that:

(a) since the beginning of this public health crisis, the Opposition has sought to work constructively and in good faith with the Government to ensure that Australians are kept safe during this health emergency;

(b) the Opposition made a number of constructive suggestions to improve the bill prior to its introduction into the Parliament and the Attorney-General considered, in good faith, all of those suggestions;

(c) to be a valuable public health tool, the Prime Minister has said that at least 40 per cent of the Australian population – or 10 million Australians – would have to download the Government’s COVIDSafe contact tracing app;

(d) to date, approximately 5.5 million Australians have downloaded the COVIDSafe app; and

(e) the passage of this bill, which incorporates a number of suggestions made by the Opposition, is likely to encourage more Australians to download the COVIDSafe contact tracing app; and

(2) is of the view that, in order to reach the Prime Minister’s 40 per cent target, there are other things the Government can and should be doing to build public confidence in the COVIDSafe app, including:

(a) explain to the Australian people why the Government preferred to trust overseas multinational Amazon Web Services over a range of Australian certified cloud service providers when it came to awarding the COVIDSafe data storage contract;

(b) take concrete steps to reassure and guarantee to the Australian public that none of the COVIDSafe app data stored by an overseas multinational cloud service provider can be accessed by foreign nationals, including Amazon employees and contractors and overseas law enforcement and intelligence services;

(c) provide additional funding to the Office of the Australian Information Commissioner, and appoint a standalone Privacy Commissioner, to ensure that the Commissioner is able to properly perform the important oversight functions provided for in this bill;

(d) urgently address the security and technical concerns that have been raised about the COVIDSafe app by technology experts and members of the public; and

(e) provide the Australian people, including older and culturally and linguistically diverse Australians and Australians with disabilities, with clear, easy to understand and accurate information about the COVIDSafe app''.

Photo of Ian GoodenoughIan Goodenough (Moore, Liberal Party) Share this | | Hansard source

Is the amendment seconded?

Photo of Warren SnowdonWarren Snowdon (Lingiari, Australian Labor Party, Shadow Assistant Minister for External Territories) Share this | | Hansard source

I second the amendment.

4:37 pm

Photo of Lucy WicksLucy Wicks (Robertson, Liberal Party) Share this | | Hansard source

I rise in support of the Privacy Amendment (Public Health Contact Information) Bill 2020, which will amend the Privacy Act 1988 to ensure the security of data collected through the COVIDSafe app. This amendment is important to ensure that the personal details of all those who have registered for the app are secure, which goes to the heart of concerns about privacy.

I am extremely proud of how Australians have responded to calls from our Prime Minister and health professionals to download the COVIDSafe app. Over five million Australians have done so, and when I'm out and about in my electorate of Robertson it is really clear that residents on the Central Coast know how valuable this app is in helping to protect our community. Only last week, I was talking to: a local resident who was telling me how she had downloaded the app and she was conscious to carry her phone with her at work rather than placing it in a locker at the back of her work premises, as she normally would do; a local retail worker who said to me that he wanted to make sure he had the app to protect the elderly and vulnerable people who he serves every day; and a local mum who said to me that she's more comfortable now going outside to exercise, knowing that the app provides an extra layer of protection. These are just some of the examples showing how Australians are committed to doing their bit, so that we can continue to consider easing this current phase of restrictions. As the Minister for Health has said, the more people that download the COVIDSafe app the faster we can trace outbreaks of the virus and the greater the protection it provides. This will enable Australians to get back to doing the things that they love sooner, like attending sport on a Saturday morning, catching up with friends for lunch or having the family over for dinner.

As somebody who worked in the telecommunications industry for a number of years, I am acutely aware of the importance of building data systems with integrity. I believe that this bill provides a robust framework, and it makes it very clear to the Australian public that there is only one purpose for the app, and that is to ensure the accurate tracing of COVID-19 cases to help save lives and livelihoods. It's important to note that the app does not track a user's location or movements. Instead, it uses bluetooth to record a digital handshake with other phones nearby, storing this information in an encrypted file on the user's device. If a user tests positive for COVID-19, they'll be asked to provide their permission to upload this information. State and territory health agencies will then be able to use this data to trace who the person has had contact with over the past 21 days. The app is simple, but it will assist in speeding up current manual tracing processes, helping frontline health workers to more quickly stop the spread of the virus.

To assist the effective functioning of this process, the bill provides several protections, which I'd like to outline to the House. Firstly, the bill outlines that it's an offence to require participation in the COVIDSafe app and makes it clear that downloading the app, having it operational and uploading data is voluntary. Secondly, the bill restricts the collection, use or disclosure of app data and punishes breaches with up to five years imprisonment or significant fines. Access will be restricted to state or territory health agencies undertaking contact tracing or those involved as a data store administrator. Not even law enforcement agencies will have access to this data. Users can also ask that their registration data be deleted, giving them full control of their information. These measures and the serious penalties that exist for anyone who breaches them show how seriously the government takes the protection of Australians' personal data.

The amendments also detail the role of the Office of the Australian Information Commissioner in dealing with possible data breaches, making assessments and conducting investigations. Breaches may also be referred to the Australian Federal Police for eventual prosecution. This provides a clear means of enforcement, demonstrating to the community that any breaches will be taken seriously and that their personal information will be safeguarded.

The bill will also make it an offence to hold information on a database outside Australia, clarifying that data will not be exposed to foreign entities and will remain secure. I know some concerns were expressed to me locally in my community about this issue, and I want to assure people in my community that the government has taken strong steps to protect their data.

Finally, the bill addresses what will occur once the app is no longer required to help fight the coronavirus. The federal health minister will be advised by state and territory health officers, through the Health Protection Principal Committee, on when the COVIDSafe app is no longer needed. The bill then requires that the data store administrator delete all app data and notify authorities so a review can be conducted to ensure compliance. This provides another layer of protection and reinforces that the sole purpose of the app is to fight the spread of the virus and save lives and livelihoods.

In concluding my remarks, I'd like to encourage residents across the Central Coast to download the COVIDSafe app or to consider downloading the COVIDSafe app if they haven't already had a chance to do so. As the Prime Minister has said, this is especially important in the weeks and months ahead as some restrictions begin to be relaxed. This means we will be connecting more with others at the supermarket, at local restaurants and cafes, while out getting some exercise, or at work. The app only takes a few minutes to download, but it is such an important step in helping our frontline health professionals, who are working so hard to trace and control outbreaks of the coronavirus. While we've been successful in flattening the curve, it's important that we don't become complacent. By taking basic measures, such as observing social distancing, practising good hygiene and downloading the app or considering downloading the app, each of us can help to protect not only ourselves and our family but our communities and our nation. I commend this bill to the House.

4:44 pm

Photo of Chris BowenChris Bowen (McMahon, Australian Labor Party, Shadow Minister for Health) Share this | | Hansard source

The Labor Party will be supporting this legislation and facilitating its passage through the House this evening. This is in keeping with the constructive approach that the opposition has taken since the beginning of this crisis to support things which are worthy of support and point out areas of potential improvement but not to seek areas of disagreement needlessly. The Labor Party has been consistent in supporting the concept of this app. We have not engaged in undermining the app or questioning its impact on privacy or the role of government, like some members of this House have done who aren't in the Labor Party. We have indicated our support in principle for the app, and we support this legislation. We suggested that it would be appropriate to have a legislative framework surrounding the app.

I acknowledge the Minister for Health has brought down a determination under the Biosecurity Act. It is a good determination. It is a strong and robust one, but of course, as honourable members would understand, it is able to be changed by the minister and to provide that further certainty legislation which could only be changed by a vote of both houses of parliament would be a sensible step and this legislation does this. The legislation provides two pillars. One is to ensure that the information gathered can only be used for the purposes intended, not accessed by any other government agency, not even used in a court case for either a prosecution or a defence, not for any other purpose but for the state health agency for contact tracing and ancillary efforts to ensure the app is working as is intended. That is the only intended use and the only permissible use under law once this legislation passes. The other pillar of the legislation is to ensure that it is truly voluntary—not only that it not be a requirement of government to download the app but nor can it be a requirement of an employer to require its employees to download the app. I noticed a few employers have tried that. It is not on. It is not permissible. It is not legal. No employee can be required by their employer to download the app. Even if the phone belongs to the employer it is not lawful. Nor can it be required by anybody else—a shopping centre, a shop or a hospital—for entry. The app must be voluntary in spirit as well as in the letter of the law. This legislation, I am confident, achieves that.

We have made a series of suggestions through the member for Isaacs to the Attorney-General. Most of those suggestions have been taken up by the government changing the bill, and we welcome that. These have been very sensible suggestions by the member for Isaacs, the shadow Attorney-General, on our behalf, and I do acknowledge the Attorney-General for taking most of them onboard. They are things such as the clarification and improvement of the role of the Privacy Commissioner, which we do think is sensible, and I know the shadow Attorney-General has also suggested more resources for the Privacy Commissioner, which I think is a very sensible suggestion.

I want to cover a few issues though. Obviously, there is the matter of the take-up of the app. There is international evidence that a take-up of 40 to 60 per cent of the population is required for the app to be truly effective. I asked the Prime Minister about this today. The Prime Minister has previously used the 40 per cent figure himself. I see the government has changed the goalposts a little at various points and changed it to 40 per cent of smartphone users. That to my way of thinking is not the appropriate measure. You can get COVID-19 whether you have a smartphone or not. I note that Australia has one of the highest take-up rates of smartphones anyway at 91 per cent of the population. They are relatively similar figures, but the fact of the matter is that 40 per cent of the population at least needs to take up the app for it to be truly effective. The Prime Minister said there was no target today. I, with respect, differ from that. I think there should be a target and it should be at least 40 per cent.

There are also a range of technical concerns that have been raised at various places, and I note the government has said that they're aware of those and are working to remedy them. It does not work as effectively on old operating systems. In some operating systems, it doesn't work at all on older phones which are often owned by older Australians. That is a problem. It doesn't work effectively, or at least there are some concerns, with glucose monitoring apps that many Australians who are diabetics have on their phones. I know that Diabetes Australia has recommended to members not to download the app for that purpose. That is a concern.

There are concerns around people understanding that it's got to be on, operating in the background, and that bluetooth has to be on. There are many Australians who aren't clear about that. Indeed they're not always simple concepts and not all of us are as understanding of those concepts. I've had to check a few times that the app is on and in the background and that my bluetooth remains on for it to work. I do think these are issues. It could be the case that, if the government had waited for the Google Apple app, some of these matters would not have arisen. That is a matter for the government. They're entitled to make that decision for themselves. Our job as parliamentarians is to provide the legislative framework.

The final matter I will refer to is the government's decision to outsource the data responsibilities for the app to Amazon. This has caused, to be frank, considerable concern in elements of the community. It is referred to in our second reading amendment. Our second reading amendment is of course a statement of principle. We are not seeking to amend the bill in detail. That would not be in keeping with our undertaking to the government to facilitate its passage through the House this evening and facilitate its passage through the parliament this week. But it is a matter for the government to explain as to why Amazon was chosen. As I understand it, Australian providers were not given the opportunity to bid for this work. I think that is unfortunate. I understand the government was in a hurry and I understand that only large and reputable providers can carry out this work, but I do think it's at least arguable that Australian providers could have done so. While they don't deserve to have a leg up, they do deserve to have the opportunity to bid for an Australian government contract. I note that we're advised that this was a decision of the Department of Home Affairs, not a decision of the Department of Health or DTA. I think that is a curious decision, and the government would do well to give more detail about that and the protections. I saw the chief executive of Amazon today saying, 'Well, we'll try and resist if the United States seeks under their legal powers to access the data but we may not succeed.' That's simply to my way of thinking not good enough, and it's important that Australians are reassured about that. Australian law doesn't trump US law, and US law doesn't trump Australian law. This bill does make it clear that the data must be kept in Australia. It is an offence if it's not kept in Australia. I think that's appropriate and it has our support, but there are concerns around the decision to give the work to Amazon. I think my friend and colleague the member for Chifley will expand on some of those concerns and other honourable members may well as well.

I don't wish to detain the House because I do want to leave plenty of time for my colleagues to make a contribution nor take up time unnecessarily that would stop a colleague having time so I will conclude at that point. I do thank the House for its consideration and thank the Attorney-General. You've indulged me and, given two of them are here, I thank the members for Hotham and Gellibrand for their engagement with me personally on the issues as well as the member for Chifley. They are deeply engaged in the technological community and understand the highly technical matters and they've been of great assistance to both me and the member for Isaacs as we navigate through this legislation.

4:52 pm

Photo of Clare O'NeilClare O'Neil (Hotham, Australian Labor Party, Shadow Minister for Innovation, Technology and the Future of Work) Share this | | Hansard source

I'm very grateful to the member for McMahon for his contribution. He led a great process within our party to try and think through some of the ways that we could push to get the best bill out of the parliament on this crucial issue. I think we've done a really good job of that. We've worked across the two sides of parliament to make sure of it. We have done something here that is quite unusual, and that is to genuinely improve a bill and get a really good outcome for Australians. I firmly believe that the app that's been designed could—I use that word very deliberately—be a critical part of the way that Australia can start to recover from the COVID-19 economic and health crisis. The legislation that's before us, the Privacy Amendment (Public Health Contact Information) Bill 2020, puts into law some aspects of the legal structure that will essentially sit around the app. Part of the controversy today are the things that are in the bill, but I think there is a lot more controversy about the things that are not in the bill: the way the app has been rolled out and the way the government has described what it was going to do. I think it hasn't been set up for success in the way that those of us on this side of the chamber would have liked to have seen. I'll talk about some of those issues, but I think, like most of us, my perspective on all the policies that we're discussing as a parliament at the moment is very much informed by how I've experienced this crisis—that is, from the extensive contact that I've had with the people that I represent and how their lives in many instances have fallen apart over a series of weeks and days. The family that always comes into mind when I am thinking about the different policies being put forward and how they will affect Australians is one that lives in Oakleigh South in my electorate. The parents and a daughter, who is 19, live together. All three members of the family lost their job in three days. The impact of that on the welfare of that family, not today, not next month but probably in six and 12 months time, is just enormous. Those are the people that I have in my mind when I think about issues like the bill before us.

One of the real concerns I have about the way this debate is being conducted by the government is about a lot of the rhetoric that's surrounding how far we are through this crisis. We get told that the curve has been flattened. We get told that we are past the peak. The Prime Minister and the Treasurer have talked about this notion of 'snap back'. That really worries me because I think it completely underplays the size of the task that's ahead of us. We are six weeks into this thing. We are not going to be out of it until we either have a cure for the coronavirus or we eradicate the coronavirus in Australia, which looks very much like it's not going to happen. There has never been a cure for a coronavirus in history, yet our entire political discussion is predicated on the notion that this thing is past the worse of it. I respect some of the good work that has been done on the other side, but I think we are in for a very difficult year and what the government is having to guide us through is virtually—I'm not going to say it is impossible, because it must be made possible, but what we are talking about here is opening up an economy, letting people go back to work in the middle of a global pandemic that might last for another 18 months or perhaps longer.

The challenge that we are going to face over the coming weeks, as states start to take away the restrictions of movement and on work, is something that no other country in the world has been able to manage yet. Almost all of the countries in the world that we were looking to as best-practice examples perhaps two or three weeks ago have had to put new restrictions down. Even in China, where they did everything possible—and I mean everything possible—to rid Wuhan of this virus, they are again in lockdown there. We see in Singapore and South Korea, which were the great examples to show us that we could manage an economy and get people back to work in the middle of a pandemic, are having to reintroduce restrictions. So, the size of this task is absolutely massive.

Of course, health is the main priority here; I absolutely accept that. We've seen brilliant examples of leadership coming from Victoria. The leadership shown by our Premier has been exemplary, and the public trust in the way that he is managing the process has been so important in helping us get through to this stage. But I also think about that family in my electorate that have lost their jobs. My constituents need to go back to work. They need to go back to work because they need to get food on their table and they need to get their lives back and rolling, and they are very worried.

We know all the things that we need to do. We know the structures that we need to set up in this parliament. We need extensive testing. We need isolation of cases. We need a way for workplaces to be made COVID-safe. We need Australians to follow the rules and regulations about social distancing, and handwashing and hygiene, and we need tracing. We need a fast way to track where Australians are going only so that we can help them and so that we can stop this pandemic from spreading further through our country.

I am absolutely desperate for the government to succeed on this, and it is quite rare for me to be able to stand up and genuinely say that about a bill that is before us. The concern I have is that every indication that I see in the press conferences about the app, the way this conversation has just wildly swung as we've got to the point we are at today, makes me very nervous about whether this process has been set up for success. I've downloaded the app. It's open on my phone right now. I get pinged by notifications several times a day, as I'm sure many of you do too. I want it to work, but I think some of the history here is ringing alarm bells for me. I'm supportive of this legislation because the truth is that most—not none—of the concerns I have about this bill are not about the legislative structure that we've set up. I think the law before us is a good law. I think one of the takeaways from the conversation about this bill is that we can have a good conversation about a technology issue in this country. That's much better than some of the ones we've had with the government in recent years.

We're supportive of the concept of this bill. We're supportive of the concept of a contact-tracing app. We've raised some concerns where they've been warranted. The bill we have before us isn't perfect, but I do want to acknowledge that the government have been good about the way they've engaged with some of the issues that Labor have raised. I went into this discussion absolutely believing that we would need to have an extensive set of amendments moved by Labor and discussed by those on the other side, and probably a whole lot of divisions. We're not having that today. Labor's not moving amendments, and there's a really good reason for that. Almost everything that we raised with the government as areas of major concern were actually dealt with by the government and fixed in the bill that's before us.

I just want to mention some of the specific things that Labor raised and fought for, and that we were able to work through with the government during that process. One of the things that was a very significant concern for people who have a human rights and privacy perspective was the issue about how people would be protected when they were asked to download the app, or essentially coerced into downloading the app. One of the instances that people were concerned about, for example, was that they wouldn't be allowed to go back to work and that bosses would say, 'You're not to come back until you've downloaded the app.' People were worried about not being able to enter certain premises because the owner of the property might say, 'We're only allowing people in who have downloaded the app.' One of the things that's very important about this, to maintain public trust, is that the app is voluntary. So we were able to make a change to how the government proposed the voluntary nature of the app so that it was genuinely enforced, and that was by giving a much stronger role to the Privacy Commissioner in how she'll be able to manage situations where people feel they've been coerced.

We have required six-monthly reporting, on behalf of the health minister and the Privacy Commissioner, on the app. Again, it's critically important that we watch this process. This is new for Australians. We want people to genuinely believe that technology can be used for the public good, and to do that it's important that we continue to monitor how the situation is progressing.

We secured additional oversight and certification responsibilities to ensure that the Commonwealth complies with its obligation to delete COVIDSafe data when the app is no longer in use. One of the really important things we were promised and that we were able to enshrine in this law was that at the end of this pandemic all that data that has been collected by the app would be deleted. No record will be kept of what was recorded by the app of the various people you were in touch with.

There are a number of other changes and improvements that have been made to the bill, but it's crucially important for people who are listening to understand that the reason Labor are not moving amendments is that we did a lot of work before we got to the chamber. We consulted with technology stakeholders, we consulted with people who have a focus on digital rights and we made sure that the things they were worried about actually got dealt with in the bill—I acknowledge the government's willingness to work with us on that—and that's why we have a bipartisan commitment to pass this bill today.

I said that the real concern here is actually not what's in the legislation but the broader way technology issues are handled by this government and the unfortunate place that this COVID app debate takes in that context. The moment this idea was released, the moment the concept of an app was discussed, people's hackles were immediately up. There was an immediate sense of suspicion about what the app would do, how it would collect data and how you'd be able to control what information was kept by it. I think it's really important for us to step back and see why that suspicion was there. It was there because the government, time after time after time, had shown that it actually couldn't bring about a big technology change in a way that was consultative, that respected people's rights and that allowed everyone to have a say, or to say how it was going to be for the public good rather than some sort of coercive purpose.

We don't have to look far into the past to find examples. Everywhere we turn, every time the coalition have tried to do something that relates to technology, they have totally stuffed it up, so why would we trust them with our data? I think that's how a lot of people felt when they were going into this. I'm even thinking about things like the national broadband network. Labor had this great proposal for fibre-to-the-home for 90 per cent of Australians, but under this government we ended up with this mishmash of mixed models. It was a totally missed opportunity to do something to futureproof our country and our economy.

There was the absolutely kneejerk and ham-fisted approach taken on the encryption legislation prior to the last election. I don't think there is a single moment in this parliament's recent history where we have trashed the trust that people have in us to deal with technology issues more than what happened there. It was a truly appalling instance of Australian public policy. And the fact is we're trying to crawl back from these incidents. That's the issue.

One of the other awful examples is also one of the first things the government did with this incredible capability of artificial intelligence that can help us solve so many public policy problems—that is, robo-debt. In an appalling, error-filled way they went around and persecuted some of the most vulnerable people in the country. It's just so regrettable that these are the issues that the government chooses to apply technology solutions to when there are actual public policy problems that are more important, that are more crucial to use artificial intelligence for. But how are we going to get the trust of the Australian people for the next important issue when we just trash their trust in its use through something like robo-debt?

We even saw it in more flippant examples. We had the minister responsible come out and pretend—let's not say pretend, but infer—the myGov website had been hacked when there was no basis for that. Of course it turned out to not be true. Why do these things? We've got to be a lot more careful and thoughtful about how we integrate technology into public policy, because we can do so much better, and we need to do so much better.

That has extended right through to the way we saw the government handle the introduction of the COVID app. We had the government announce the app before they knew what it was going to do—why would they do that?—so instantly everyone was on the back foot because no-one was able to give a clear answer about anything. We had the Prime Minister say that it was going to be mandatory, and then days later he had to unwind that. The government started this whole public discussion about the merits of the app, trying to get people on board, without explaining how it was going to work and how people's privacy would be protected. And they still haven't shown Australians the source code in an open-source format so that these technology specialists out there who are so concerned about some of the ways that technology is being used in public policy can have their concerns allayed. It's just an absolute mess.

What we're seeing here today is that we're trying to come to the party—we want people to trust government in doing this—but government is doing everything it can to lay boulders in its own path to making this technology app work. We know this is crucial, because for the app to work it has to have mass take-up. We had the shadow health minister talk about the need for somewhere in the order of 40 to 60 per cent of Australians to download the app. There are medical specialists who say it must be much higher for us to get use out of this app. What we are talking about here is how, if we are ever going to get to that point, we need everything to go right all the way along. We don't need the Prime Minister to come out and say he's putting forward an app and it's going to be mandatory and he isn't able to exactly explain what it's going to do. This could have been handled a lot better, but let's try to use this as a starting point to refresh this conversation. We've got a bill before the House. I think the app is very important. Labor will be doing what it can to try to make this work.

5:07 pm

Photo of Bill ShortenBill Shorten (Maribyrnong, Australian Labor Party, Shadow Minister for the National Disability Insurance Scheme) Share this | | Hansard source

I'm rising to speak in support of the Privacy Amendment (Public Health Contact Information) Bill 2020, because from the start of this crisis we in Labor have called for sensible, practical measures to help Australia overcome the challenge of the COVID-19 virus. I think the response of regular Australians has been excellent. Individuals, through their actions, have flattened the curve. But of course the pandemic is far from over. Had regular Australians not heeded the call and taken the actions they did—sometimes ahead of government—I think we would be in a much worse situation than we are today. Our hospital system, particularly intensive care, could have been overwhelmed, as we've seen in other jurisdictions and other countries.

Having flattened the curve, Australians seek to assemble and step out again in greater numbers. It is important therefore, that our health system has all the tools in the public health system to be able to prevent and detect the virus. A tracing app that assists health authorities to determine the extent, location and spread of outbreaks is a critical tool. Tracing, tracing, tracing will be part of allowing Australians to step back from the lockdown provisions that we've seen. Labor has consistently supported the concept of the tracing app, as our health spokesperson and our leader have said. Again, we support the legislation, which will protect privacy and safety. I congratulate the Labor MPs and the government MPs who've managed to fashion a satisfactory set of privacy laws.

This is part of Labor's approach to being in this all together and leaving no-one behind. Labor has not provided an obstacle to the government's plans on this app. Labor has removed hurdles by seeking to improve the legislation. Labor is giving the government a clear runway to do its job. Now it is down to them to make this app work. So far, the performance hasn't been satisfactory enough. My opposite number, the minister responsible for the Digital Transformation Agency, is my old friend, Minister Robert, affectionately known in some quarters as the 'master of disaster'. In an interesting interview on Sky After Dark he said that if we're ever to go skiing again—no doubt a thought that most struggling Australians have straightaway in this virus—we have to download the app. He also said that the app works 'fantastically well' on all smartphones, whether they're locked or unlocked. The only problem is that like many of the decrees that emanate from the minister the facts are different to what he says.

There have been real issues with the functionality of COVIDSafe that could have been fixed quickly—fixed rather than denied, dealt with rather than papered over by the minister. The fact of the matter is that there are functionality and bluetooth issues on Apple iPhones. This should ring alarm bells, because iPhones account for more than 50 per cent of smartphones in Australia. The older the smartphone and its operating system, the less effective the app is. When the app is running in the background it competes with other apps for the limited amount of bluetooth functionality. This is a problem. In addition, it has created its own health concerns. People with diabetes who need to have continuous glucose monitoring—CGM apps, for instance—have been warned that they might be compromised by the COVIDSafe app being on the same device. Pick your poison! Experts and users alike have reported that the app's bluetooth functionality works best when it's in the foreground of the iPhone. This means, though, that when the phone is locked, as most of our phones are most of the time, it does not work properly.

Now, this isn't just some people on the internet talking down or talking poorly of the minister or the government. I listened very carefully to the submission to the Senate committee hearing on 6 May by the CEO of the Digital Transformation Agency, Mr Randall Brugeaud. He said:

What we can say is that the quality of the bluetooth connectivity for phones that have the app installed running in the foreground is very good, and it progressively deteriorates and the quality of the connection is not as good as you get to a point where the phone is locked and the app is running in the background.

This is a problem. I suggest that the minister request a briefing from the DTA Chief Executive on how his app works—or, as the case may be, doesn't work.

We support this app in principle. It requires public trust. The thing needs to work in order to help instil the trust. It needs to have sufficient uptake. The government has said at different times that the aim is to have it taken up by 40 per cent of people. Now we've found out—the Prime Minister has said—that it's 40 per cent of adult Australians and indeed 40 per cent was a number from Singapore and the government didn't really mean 40 per cent. This is not designed to engender public confidence. Will the app work, or won't it?

I also have to raise what a lot of constituents have raised with me. Why has the data been stored with the US company Amazon? Surely there are Australian companies who could have done the work. If we've learnt one thing about this virus and global supply chains it's that the more we can do things locally, the more that we can rely on Australian know-how, the more independence and greater control we have. And why hasn't the government been able to get the app to work properly on iPhones?

But I speak in this debate on the basis of hope, and there is reason to hope. Since the recent conversion of the government to Keynesianism, the Morrison government makes me believe that they're capable of coping with other changes from initial positions. It is said that there are no atheists in a foxhole. It turns out there are no small-government libertarians in the current government, in a pandemic. But I believe that a recurring problem for this government is a lack of willingness to listen to outside experts and to make sure that they can build the public trust to the sufficient level to take this app up.

The app does have issues; some are being fixed and others can be fixed. What we don't need is a Napster app for the iTunes age. We don't need a Blu-ray in the age of Netflix. We cannot have the usual approach from this particular minister of saying: 'Everything's fine. Nothing to see here. Move along.' We don't need to have a minister who blamed imaginary hackers—before the parliament rose—for the myGov crash. What we need to do is just take responsibility.

Labor has been cooperative with the government. It is providing it with the environment in which it can pass its legislation. But I think the quid pro quo from the government to the Australian people is to make sure that the app works. I'm indebted to the work of the members for Chifley, Hotham and Gellibrand for helping to educate me and Labor about how to make the system work properly. But I say to the government: 'Where there is a problem, just fix it.' This should not be a situation where they resort to type and criticise imaginary enemies and imaginary problems when they can actually deal with the issues themselves. This is what Labor does with this legislation: no obstacles, no hurdles, no barriers, no Labor to blame. What Australians want from the government is just to make it work, like Australians have flattened the curve.

5:16 pm

Photo of Tim WattsTim Watts (Gellibrand, Australian Labor Party, Shadow Assistant Minister for Communications) Share this | | Hansard source

I'm pleased to have the opportunity to speak on the Privacy Amendment (Public Health Contact Information) Bill. We all have a role to play in our nation's fight against the COVID-19 pandemic, and I'm pleased that for this week at least parliamentarians are being allowed to do their job in this place, providing representation for our communities and accountability and scrutiny of the government. If footy players are getting back on the training pitch, we can certainly do our job in this chamber. On the whole, the bill before the House today is a good one. The bill provides an enduring legislative framework for the protection of information collected by the government's new COVIDSafe tracing app. In many ways the privacy protections included in this bill are, to use a word of our times, 'unprecedented' in Australian law. These protections are important not only for delivering on the substantive privacy outcomes but also for boosting public confidence and helping increase the take-up of this app.

Labor has worked constructively with the government on amendments to further strengthen these privacy protections and I thank the shadow Attorney-General for his work as well as other members of the Labor side, including the members for Chifley, Hoffman, Maribyrnong and the shadow health minister. I also thank the government for their constructive and cooperative approach in this regard. The result is a bill that will provide the strongest privacy protections for any data ever collected in Australia. The way that Labor has constructively worked with the government on this bill reflects our support for the idea of a contact-tracing app to assist our public health experts in the next stage of our response to COVID-19.

Many Australians—around five million people, or 20 per cent of the general population—have also shown their willingness to do their bit to support this endeavour, by downloading the app to their phones. The government has been able to tap into an enormous wellspring of solidarity and community support in reaching this level of take-up. It is a genuinely impressive response from the Australian community that we should all be proud of. However, the ultimate effectiveness of this app will depend on more than just this initial public response. Those who want this app to succeed should be clear-eyed about these challenges. We need to understand the app's limitations so that the government can continue to improve it and so that the public can adapt its behaviour to take its limitations into account.

The first thing that's important for everyone to understand is that the COVIDSafe app's objective is to protect the community, not the individual. The contact tracing enabled by the COVIDSafe app is designed to stop the spread of COVID-19 throughout the community, making us all, collectively, safer. But the public must understand that installing this app will not provide any form of individual protection to you. It's not a prophylactic; it's not individually preventative. It is misleading to describe this app as being 'like sunscreen'. That might be effective as a sales job to drive downloads, but it is misleading when it comes to the COVIDSafe app's individual health benefits. Unfortunately, there is an emerging misconception amongst some in the community that the app does provide some form of personal protection or, say, a warning if COVID-19 infected people are nearby. It doesn't, and it's important that people who have installed the app do not behave as if it does.

If people think installing the app is a licence to engage in risky behaviour, it will undermine the work of the public health officials that we are trying to assist here today. Even if you have installed the app, you still need to carefully follow the medical advice of our health experts in your state or territory on social distancing. The second challenge for the effectiveness of this app that needs to be confronted is its performance limitations. The COVIDSafe app is not a silver bullet for contact tracing. Government, health officials and the general public need to be aware of its technological limitations to guide their behaviour. Unfortunately, a fortnight after the public release of this app, the functionality of the app on iOS devices—nearly half the market—is still unclear.

Troublingly, statements from the government about the way the app works on iOS devices have varied over time. In the hours before the app was launched by the Prime Minister, the government's COVIDSafe information page stated: 'COVIDSafe app needs to be open to work effectively. Keep the app open and notifications on when you're out and about, especially in meetings and public places. Activate the inner power save mode. Flip your unlocked device upside-down or face down while the app is running. This keeps the app open with a dim screen so that it can detect other devices running COVIDSafe app.' But shortly before the Prime Minister's press conference releasing the app this text was altered to: 'Keep COVIDSafe running and notifications on when you're out and about, especially in meetings and public places.' This inconsistent messaging was reflected in statements from government ministers and public servants. On the day of the launch of the app, the Minister for Government Services declared: 'To be effective users should have the app running in the background when they are coming into contact with others. Your phone does not need to be unlocked for the app to work.' Yet, later, the head of the DTA, Randall Brugeaud, hedged and said: 'The quality of bluetooth connectivity for phones that have the app installed running in the foreground is very good but it progressively deteriorates and the quality of the connection is not as good as you get to the point where the phone is locked and the phone is running in the background.'

This was only compounded when these statements about how the app actually works were tested against real-world performance of the app by the Australian tech community. Today the actual effectiveness of the app on iPhones in background mode remains obtuse. It certainly isn't catching all of the potential contacts between locked iPhones or between iPhones where the app is operating in the background. These performance issues have real consequences. The most obvious is its impact on the public health messaging required from the government. Public health messaging shouldn't require citizens to follow GitHub forks to know what to do to use the app the right way. If the app requires users to take actions in order for the app to work effectively, the government messaging needs to make this clear, and it's not just users who need to understand this either. These technical limitations may well have implications for employers too. Mobile device management policies frequently require the automatic locking of devices for corporate phones, including the policies of the Department of Parliamentary Services. This applies to handsets for people in this chamber. Those managing these systems need to understand the impact of these policies on the operation of the app. Public health officials need to understand this too in order to be able to judge the tracing capability available to them through this app for managing further outbreaks.

Epidemiologists studying the transmission dynamics of COVID-19 have sought to model the effects that app based contact tracing could have in helping to contain the epidemic in a country. Epidemiologists at Oxford University have found that around half of COVID-19 transmission occurred before individuals were symptomatic, and they developed a model looking at how contact tracing via an app could help reduce this form of onward transmission. Their modelling tested the impact of a contact tracing app based on a range of assumptions and concluded that if 80 per cent of smartphone users—or 56 per cent of the general population—used the app then it could effectively contain an epidemic in a country. Lower take-up rates of the app would still assist in reducing infection and death rates, though, as well as reducing the prospects of subsequent lockdowns.

Importantly, however, underpinning each of these scenarios in the Oxford University modelling was an assumption:

… 80% of modelled contacts are registered by the app, either for technical reasons, or due to some contacts involving people not carrying their phones. We've seen a range of take-up targets for the number of people downloading the COVIDSafe app floated by members of the government in recent weeks, ranging from the Prime Minister's 40 per cent of the total Australian population, to the Prime Minister's 40 per cent of smartphone users in Australia to the Chief Scientist's target of at least a third of Australians, which was the Chief Medical Officer's target as well. We haven't, however, heard what proportion of potential contacts between apps the government is expecting the current configuration of the app to register. It's a key variable in the modelling. This figure has big consequences.

As Dr Adam Dunn, a biomedical informatics expert at the University of Sydney, explained to the ABC that if 70 per cent of Australians downloaded the app and the app registered all potential contacts, up to half of all theoretical contacts would be caught by the app—50 per cent effectiveness. In contrast, if 40 per cent of the population downloaded the app but only half of the potential digital handshakes between downloaded apps were completed then only four per cent of potential contacts—fewer than one-in-20 contacts—would be caught by the app. This is why the effectiveness of the app the government has designed in registering contacts matters.

We should be clear that the reduced effectiveness of the COVIDSafe app on iOS devices is the result of a design decision taken by government—specifically its decision not to wait for the new Google-Apple API for contact tracing. The Prime Minister's decision to move away from his initial, complete rejection of the need to use the Google-Apple API for this app, stated in mid-April, is welcome. But it's now important that the government prioritises incorporating the Google-Apple API iOS integration as soon as possible to maximise the number of potential contacts caught. Once this new version is released, we'll also need a new public information campaign to encourage people to update the app to catch the 10 to 20 per cent of users who don't regularly update the apps on their phones. This app could play an important role in helping us move beyond the current coronavirus restrictions, so it's important that the government gets its implementation right.

Finally, I want to make a few comments on this bill from the perspective of my cybersecurity portfolio. The provisions in this bill and the government's overall approach to this app highlight an ongoing philosophical problem in the government's approach to security. For this government, security seems to be founded on secrecy and obscurity. They won't be accountable to the parliament about the cybersecurity posture of Commonwealth entities, because they believe talking about the security posture is a security risk, as though adversaries rely on Senate estimates for vulnerability scanning. They respond to good-faith reports of security issues by threatening the employment of academic researchers and seeking to make independent security research a crime. They gag security researchers with views that scare them from speaking at government security conferences. They instinctively overclassify, creating needless obstacles to cybersecurity threat intelligence sharing and genuine engagement with the private sector stakeholders. Security doesn't work this way.

Transparency doesn't create security threats; it reveals them. Security vulnerabilities continue to exist whether you talk about them or not. Accountability doesn't undermine security; it strengthens it by identifying problems and creating incentives to fix them. The broader technology and security communities aren't a threat to be managed; they're an opportunity to be engaged.

While the process that the government has pursued in the development and release of this app has offered more transparency than is usual from the government in this space, it's still fallen short of that seen in peer nations. I want to thank Vanessa Teague for her diligent work in compiling international comparisons of government transparency and accountability in this respect.

It wasn't until two weeks after the public launch that the government released the source code for the iOS and Android versions of the app. In comparison, both the UK and Singapore released the source code for their apps either before the launch or at the time of the launch. The Australian government has stated that it will not be releasing the source code for the national COVIDSafe server supporting the app. In contrast, Singapore has released a source code for both the app and the server.

Both Singapore and the UK released white papers explaining the security and encryption decisions made in the implementation of the app at length. The UK has published a detailed paper from the technical director of the National Cyber Security Centre. We haven't seen anywhere near the same security transparency from the Australian bodies who have reviewed the app. We're told that it received the thumbs up, but there isn't anything detailed that external researchers can engage in to validate this. We don't know, for example, why the COVIDSafe design team chose to rotate handset encrypted IDs every two hours instead of every 15 minutes or why they chose to obtain only a single new temporary ID from an essential server at a time. Contrary to the recommendation in a traced together white paper is that daily batches are downloaded, leaving handsets without a new ID if they're outside internet coverage.

Finally, there's no vulnerability disclosure process for this app. Members of the Australian tech community—public interest technologists—who want this app to succeed have donated countless hours to analysing the code of the COVIDSafe app, looking for bugs and vulnerabilities, and they have found issues with both the security and the performance of the app. While on the whole, most researchers believe that the bugs and vulnerabilities they've found would not have dissuaded them from downloading the app given the potential public benefits, it would be better for these unintended privacy issues to be remedied. As one researcher, Jim Mussared, put it:

Don't Panic! Users are advised to be aware of these issues but in most cases might reasonably conclude that they are not significant enough to warrant not using the app.

I still have the app installed, and will continue to do so. I support the COVIDSafe application and want to see lives saved, but, at the same time, it's very important to me that these privacy issues are addressed. But, when Jim disclosed security issues via the public-facing email address for the app, as well as via emails to the DTA, ASD, ACSC and the Cyber Security CRC, he received no response to his issues for eight days. It was only when the issue began to attract media attention that he received a one-line acknowledgement via email. An update to the app released the day that he received this response did not address the issue that he had raised.

At a minimum, a functioning vulnerability disclosure process should set expectations for how an organisation will engage with outside reports of vulnerabilities and bugs and subsequently respond. An email address that operates as a black hole is not a vulnerability disclosure process. The best technology companies in the world seek external feedback. They operate with these vulnerable disclosure processes. The US military does this. The UK government has a government-wide vulnerability disclosure platform operated by HackerOne, and Australia should follow suit.

We shouldn't exaggerate the impact. Vulnerability disclosure processes and their extension bug bounty programs are supplements to good security practice, not replacements for it, but we've already seen the value that an extra set of eyes can offer to improving the security and performance of this app, and the government should avail itself of it. All of us in this chamber, all of us in the Australian community and all of us in the Australian technology sector want the government to succeed with this app. The government should listen to those trying to help it in this initiative.

5:31 pm

Photo of Helen HainesHelen Haines (Indi, Independent) Share this | | Hansard source

Since the Minister for Health first announced that this app would be central to Australia's fight against the pandemic, many constituents have contacted me concerned about what this app entails. They wanted to know that their personal data would only be used to respond to the pandemic and would not be exploited by government. What would happen to their personal data after deleting the app? Could they be forced to download the app or upload their personal data, particularly by their employers? To be fair, I wondered these things myself.

When I first studied the government's proposal, I laid out three tests the government would have to meet to win my support. It had to be voluntary, temporary and secure. 'Voluntary' means people cannot be forced to download the app by their employer, the government or any services they wish to use. 'Temporary' means that, once this pandemic has passed, the app is dismantled and the data it stored is completely erased. 'Secure' means legislated privacy protections for all those who download it. The privacy safeguards in the bill meet my three tests and they will allay the concerns of many Australians who, when asked to download the app, have justifiably hesitated. While there are clearly gremlins to be ironed out, the public benefit outweighs the issues that have been identified thus far.

This app, of course, is only necessary because Australia continues to face an enormous public health crisis. As a former nurse and a rural health researcher, I understand acutely the impact that this pandemic is having on our health service. The nurses and doctors on the front line of this fight are my former colleagues. Today, on International Nurses Day, I think especially of our nurses and the centrality of their role in the fight against this pandemic. For their expertise, their professionalism, their courage and their compassion as they take on this pandemic, I honour them. When I think of this app and what it could do to help keep a lid on this virus, it's them I think of.

As we relax restrictions, we know there will be outbreaks. To deal with this, the app alone is not enough. The app is not an alternative to social distancing; it's a complement. I'm concerned that the government's messaging on this has been confusing. It's not a catch-all for contact tracing; it's an adjunct to contact tracing. I've even heard stories about people thinking the app itself provides immunity against the virus. We need to be crystal clear that the same lessons we followed still apply even as restrictions lift: stay home when you can, maintain a safe distance from people and wash your hands.

COVID-19 was always more than a health crisis. It's also, of course, an economic one, and this app, by assisting us to trace and contain outbreaks, helps us start carefully and cautiously to reopen the economy. This is critical because the economic picture is dire. Throughout April I conducted an extensive survey of almost 400 businesses across my electorate of Indi to understand precisely how they've been impacted by COVID-19 and whether the support the government offered is sufficient to support them through this difficult period. The results of that survey are sobering. One-third of businesses told me they had lost 100 per cent of their revenue due to the lockdown. Ninety-seven per cent of businesses have been negatively affected. On average for those 400 businesses was a loss of 70 per cent of their revenue. Over a third of them laid off employees.

But beyond the headline figures three things absolutely stood out. Firstly, in my electorate tourism has been so hard hit. Accommodation and food businesses were among the hardest hit. Ninety-nine per cent of accommodation providers and 91 per cent of food businesses reported severe impacts.

Secondly, JobKeeper is leaving many behind. Sole traders in particular were more likely than anyone else to have looked into JobKeeper and decided not to apply. Now, many people have legitimate reasons not to apply, but many sole traders told me they wanted to but they're not eligible or they don't think they're eligible. One participant said there are entire industries—in particular the arts and entertainment industry—that, due to the nature of their employment, will not benefit. People on temporary visas, crucial to many regional businesses, have no support, and in many cases they've been told to go home. Unfortunately, it's not that simple and, if they leave these businesses, many of these businesses will indeed collapse. In a rural area such as mine, they won't open again.

Thirdly, bushfire affected regions are struggling the most. With the bushfires and now COVID-19, these regions have been hit with a double whammy. The data from my research shows that the Alpine and Indigo shires, the most bushfire affected of the LGAs which were hard hit either directly by the bushfires or as an effect of the bushfires, reported the most severe impacts of COVID-19. Towong Shire, the most severely burnt of the bushfire areas, was not far behind. One shop owner told me: 'It's going to take a lot to recover from this year, with fires and now this. It's the ripple effect that's going to impact us for years.' A hotel owner in one small rural community told me: 'We're resilient farming people who are used to tough times. However, on the back of our horrific and devastating bushfire season, our local community is fragile and struggling with this.'

All businesses in Australia have been hit hard, but in bushfire affected regions COVID-19 was not the first hammer blow that they've suffered this year. Just as we need to safeguard our hard-fought gains in tackling the pandemic, we need to do all we can to support small businesses through the difficult time they face. This app, which this legislation implements, is a start. It's a small start and it's part of our fight back.

But reopening the economy—which this app contributes to enabling—by itself, is not enough. From my research with small businesses in Indi, there were six key things that people were calling for again and again. First, small businesses need more targeted and flexible support to survive and grow beyond this COVID-19 crisis. Second, we need to invest in regional infrastructure to support growth post COVID. This means great internet, reliable phone services, and reliable train services into the cities and bigger centres. Crucial is support of our rural local governments, many of whom are working to deliver more with less from a diminishing ratepayer base and federal assistance grant funding that is 0.55 per cent of what it was in 1996. Restoring the value of financial assistance grant funding to one per cent of Commonwealth taxation revenue would go a long way to getting rural councils and their residents the stability they need to thrive beyond this crisis, and nowhere more so that in the bushfire affected communities.

Third, we must invest and promote regional tourism. Alpine Shire, in Indi, lost an estimated $90 million in tourism through the bushfires before COVID even happened. We need to invest in the infrastructure of these attractions to bring tourists back once this is over. Fourth, we need to diversify our local industries, especially by producing and buying local. The fires burned through over 6,000 hectares of softwood plantations in Indi, threatening harvesting, haulage and manufacturing jobs in Benalla, Myrtleford and beyond. We have multiple local manufacturers across Indi, in industries as diverse as food manufacturing, steel fabrication, textiles and defence, to name but some. If these workers are to have jobs into the future, we need an innovative industrial strategy in this country, one that harnesses the potential of regional Australia once COVID-19 is past.

Fifth, we need targeted support for the arts sector. The arts employ around 2,100 people in Indi. These are the people who teach our kids to play the piano and dance; it's the bands that perform in local pubs; it's the artists who perform at the HotHouse Theatre. They're being left behind. In the wake of the bushfires, the town of Bright saw something none of us thought we would see: Katy Perry came to town to perform a special concert. Many people have told me how that concert was such an important moment for the community—a night of relief and coming together after a dark time, which helped create a positive energy that the community so badly needed. This is what the arts can do, and we will need more of that once this crisis is over.

Finally, we need accelerated deployment of bushfire funding. The fires were almost six months ago, and many are still waiting on support. This is just not good enough. In Indi, 19 people have applied for bushfire related concessional loans, but none of them have been approved. This application number should be higher, but many people have told me that the process to apply is just too cumbersome and confusing, and with COVID on top of this they just don't know that they have the energy to do it. Six months after the fires, 254 small business support grants have been paid out, but another 84 small businesses are still waiting. These grants are only available to businesses in Alpine and Towong shires. I've been lobbying since the grants were announced for them to be extended to Indigo, Wangaratta, Wodonga and Mansfield shires, all of which were affected by bushfires, especially Indigo, trapped as it was between the Towong and Alpine blazes. Why these LGAs were not included initially is beyond me, and why we are six months down the track and waiting for the Commonwealth and Victorian governments to sort this out is completely perplexing. All up, $12.5 million of grants have come through, when in fact the damage from the fires is in the hundreds of millions. I welcome the government's latest announcement this week, but I will not rest until the bushfire communities—hit twice, by bushfire and COVID—are back on their feet again.

I've written to the Treasurer and to the Victorian government outlining these six practical actions that they could take to better support our regional economy. As we debate the role of this app in supporting the reopening of our economy, it's important that we recognise that there is, indeed, so much work to do beyond the app.

I would like to make one last comment. It is about trust. With this app, the government is asking Australians to trust it. With this app, our ability to reopen our economy depends on the extent that Australians trust their government to get it right. With this app—one tool in our public health response armoury—our ability to literally save lives depends on the extent that Australians trust their government. Yet we come off the back of a drastic collapse in trust in government and democracy. The ANU election study last year found that Australians' satisfaction with democracy is at its lowest since the constitutional crisis in the 1970s. Just 59 per cent of Australians are satisfied with how democracy is working, and just 12 per cent of people think that government is run for all Australians.

That's hardly surprising, because for years some politicians have given us reason to distrust them. Let's remember that the biggest story before COVID-19 washed it from the headlines was sports rorts. Since I was elected I've been talking about the pressing need to restore integrity to our democratic institutions and to regain trust from the Australian people. That was never just an academic exercise. This was always about ensuring that when Australian governments need to take significant policy reform, or take the extraordinary actions that governments sometimes must, they have the necessary trust from the Australian people to do so.

Legislating a robust federal integrity commission is a critical step to restore trust, yet the government has missed its own deadline of last December to release the legislation. In this time of crisis, they've realised now how important trust really is. Everyday Australians have played their part throughout this crisis, and I ask the government to play its part now too and release this legislation.

In supporting the legislation for the app, I'm essentially asking Australians to put their faith in a government that has not always shown that it deserves it. In supporting the bill I'm also calling on the government to introduce the legislation for a federal integrity commission to show Australians that they are worthy of this trust. That commission must be robust. In February I outlined the Beechworth principles—five characteristics of any integrity commission worth its name. They call on the federal integrity commission to have broad jurisdiction, to have one set of rules for everybody, to have appropriate powers to do its job, to hold fair hearings and to be accountable to the parliament. If the government's integrity commission is to restore the trust of the Australian people, I believe it must meet these five Beechworth principles. I'm committed to working with all MPs to ensure it does. Today I support this legislation on the app, but I do so with a call that we support the Australian people in restoring trust to our democracy.

5:45 pm

Photo of Zali SteggallZali Steggall (Warringah, Independent) Share this | | Hansard source

I rise to speak on the Privacy Amendment (Public Health Contact Information) Bill 2020 to facilitate the correct handling of the data collected through the COVIDSafe app. I commend the government on the legislation presented and its willingness to embrace the amendments and the concerns that have been raised, in particular by the Law Council of Australia.

I do have concerns about the messaging that the government has deployed to encourage people to download it and people's understanding of what it is and how it works. The app is not like sunscreen. It will not protect you. It's not a warning beacon. It won't keep you away from a person or a risk of contamination. My biggest concern is that having downloaded the app people will get complacent about the most important measures that they need to take, which are to maintain their physical distancing, maintain awareness of their health and maintain good hand hygiene.

The app is simply a tool to work out who you may have come into contact with after someone has been tested. It helps the Department of Health officials with contact tracing. Once someone has tested positive to COVID-19 health officials will request permission to download the data from the app on the user's phone. The health official will then use that data to contact those people who have been within 1.5 meters of that positive case for more than 15 minutes. If you're a person who keeps a diary and you can keep a very clear and precise account of who you might have been in contact with, or it's been so little that you're not concerned, this is probably not aimed at you. But for those who may resume taking public transport, resume at places of work where there will be numerous people, this will be an important way of being able to contact strangers—people you may not have been aware of but who will have been within 1.5 meters for a period of 15 minutes. But we need to be clear. It's not a silver bullet. You don't get an alert. You're not warned. It's retrospective. You must maintain your distance and you must maintain that good hygiene.

The legal protections have been a big part of the discussion about the app. This bill addresses many of those concerns that were raised by the privacy impacts assessment and stakeholders, including the Law Council of Australia. The biosecurity determination raised some concerns. The bill clarifies the role of the Privacy Commissioner and confers powers to the commissioner in the interactions with states and territories. It imposes specific obligations on the data administrator regarding deletion of data, which requires the government to delete the data as soon as possible. It prohibits the use and disclosure of data collected by the app and coercion of other persons to use the app. For example, no-one can be forced to download it to resume their employment or attend certain premises. It prohibits the creating and using of derivative data from data that can be collected by the app and reverse engineering or re-identifying data that has been de-identified.

There are some remaining concerns expressed by the Law Council of Australia and I do share those concerns. These are that the legislation should prescribe minimum design specifications for the app and the data store themselves; that the app must operate on a strictly voluntary basis at all times with mechanisms for users to opt-out; and that streamlined arrangements to manage the interaction of investigations by the Privacy Commissioner with law enforcement investigations of offences for breaching the prohibitions on the use of data, under which the commissioner is not obliged to discontinue investigations.

A lot of people are very confused about the app. The technical aspects are interesting. I've spoken with data security experts, including Fergus Hanson from ASPI, and I'm pleased that the government has implemented various security and privacy arrangements into the technical design. These include that the app works on bluetooth via a digital handshake when you come within 1.5 meters of someone for a period of 15 minutes. It does not require your GPS or any other location sensing data to be turned on.Like playing your speaker—for example, if you're playing music—the closer you are, that 1.5 meter distance, is about where the signal will be strongest. The app records the time and the unique ID of the other apps around. This unique ID changes every two hours to help prevent passive tracking by other applications and this is a concern that's been raised by many constituents. The unique ID data is saved on the phone and it's an important privacy feature. All the data is stored on your phone, not a centralised database.

The app works on a consent based model. So if you are confirmed as a COVID positive case you will be asked for permission to access the contact list on your device. If you grant permission the data will then be uploaded to a secure government server managed by Amazon Web Services and located here in Australia. Health officials will use that data to assist contact tracing.

I do remain concerned with the functionality of the app on certain phones, in particular iPhones, and older phones. The security settings built into iPhone operating systems prevent bluetooth from conducting the handshake effectively when running in the background. So for the app to work effectively the iPhone needs to be unlocked and the app needs to be running in the foreground without too many other bluetooth enabled apps running at the same time. This is a common problem that all governments have faced in the development of similar tracing apps. The government has an obligation to be truthful with the public about the functionalities of the app and its limitations.

I do support the recent comments by various tech industry professionals that we should understand that the app and supporting regulation has been commissioned as a matter of urgency, therefore, it will be imperfect at an early stage of release and it will need to be improved upon. I urge the government to continue modifying and rectifying issues as they arise. There's no doubt though that as many people have wrestled with whether or not they are comfortable with downloading the app trust in government has been a big part. It's been a moral quandary for many individuals, sometimes within same households.

Since the terrorist attacks on the World Trade Centre on 11 September 2001 data incursion has been pushed by government in the name of national security. As a result, Australians have seen a gradual erosion of their privacy and a rise of scepticism. Similarly, with the advent of social media and smartphones, tech companies are using data in the name of profiteering. Here users are asked to sacrifice their privacy to improve their experience and convenience. These developments have all been against the backdrop of a steady decline in trust in government, caused in part by regular scandals; the rushing through of the metadata retention laws in 2015 and the subsequent expansion of access under those laws; and the controversial My Health Record service. Lack of trust in the government and the lack of transparency of government are major hurdles for all those who have not yet downloaded the app. Government should show goodwill by urgently putting forward legislation in relation to a national integrity commission with real powers. This was promised at the end of 2019. It's still not before the House, yet we've seen a number of pieces of legislation brought here with urgency because the situation demanded it. It shows that, clearly, where there's a will, there's a way. There should be no further delay in introducing the legislation to ensure a national integrity commission with teeth, so that Australians can have confidence that there is accountancy and transparency in government.

Most recently—and yet again, in the press—the sports rorts scandal has reinforced that lack of trust in government. The recent revelations that there may in fact have been authorisation by the Prime Minister's office in relation to that sports expenditure, raise a really concerning inference that there may have been a misleading of the House in terms of responses. The very fabric of democracy is undermined if we can't trust what is said in this place. To that end, it is now more important than ever to form a national integrity commission and restore trust in the integrity of governments and transparency in governance. We've seen it in the very response to this crisis. We've seen the government establish the National COVID-19 Coordination Commission. There was certainly no promoting or advertising its creation or its content, the people on it or its agenda. There is no transparency in relation to its principles or its priorities. There is no accountability and no reporting mechanism. It's a clear lack of transparency. I note that, in fact, there will be an appearance before the Senate committee tomorrow by the National COVID-19 Coordination Commission members. I welcome hearing some of those answers. It's that lack of transparency that undermines trust in things like the app because, in a response to a crisis like this, it is so important that party politics be put aside and that everyone in this place come together to find solutions for the many Australians who are suffering through this crisis. Restoring that trust is absolutely vital.

This app is mostly aimed at our younger generation. I think it's fair to say that our older generations are very cautious in their public interactions. If there is a lifting of restrictions, they are very focused on who they have contact with and maintaining social distancing. But the greater concern, as our younger people head back out into the community and are involved with and are in contact with more people, is that they download the app. So the government is asking for trust from our young people. I would argue that they are the very people that have been left last on the list of considerations by the government, so I would urge the government to think about putting in place more supporting measures for our young people, for all those on casual contracts who are not receiving assistance under the current packages. We have a generation that is facing so many challenges. They are deeply concerned about the impacts of climate change and of so many issues that are impacting around the world. They are deeply concerned about the debt that is being incurred and the economic crisis that is coming from this health crisis. They are the generation that will have to bear it on their shoulders. They will have to work hard, and they deserve this government's attention to give them hope and to give them a sense that they are very much at the centre of the focus of this government. If the government can give them that faith, trust, courage and the hope that they are a priority, I believe that they will turn around and be all the more supportive of this app, and they will trust the government when it comes to their privacy and download the app and play their part.

So it's important for all those who have been hesitant to download the app to date to make an informed decision. It is a part each and every one of us can play. It's important that you take that responsibility seriously and it is important you all do your bit. But, mostly, remember: it is not a solution; it is just another tool. So please maintain your physical distancing, maintain your hygiene and your social-distancing measures, get tested if you have any health concerns, and stay informed.

5:57 pm

Photo of Ed HusicEd Husic (Chifley, Australian Labor Party) Share this | | Hansard source

I sometimes feel that, in the discussion around these elements of the nation's response to COVID-19, if at any point we do raise matters that are contrary or critical, then in some way we are considered treasonous or not supportive of the national effort in responding to this pandemic. Nothing could be further from the truth. The reality is that, where there is a call for national unity, we do want to be able to act in a way that delivers it. I note that, a number of times, people within the opposition have used the term 'constructive', and we have been constructive, by and large. But being constructive does not require us to be mute. It does require us to look, in a very objective way, at some of the things that are being proposed. And, where we believe recommendations or changes should be made, they should be put forward. There have been elements, where I am aware that both the shadow minister for health and the shadow attorney-general have put forward ideas with respect to elements of the privacy amendment bill. These changes are being made to this legislation. And, within the context of the COVIDSafe app, a number of times we have made the point that we support the app. Apparently this is the threshold requirement for any discussion around this matter—that, in some way, if we are critical of the app, we're not supportive of it.

We do want this app. We do recognise that the app has a role to play, as has been expressed by a number of speakers in this debate. I note in particular the contribution by the member for Indi, saying that we want to see this work—and also to pick up on the point made by the member for Gellibrand—because as a community we will be safer. In the case of what the member for Indi spelt out, in her community, like many others, the economic impact can be lessened. I totally get that as well. But I have been frustrated, in the context of the discussion around the app, about the government's preference for headlines over hard yards, where we have wanted them to actually get a few things done right in respect of this.

It is not enough for the government to say, 'Trust us' and then appeal to the community to just download the app en masse without having done the homework. In a number of cases it took quite a bit of time for this legislation to be released, despite the commitment made that it would be released promptly. We had a biosecurity determination put in place as a mechanism to deliver a certain level of protections, but it took time for that to happen. We were told that the source code, the building blocks—in effect the language that's used by the app to determine what is done and what isn't done—would be released. Then we were told that it would take a couple of weeks for it to be released. And now, from what I'm led to believe, the source code has been released, but it's not open source, so there are some hurdles in being able to obtain that.

There is another thing that has concerned Australians. The five billion Australians who have downloaded the app have done that on the basis of trusting the government to get this right. As I described earlier, a target was set in relation to this app, and then there was a walkaway from that target. We don't know whether 30 per cent, 40 per cent or 50 per cent of smartphone users would be required to hold onto this app. It's almost like attaching the target to a chocolate wheel and spinning it and at some point we'll reach what they need. We should have something definite from the government as to what is required in terms of the number of downloads—a target that is required to ensure public safety—and then do the things that will build trust.

One of the things I've been deeply concerned about is the awarding of the contract for the data storage to an overseas multinational, Amazon Web Services. Now, Amazon Web Services is a great company—no doubt. They have supported a lot of innovation, and a lot of effort online has been as a result of their offering. I'm absolutely in support of that. But, having said that, when Microsoft first got access to government data through its cloud services offering I was critical of that in this place. I also forewarned to Amazon and to Google that I would have the same view, because there are capable, competent cloud services providers that are Australian based, that are Australian generated and that have been vetted by government and can do this work. You need only go to the government's own websites that list half a dozen cloud services providers that have been vetted as being able to securely manage data in this country. Of that protected list, two of them are overseas multinationals: Amazon and Microsoft. The four others—NTT Australia, Sliced Tech, Macquarie Telecom and Vault—were overlooked by this government in its rush to provide the contract for COVIDSafe to Amazon Web Services.

Again, Amazon Web Services do work in my electorate and have supported community groups in my electorate, for which I've been enormously grateful. But I will not, as a parliamentarian, turn a blind eye to the requirement that we speak in the national interest where it's appropriate. And a lot of Australians have been concerned that an overseas multinational has been given carriage of this element of the COVIDSafe app, even though the government has said that it will be stored here and have tried to build an assurance to the Australian public that the data is safe. Even today in the Financial Review the head of AWS in Australia could not guarantee that foreign nationals would be prevented entirely from being able to access any of the data generated by the COVIDSafe app in the national data storage arrangements. They themselves have admitted that and have contradicted the Attorney-General's Department, which tried to give us an assurance contrary to this.

This could easily have been avoided if one of the accredited, certified cloud services providers was given that element of the contract. There are a lot of Australians who do take their privacy seriously. They should not have parliamentarians look down their noses at them about their desire to have their data protected, very securely, and about also wanting to see Australian firms being able to do this work if they're capable of doing so. My firm view is that the AWS contract should be taken away from AWS and provided to one of the providers that is on that protected list and is Australian based to build stronger confidence in the way that this app is managed and not just have five million Australians downloading this app, but many more. And we should, as a demonstration of good faith for the five million who did download this app, demonstrate that we take their privacy and their concerns seriously and that this data being managed by an Australian company on Australian soil should be taken seriously.

I'm not asking for us to cut corners. I'm not asking for us to create a lower standard for those companies—not by any stretch of the imagination. And I'm not being protectionist in expanding or extending to this parliament the argument that I'm making right now. As I said earlier and as I emphasise, the Australian firms have been asked by government whether or not they are capable of securely holding and managing sensitive government data. And they have met the government's expectations. They have shown that they are capable of doing this.

You cannot have an industry minister, in the middle of this pandemic, when reconsidering the impact on global supply chains, talking about the impact on Australian industry and the need for us to rethink the way we do business in this country to support Australian industry and then have another minister make a decision that is quite contrary to Australian industry, where that industry is capable of doing the job. I speak on behalf of not just the firms but the tech talent in this country that are quite capable of supporting and developing the app and of ensuring that the data is stored absolutely capably and securely and to the needs and expectations of not only the government but the public. I speak on behalf of those workers, the thousands of them across the country, the thousands that might even live in the member for Warringah's seat as well, as I know they live in my seat and the member for Gorton's seat. In all parts of the country, tech workers, more and more, are supporting these operations, be it within government, business or even the community sector, and would expect that their government would back Australian firms where they are capable of doing the work of managing sensitive data. They were absolutely ignored by this government.

What's interesting is that the public cloud offerings that were extended by Microsoft and Amazon to the Australian government, the US government would not accept. They would expect a higher standard of security and storage of data. So the US government would not accept a US firm offering, but the Australian government has. This is my issue with the way that the cloud services providers in this country have been shabbily treated by a government that reckons it looks after Australian firms but doesn't. This is why we've raised this issue in the substantive amendment that's been moved by the shadow Attorney-General.

The other thing is this—and I've raised this with parliamentarians: I am aware of the fact that the Australian Signals Directorate did an assessment on the security of Australian data on overseas servers. There is a quote going around, and I challenge the Minister for Government Services, the Attorney-General or the Minister for Home Affairs to tell me whether or not this is right—and I'm happy to be proven wrong on this. There is a quote going around about the overseas cloud services providers: 'There is still a risk that foreign nationals may be able to gain limited access to Australian government data.' This is why it's a serious issue. The Australian Signals Directorate has made those assessments about overseas multinationals providing public cloud services for the storage of sensitive Australian government data. The government recognises this as an issue. Even having done that assessment in the last 12 to 18 months, it has still provided a major contract to an overseas multinational to do this work. It's just wrong. This is the point I make: this government could generate massive confidence in this app by addressing the concerns of a sizeable part of the Australian public that do not like the fact that Amazon Web Services got this contract and that did react publicly to that. Their view should be represented in this chamber.

There are even simple things with the way that the app works—or doesn't work, I might add. I would make this observation. There are still older phones that are not capable of running the app. The issue of the iPhone has been well ventilated by the member for Gellibrand. The other issue, too, that people are worried about is power usage on the app. I think the member for Warringah observed that younger people might be a bit more au fait in using this app than older people. But even if you follow the advice of the app that says, 'Apply the power saver mode in the app,' if you go into the app itself to try to find that it's not there. If I then, for example, go into the battery option in settings on the iPhone, it's not there. If I then go into the app itself within the general settings of the iPhone and look at the app settings for the COVIDSafe app as to how to apply the power saver mode, it's not there. Now, it could be there. I'm not saying I'm a tech expert, by any stretch of the imagination. But make it easier for the general public who are not necessarily au fait with these things to be able to apply and use the app. It's these simple steps that have been made a lot more difficult and torturous to navigate in part, to use that dramatic phrase, that could easily be sorted out and should be sorted out with a mentality that is collaborative. That's what happens in the tech sector.

The member for Gellibrand rightly pointed out, for example, that acknowledging vulnerabilities in the app is not an admission of failure. I take on board some of the other points that were raised on the app. Yes, there will be problems. Yes, it will be buggy. Yes, it will need to be updated—absolutely. The government should embrace that if there is a problem with the app that they need to be a lot more forthcoming in acknowledging those problems and they need to respond to them more quickly than the time frame that the member for Gellibrand outlined earlier, where it took eight days for some problems to even get recognised when some in the tech community raised them. The quicker we address them, the more solid the app. The more confidence built in it, the greater usage by the Australian public. I then go back to the point that was rightly raised by the member for Indi: the more we get this used and the more we can track these issues the quicker we can raise the restrictions and the better our local communities and the nation will be as a result.

6:13 pm

Photo of Kate ThwaitesKate Thwaites (Jagajaga, Australian Labor Party) Share this | | Hansard source

It is important that we have this debate in this space, because the COVIDSafe app has the potential to be a valuable tool in helping to manage the spread of the coronavirus. It gives public health officials another means to do contact tracing, particularly when people start moving around more. Of course, to do that the app has to be effective in how it operates and Australians have to have confidence in it and they have to believe that the government has made the right decisions when it comes to their privacy. We're starting here from a base where many Australians are sceptical about the government when it comes to trust and particularly when it comes to trusting government with technological solutions. They do have hesitation in sharing information with government. So this legislation, the Privacy Amendment (Public Health Contact Information) Bill 2020, is an important step in building some public confidence in the app and hopefully reassuring more people such that they'll download it.

As the centre of this crisis, Labor has sought to work in good faith with the government to do what is needed to keep people safe. So it is important for me to acknowledge that the government has engaged constructively with Labor on this legislation and that since the draft was released that the government has accepted a number of suggestions Labor has made to improve this legislation. That's a positive thing that we have been able to work together to make this legislation and the privacy in this legislation stronger. It is also important that reviewing this app and the privacy concerns will be part of the work that the Senate Select Committee on COVID-19 does because, again, this goes to trust in government and trust in its actions during this crisis. That trust will continue to be an integral part of helping us to navigate this crisis.

It's for that reason that I take this opportunity to call on the government to reconsider its suspension of parliament until August. Trust matters, and oversight and scrutiny are part of what builds trust. All of us here have been elected by our communities to come to this place and to represent them, and in a time of crisis that is more important than ever. So it's important that we have the chance to discuss this legislation today and that we have the chance to discuss legislation in the future. I urge the government to make sure that we come back to be able to do that before August.

Despite the work that this legislation does to support privacy, we know that community members and experts continue to have some privacy concerns. As we heard from the member for Chifley, there are concerns around how the data is being warehoused overseas and what that might mean as well as concerns around the way the government has maybe not taken on board as much outside expertise as it should have when it comes to looking at the source code and possible flaws in it. There do also remain concerns about how the app works and whether it is as effective as it should be. And, as someone representing an electorate with a number of older residents, I am particularly concerned that the app doesn't work on older Android phones. I've had a number of older residents contact my office, feeling very scared because they can't download the app onto their phone.

For those who have managed to download the app but who are perhaps less tech-savvy than some of us, they're really confused about what the app actually does. People have contacted my office very stressed about why they're getting push notifications and whether that's the app trying to tell them that they've actually got COVID-19. Some have been under the misunderstanding that the app will protect them from getting COVID-19 by sending them an alert when they're near someone who's got the virus so they can make a quick exit. This misunderstanding has the potential to affect people's behaviour in public. They may undertake more risky behaviour because they think they're going to get a ping telling them to run. It also has the potential to undermine trust in the app. When people realise this is not how it operates they are going to be less likely to use it. So I really urge the government to consider how they're talking about the app, how they're communicating with the public about the purpose of this—that it's for contact tracing, that it doesn't give them a magical shield that will protect them and that it's not sunscreen but something that will help them find people who they've been around. I think that's really important. Perhaps a public information campaign could also support that.

I know that people in my electorate want to get out and about. They need to get back to work. Too many of them are still falling through the cracks; they're struggling. They need this app to work, so they need to have trust. I commend the government for bringing this legislation. I ask them to do all they can to make sure the app is as effective as possible.

6:18 pm

Photo of Graham PerrettGraham Perrett (Moreton, Australian Labor Party, Shadow Assistant Minister for Education and Training) Share this | | Hansard source

I rise to speak on the Privacy Amendment (Public Health Contact Information) Bill 2020. This is legislation that protects the privacy of data that is volunteered by people who voluntarily download the COVIDSafe app. Obviously, these are extraordinary times. Right now in several overseas countries there are fleets of drones monitoring neighbourhoods to check the compliance of citizens with the social-distancing restrictions imposed by their governments. This sounds like something out of a sci-fi movie, but sadly this is the world that we live in in 2020 and the world as it will be for a very long time.

There is no denying the importance of containing the spread of COVID-19. It's a very dangerous disease that has now caused the death of more than 100 Australians and more than 283,000 people worldwide, and these numbers will continue to rise. On International Nurses Day I particularly mention the nurses who've been involved in helping people but also those nurses who've given their lives whilst caring for people around the world.

Restrictions on people's liberties have been applied across the world to contain the spread of the virus—individual rights sacrificed for the safety of the herd. The International Center for Not-for-Profit Law has launched the COVID-19 Civic Freedom Tracker to track what measures are being imposed by countries around the world. As of today, 84 countries have emergency declarations in place; 30 countries have measures which affect expression; and 111 countries have imposed measures that affect assembly. So balancing human rights is always a difficult task. Obviously, there is a legitimate need to contain our movements to stop the virus spreading. It is important to ensure that everyone is given accurate information explaining the why, and measures to keep people safe should always be seriously considered. However, history has taught us that often when governments gain new powers they are usually reluctant to give them back and never do so quickly. A robust democracy is more important in times of crisis than at any other time.

The opposition should not be condemned for questioning the coalition government about any measures they impose. We can't ask Australians to make sacrifices and then have a government that doesn't bring them into their confidences. It is the job of opposition to hold governments to account. To paraphrase the member for Rankin today in his speech in response to the Treasurer: it might be the Labor Party that the government wants, but it is not the opposition that the nation needs. It is more important than ever that we continue to question, call out inconsistencies and demand explanations about how our economy, our community and our human rights will be protected after this crisis is over because it will be a changed Australia and a changed world.

Labor has consistently supported the concept of a tracing app. We know that a tracing app can be a critical tool in the COVID-19 exit strategy, but equally we know that we have to get the balance right. We've heard many speeches tonight detailing some of the technical and more complicated issues associated with the COVIDSafe app. The government launched the COVIDSafe app just a few weeks ago and said that we would need to get to 40 per cent of Australians, or 10 million Australians, and so far there have been more than five million downloads of the app.

The purpose of the legislation before the House that we're debating right now is to protect data collected by the COVIDSafe app. Before I talk about the privacy protections because that was what I was most concerned about, it is important to understand how the COVIDSafe app collects the data and what data it collects. Firstly, the app only works on smartphones and the smartphone must have a compatible operating system. As we've heard from previous speakers, many people do not have phones that are compatible, particularly some elderly Australians who've been contacting my office most concerned. If the app is open and running on a person's smartphone, the app will use the phone's bluetooth capability to seek out the bluetooth signals from other smartphones that have downloaded the app and have it also open and running. Where a smartphone running the app detects another smartphone running the app, each smartphone will create a digital handshake and store this on the individual smartphones as an encrypted file. The smartphone's ability to detect and store this digital handshake will be optimum when the smartphone is unlocked—and that is not necessarily how most people carry their phones.

The only data stored on the phone from the digital handshake is that the user of the downloaded COVIDSafe app was in contact with another user of the COVIDSafe app; the unique ID of the other user of the COVIDSafe app; the strength of the bluetooth signal during the digital handshake; and the date and time of the digital handshake. The smartphone will continue to create a digital handshake with the other user of the COVIDSafe app every minute that it remains within bluetooth proximity. The encrypted digital handshake will be stored on the smartphone for a period of 21 days before it is automatically deleted.

We know that there have been issues with this app since it was released a few weeks ago. My electorate office has had many calls, including today, from people who are willing but unable to download the app. Sometimes it's because their phones are not compatible due to the age of the phone. Many of them have been elderly people. Unfortunately, they're also the people most at risk should they contract COVID-19. These people perhaps are not in a circumstance where they can rush out and buy a new phone. Some people have been unable to download it for reasons that we just couldn't track down in our interactions with them. All of these constituents were distressed that they could not access something that they believed was going to keep them safer from this awful virus. Some of them misunderstood the app but nevertheless were anxious because of it.

We also know that there are other important technical issues yet to be solved in the operation of this app. As stated by other speakers, particularly the member for Chifley, I'm disappointed that the Australian government chose not to work closely with the Australian tech sector in developing aspects of this. I suggest that that would have been good for employment. We've certainly had information presented that they were capable of responding to it, rather than having to go overseas for everything.

With the member for Grey, I'm a co-chair of the Parliamentary Friends of Diabetes—or the enemies of diabetes! Unfortunately, Diabetes Australia, the peak body, has had to warn people with diabetes who have downloaded the COVIDSafe app that it may interfere with their lifesaving continuous glucose monitoring apps. People with diabetes, people who have that comorbidity, are perhaps more at risk from COVID-19. This is not good enough. I'm speaking up for people with diabetes.

Since the beginning of this health crisis, Labor has sought to work constructively and in good faith with the government to ensure that Australians are kept safe during this health emergency. Our working with the government on this legislation is an example of that cooperative approach. The shadow Attorney-General, in his speech in response, spoke very highly of working with the Attorney-General, Mr Porter, in terms of working out this legislation. Labor made some suggestions for improving this bill. I'm very pleased that the government took heed of those suggestions and included some in the legislation that we are now debating.

I've talked a bit about the app itself. The most important details about this app are not how the app collects information, not where the information is stored and not how long the information will be stored for. The most important characteristic of this app is how much confidence the public has in its use. So far five million people have downloaded the app and, as has been stated on a list, I am not one of those people as yet. That's not the 40 per cent of the population that the government said we need to make it an effective process. Unless the public have confidence that the app will work consistently and that their data and privacy will be protected, they won't use it. Unless their smartphone can download the app, they can't use it. Unless the app does not interfere with other even more important apps on their phone, such as for diabetes, they can't use it. To state the obvious: if the app is not used, it's not going to do much to stop the spread of COVID-19.

Assuring Australians that their data and privacy will be protected is crucial in gaining public confidence in the app. This bill protects the collection, use and disclosure of information collected by the app, except in a number of prescribed circumstances. Its intention is for contact tracing. The bill creates offences for other unauthorised use of the data. Importantly, the bill contains an override provision in relation to other laws. A warrant obtained by a law enforcement agency for access to COVIDSafe data cannot override the prohibition on access to that data. I will stress that again for the lawyers out there: a warrant obtained by a law enforcement agency cannot override that prohibition on accessing the data. And data collected by the app will not be admissible in any court proceedings.

This is a stronger piece of legislation now that the opposition has had some input into it. We still need to be vigilant and to keep an eye on how these measures will protect the data and privacy of those using the app. Unfortunately, there are some ministers in the Morrison government that I wouldn't trust to feed my goldfish. And I only have one goldfish, so I can't test which ones are competent. I'm not sure if anyone was suggesting they wanted to nominate to feed my goldfish there, but let's hope that the government gets this COVIDSafe app right and that the public does have confidence in it. I'm reassured enough that I will now download the COVIDSafe app—I do have confidence in that process now.

Obviously, sorting out the power save mode and some of the other concerns that have been raised by speakers in the chamber during the debate will, hopefully, make it a more effective process. I call on the government to improve that public confidence in the app by addressing the many technical concerns that have been raised by members of parliament, and by Australians—especially those in my electorate of Moreton—and I commend this privacy legislation to the House.

6:29 pm

Photo of Adam BandtAdam Bandt (Melbourne, Australian Greens) Share this | | Hansard source

This Privacy Amendment (Public Health Contact Information) Bill 2020, hopefully, represents a culture shift within the government on how they approach the privacy of Australian citizens.

We have come a long way in a very short time. Just last year, this House was presented with some of the most oppressive and threatening laws to privacy through the government's encryption legislation. Not only was the government's encryption bill a tremendous invasion into people's privacy but it also threatened the viability of IT companies and startups operating in Australia. The Greens were the sole party in this place opposed to that legislation. We worked closely with stakeholders and the tech community to push privacy priorities so that they are no longer treated simply as an annoying inconvenience by the government.

Today, in this bill, we see the culmination of this hard work and hard-fought campaigning by the digital and legal community alongside the Greens. The government has listened to most of the privacy concerns that seem to have been adopted in the development of the COVID-tracing app. We continue, though, to have some concerns on this bill and we'll be moving amendments in the Senate to improve the legislation. But many of our concerns have been addressed. Our amendments—to foreshadow them—could include an explicit sunset clause on app and data use and retention so that they can't be used for any non-COVID-related purpose. We also want to see some reporting obligations, with the reports tabled in parliament, and we also want to see some enforceable prohibitions on derivative and re-identified data that is derived from the app.

We also remain deeply concerned about the ambiguities of how this intersects with US law, and whether Amazon, as the successful contractor, has duties and obligations to a foreign government that are at odds with the interests of Australian citizens. In this morning's Financial Review, the Australian head of Amazon basically conceded that if the US government wants our data from the COVIDSafe app then they can have it. Now, this is quite different to assurances that were provided to the Greens by the government during briefings that we were relying on in the lead-up to the rollout of the app. The Law Council of Australia has called on the government to expedite an executive agreement with the United States government, under the US CLOUD Act, to minimise the risk that any data obtained will be able to be accessed by US authorities. The Greens reinforce the Law Council's caution, and we will continue to pursue this point while the app is operating.

In any case, it is incredibly disappointing that the Morrison government has put its citizens in this situation by contracting a US firm to hold the personal data of millions of Australian citizens without having ensured the protection first. I repeat: when the Australian head of Amazon basically says that they may be powerless, and may be required to hand over the data to the US government if the US government wants it, then that is something that should be of concern, and that is something that the government should have sorted out before it contracted them.

With this information out today, the Greens still remain cautious and sceptical about this whole process. But it is important to note that this bill is not about the rollout of the app, which has been done by regulation. It's about putting in place a framework of privacy protections. This bill will improve the operation of the COVIDSafe app, so the Greens are not in the position of opposing this bill—despite having reservations about matters external to the legislation. I will just repeat that: this bill doesn't enable the app; the app is there under separate powers. This bill puts some protections around it and, even though we would say those protections don't go as far as they should, nonetheless those protections are better than no protections and therefore we are not in a position to oppose the bill.

But that brings us to the app itself. It may be a useful tool, to some extent, if deployed and used properly, but it's not going to be a silver bullet to our challenges. There are many more important things that we all need to be doing, such as maintaining social distancing, continuing to invest in the people who do the contact tracing and continuing to prepare our public health system. In the medium term, it's going to be critical that the government ensures that any vaccine that is invented is able to be manufactured here in Australia. I know that CSIRO and CSL have some capacity, but the government needs to be ready to put public resources into ramping up any vaccine manufacturing and to ensure that a vaccine is freely available to all. That's because if we rely on Donald Trump to give us the vaccine we are going to be at the back of the queue.

While this app does have the potential to help our public response, on a personal level I have to date been reticent to download it—given the government's atrocious record on privacy. We have recent examples where ministers of the Crown have leaked personal information relating to private health records or Centrelink income records in order to humiliate someone in the pursuit of a political advantage. Just to underscore this: the concerns that people in the community have had about handing over information to the government, that the government or governments are able to access, are not necessarily misplaced concerns, because when you see government ministers who have abused their positions to get personal information that people have provided to the government in the form of Centrelink or health records, and then those find their way out into the media so that the government can get a political hit, then you understand why people are concerned. Basically, this government has spent all of its term undermining the trust that Australian citizens can have in government.

Now, more than ever, we need trust in our public authorities in order to guide us through this crisis. But this government has done everything it possibly can to undermine that trust. And so the government comes to this from a place of trust deficit, and it has to address that. It cannot criticise people who want to ask questions about the use of this data and about their privacy, because this government has systematically abused that trust over many, many years. It's this abuse of power by the government that the Greens are so vigilant to guard against, and it's why we take our votes on legislation like this so seriously.

Personally, I've come to the view that, as far as I'm concerned, because of the gravity of the health threat and because we've been able to secure some privacy protections, I'll feel comfortable enough to have the COVID-tracing app downloaded on my phone and used to assist the public health response. But, again, I caution the government that for the people who have a question mark about whether they'll do the same it's not because those people are somehow wrong or that those people have misplaced concerns; it's because this government has done everything it can to undermine trust and to undermine protections around privacy, and so the government is now reaping what it has its own. If the government wants more people to download and use the app then it should have a look at what it has done to undermine trust and it should have a look at what it has done to undermine privacy. As I said at the start of this speech, perhaps this is the beginning of a new government approach to privacy and one of the things that could be done now is perhaps go back and revisit the metadata laws and encryption laws. If this level of privacy and protection is warranted for this then perhaps it is warranted in other instances as well. It might be a good time to start putting people's privacy first.

The Greens will always stand up for the privacy of all Australians. I'm proud of the role that we played in forcing the government to the table on privacy and ensuring that the protections are there as the app is rolled out. We'll continue to monitor the progress of this app and push for more action to protect privacy. We'll also continue to push for a response that is led by the advice of public health experts. It is with grave concern that we're starting to hear now the chimes and calls from the billionaires to say: we all need to snap back to business as usual because we aren't making as much money as before, and wouldn't it be good if some of these restrictions were lifted? Look, no-one likes these restrictions. No-one has said, 'I want these restrictions imposed' because they enjoy it. It is being done to save lives. We should only start lifting these restrictions when the public health experts tell us that it is okay to do so. While there are people saying there is still a risk of a secondary spike of infections until we get the crisis under control and as long as there is a call from the sound body of public health experts advising governments to say, 'Look, we should not follow the path of other countries who've lifted restrictions too early and have then had to manage a second wave of infections,' then the Greens will support that.

It was clear from the beginning that the government had to be dragged kicking and screaming to follow the advice of public health experts. Let's not forget that whilst some state premiers were taking the right step of beginning to put in place restrictions, we had a Prime Minister telling us he was off to the football and a health minister saying it was okay to shake hands. Then, within 24 or 48 hours, they changed their minds on that. It is clear that the government has had to be dragged to a public health first response. We are glad that they have been dragged there by political and health forces who have said that that is the way to go. We are pleased that's the case. I would urge the government now to not treat this app as a silver bullet that is going to all of a sudden allow them to cave into the demands of big business and start lifting the restrictions earlier than the public health experts say is okay to do. Because we need to listen to the health experts first, and if they tell us that the restrictions need to stay for a bit longer to make sure we're safe then that is what we should do. Again, it's not because anyone likes the restrictions; it's because it is saving lives. The Greens will continue to fight for a proper health response that puts health first and an economic recovery that leaves no-one behind.

6:40 pm

Photo of Peta MurphyPeta Murphy (Dunkley, Australian Labor Party) Share this | | Hansard source

I rise to speak on this bill today in the midst of what all would agree is a public health crisis like we've never experienced. It is likely to be a defining time in the lives of many, many Australians. It is a time when we have seen governments, individuals, businesses and community groups all pull together to do what we can to slow the spread of COVID-19.

I stand today on behalf of the community of Dunkley, which has worked incredibly hard to do what we can to not only protect the health and welfare of vulnerable people in our community to stop the spread and deal with the health crisis but also to make sure that the social and economic needs of people aren't forgotten during this time.

The COVIDSafe app, which is the subject of the bill that we're discussing today, is but one measure in a suite of measures that have been and will continue to be really important to deal with this public health crisis. It is not a magic wand. It is not a silver bullet, but it is a very important addition to what we have done already and what we will continue to do.

I want to put on the record how amazing the community of Dunkley has been in stepping up to the plate and following the new and sometimes incredibly difficult social restrictions that we have had to live through. During the last six weeks or so, I have been inundated, as have my colleagues in this place, with queries and calls for help from constituents, many of whom have never contacted a politician before to ask for help, many of whom have experienced fear and anxiety that they'd never experienced before and many of whom have experienced economic stress that not only had they never experienced; they'd never dreamed they would experience it. No-one should say anything other than abiding by the social restrictions has been hard. It's been really hard. Even people who haven't lost their jobs who have got through this period so far, touch wood, without any health or other consequences, have found the distance from family and friends, and the lack of physical intimate contact with those around them in the community really hard to deal with. But we've done it in our community, as have many communities across Australia, because it was really important and continues to be important to save lives. I want to thank each and every person in my community of Dunkley who has done the hard yards in order to do what we can to be part of stopping the spread.

The COVIDSafe app is part of, as I said, a suite of measures that will continue to stop the spread. Labor has taken the approach from day one to be constructive and cooperative with the government, saying, 'We will support measures that are good—measures that help us to help the vulnerable, measures that help us to help our communities. And we won't stand in the way of things that need to be done.' But we're also not here to just wave things through or to say that the government has a blank cheque to do whatever they want. We are here to scrutinise measures. We are here to make constructive, positive suggestions. And that's what we've done with this legislation.

It could've been the case that there could've been a tracing app earlier. We're glad it's happened now. It could have been the case that some of the technical difficulties that are being experienced by people across Australia could have been dealt with before the app was launched. They weren't, but we're here to be constructive about fixing them.

In my opinion, it's not wise to tell Australians that this app is what will protect them from catching coronavirus. We know that there are many vulnerable people in the community who are struggling to use the app properly, whether it be because they are using android phones, which this app doesn't work on, because they're older and don't understand or aren't capable of manipulating the technology, or because they are good, decent Australians who are sceptical about the government because of the actions of this government and others over many years that have eroded their trust. These are the things that the government needs to continue to address to make sure that as many Australians as possible not only download this app and feel confident in using it but also continue to do the other things that need to be done to deal with the public health crisis. It cannot be the case that people hear messages from the Prime Minister and others about this app being what's needed to get the economy back to recovery, or this app being what's needed to stop the spread and that if they have an app on their phone they're immune and they don't need to follow the other rules. That's not the case. We still have a lot of hard work to do socially, in the health area and in the economy, and this app is a part of it.

Like many people in this place, I have downloaded the app, but I understand people who are sceptical and who are anxious about their privacy. I understand people who are concerned about data being stored by international companies. I understand people who are concerned about whether other countries might be able to access their data. I understand people who are concerned about technical problems. I don't put these concerns forward as reasons not to use the app; I put them forward to say that there is more work to be done by this parliament and this government to make sure that Australians genuinely buy into this very important measure. But it is only part of a suite of measures. I'm part of an opposition that is supporting these public health measures but that is making sure that we say, every step along the way: it's not set and forget. It's not the case that we can blithely tell people: this is what you need to do, and you'll be alright. We need to take the Australian public with us, and we need to scrutinise, at all times, how well the rollout of the technology is occurring. I'm one of those Australians that looks at the history of technology that has been rolled out by this government and says that there are reasons to be concerned. We have to make sure that this is not one of those technological disasters. It won't be if we all continue to work constructively, but we also need to do our jobs and identify problems and how to fix them.

I also want to say to my community of Dunkley: we will get through this and we will get through it together. 'Getting through it together' is not just a slogan to us. Politicians can stand up and say those words over and over again, but it means nothing without the community's buy-in and it means nothing without governments putting forward packages to help us get through it together. We will continue to support each other. We will continue to fight whatever crisis comes forward. But we won't do it with blithe slogans. We'll do it with actual plans and actual community connectedness.

6:49 pm

Photo of Susan TemplemanSusan Templeman (Macquarie, Australian Labor Party) Share this | | Hansard source

It is a real privilege to be back here and able to address this place on a piece of legislation, the Privacy Amendment (Public Health Contact Information) Bill 2020, that will hopefully be a key tool in the steps that we're taking towards a new normal, and hopefully it will lead us to a recovery from what has been an extraordinary health challenge and an extraordinary challenge for our economy. I want to speak for my constituents. Like many people in this place, we've experienced calls by the droves from people who are feeling anxious, desperate, unsure, confused, and baffled by what is going on. Some of them are lonely. We've certainly reached out to those people, too.

When it comes to the app, many of them are really keen to download it, to have it on their phone, because it is something they can do that might help make a difference. They include people like Ken from Blaxland and Jeanette, Ros and Eric from right across my electorate. But, unfortunately, they have older phones. They're retired. They don't necessarily have a lot of money lying around to do the latest upgrade. They're really disappointed that the technology isn't able to be supported on their phones and that there isn't a fix for it. They've basically had to accept that they won't be able to be part of a communal effort to help contain and monitor outbreaks of coronavirus as we go forward. In an electorate like mine, in Macquarie, we have a lot of retired people who are very keen to be active members of the community, so it is a real disappointment for those people who have older android phones.

It is also one of the reasons we won't, at this stage, be able to meet the 40 per cent target the government set for mobile phone users—which I note has now been revised down to 40 per cent of smart phone users. Currently, only 20 per cent of the population has uploaded it. There are also technical problems for people running iPhones. Hopefully there will be a fix for them. We come to this place trusting that those things will be progressed by the government, even when we leave this place. So, as a responsible opposition, we're being as constructive as we can about these measures. We're not saying, 'You have a total blank cheque to do what you like,' but we appreciate that we need to be able to support the measures and we trust that this government will not betray our trust or the trust of the community.

There are obviously a lot of people who still don't quite understand what they have to do to make sure the app is running when they're out and about. I would urge the government to have a very strong campaign around that—an education campaign not about downloading it but about how we operate it—otherwise all of us who have downloaded the app, like I did, risk it not doing its job. We obviously believe that a contact tracing app can be a really valuable tool for protecting Australians from the spread of coronavirus, but for it to be a valuable tool not only does it have to work but Australians have to have confidence that there are sufficient safeguards in place so that their privacy is protected. And that's the other group of calls that I've had from people who don't have the highest level of trust in this government to roll out technology.

I'm not going to list the various examples that we have seen that have created a lack of confidence in people, but I want to speak for those people who are concerned about the privacy of their data and really commend the government on working with us to ensure this legislation includes a number of our suggestions and amendments that ensure greater oversight by the Privacy Commissioner and require regular public updates. It is obviously a stronger piece of legislation thanks to collaboration, and isn't that the way we'd like the parliament to work. Of course, we're conscious it can't just be done once and then ignored; it can't be a set and forget. We will urge there to be constructive ongoing engagement between Labor and the government about this.

I guess there's one thing I am disappointed about—that there wasn't the ability to have more public discourse and to allow Australian companies to vie for the data storage contract, which has obviously gone offshore to Amazon. Now, I appreciate there was a need for speed in that, but we know that Australian companies can provide the sort of security needed, and so that is a disappointment for me.

When I was asked about why I was so fast to download the app, which I did on the evening of the day it was released—and I got my mum to download it to her phone. My dad's phone isn't up to the job. I did that in spite of my really deep reservations prior to this legislation being drafted and refined with our input. What I told people was that it is time to do everything we can as individuals to survive this health crisis. When I look at the double blow of bushfires and coronavirus on my local Blue Mountains and Hawkesbury economies—and, of course, we had floods and landslides as a bonus there—I think as a community we are willing to do extraordinary things to allow a new normal to emerge.

We have empty shops in the picturesque village of Leura. We've got cafes and restaurants in the Blue Mountains and Hawkesbury going all out to diversify their food offerings to make up for the lack of sitting customers, and there are way too many wondering if they will get their jobs back or if they can reopen their business. Our local economy relies heavily on domestic and international travel, and we're not a two-month closed economy; we are into our sixth month of people staying away from local businesses because of smoke, floods and now disease. The workers who rely on these businesses and the owners of these businesses, all of whom are just hanging on, are trying to recover from bushfire while surviving coronavirus, so they will need a range of ongoing support. If this app provides a way for people to move around but still be identified quickly if they come in contact with the virus, then that may prove to be a really important tool for our local economy.

I want to commend the innovation of my local businesses in the Blue Mountains and Hawkesbury, particularly their use of technology to do contactless bookings and deliveries. Many have not been online before and have taken the leap to do that. Whether it's cocktails or gin or cider, platters or frozen home-cooked meals or takeaway dishes, technology, including this app, has a role to play. The people of the Blue Mountains and Hawkesbury are coping with so much. They might be coping with working from home and/or homeschooling or not working and the financial stress that brings. It's been an extraordinary effort, and in this parliament we should match it with extraordinary efforts, which is very much what we have been trying to do on this side of the parliament, working with those opposite.

The last thing I'd like to say is to really urge the government to ensure that people don't think this app is some sort of magic shield and that, just because it's on their phone, they're safe and protected, because we know that they're not. We need to keep reinforcing that handwashing is essential, and coughing into your elbow and not going to work when you're sick and keeping your distance from people is even more important as we start to move around, even when we have the app on our phone.

6:58 pm

Photo of Pat ConroyPat Conroy (Shortland, Australian Labor Party, Shadow Minister for International Development and the Pacific) Share this | | Hansard source

I rise to speak on the Privacy Amendment (Public Health Contact Information) Bill 2020, which is another important part of Australia's response to the COVID-19 crisis. Before speaking on the bill, I want to pay tribute to the people of Shortland for the way they've been dealing with this difficult time these past few months. We really are living in unprecedented times. Although in some instances we've seen the worst of human nature and behaviour, overwhelmingly I have seen the very best in my constituents, and I thank them for their forbearance and their steady commitment to getting through this crisis.

In speaking on this bill, as a representative of the sixth oldest electorate in Australia, I particularly want to convey to the House issues elderly Australians—senior Australians—have with the COVIDSafe app. I want to begin by recognising that some of my constituents have expressed concerns about downloading the app. I recognise that these concerns, especially the ones around privacy, are entirely legitimate and understandable. The first point I say to those who have reservations is that it is entirely voluntary. It is entirely voluntary, and Labor's support for the app and this bill is on the basis that it is entirely voluntary. If you're uncomfortable downloading the app, you should not download it. It's a matter of public record that I've downloaded the app. Like most people, I did my research, carefully considered what to do and then made the decision that I should download the app.

Many of my constituents have raised concerns about privacy and the storage of data, and I want to assure them that this legislation makes it an offence to collect, use or disclose app data except in limited circumstances. Basically, only state and territory health officials can access the data, and that is for the sole purpose of contact tracing those with the virus. Again, this should never change.

Another concern raised with me directly by my constituents was that the government has awarded the data storage contract to Amazon Web Services, meaning that COVIDSafe app data possibly could be obtained by the American government. This just doesn't seem right to most people I've communicated with about their concerns. Surely this contract could have been awarded to an Australian company?

I would also like to draw to the attention of the House issues my constituents have had in downloading the app. As I mentioned previously, I represent an elderly electorate. Over 20 per cent of my constituents are over the age of 65, people who are the most vulnerable in this crisis. My office has been contacted by dozens of constituents who have older mobile phones and who don't have the capacity to download the app. One of them, from Speers Point, was particularly annoyed because his phone is only four years old and he considers it a relatively new phone, yet he is still unable to download the app. He was particularly put out because some of his mates had a go at him, in a good-natured Aussie way, for having a hopeless phone.

The serious point I'm trying to make is that a lot of my elderly constituents have genuinely wanted to download the app but have been prevented from doing so because of this particular digital divide. In fact, I tried to assist my father in downloading the app. He has an older Android phone and he was particularly put out that he couldn't download it, given that he is in a high-risk category. There is clearly a flaw in the design of the app in that people who are volunteering to participate, as the government has requested, are unable to do so.

Finally, I want to draw to the attention of the House concerns about the app that have been raised by Diabetes Australia. Almost 9,000 of my constituents in Shortland have diabetes, a number which is above the average for a federal electorate, so this concerns me greatly. Diabetes Australia has warned users of certain glucose-monitoring systems that COVIDSafe could potentially cause problems and that the app has interfered with their monitoring. Let me repeat that: the best information we have is that this app cannot work alongside essential glucose-monitoring systems. It is of grave concern, and we're potentially excluding millions of Australians who have diabetes, most of whom are in a high-risk COVID category, from downloading this app. These are the very people we need to download this app, if they agree to do so. For them to be prevented doing that by a technical issue is of grave concern.

I will end where I began by saying it's good to make a contribution in the House on this very important bill. I commend the sensible amendment put forward by Labor to improve the COVIDSafe app, and I especially want to assure my constituents that I and my Labor colleagues will work constructively with the government in these extraordinary times. I am only supporting this bill on the basis that it is voluntary and that the data can be used only by state health officials for contact tracing. This bill achieves those ends, and that is the precondition for me supporting it. I commend the bill to the House.

7:03 pm

Photo of Mike FreelanderMike Freelander (Macarthur, Australian Labor Party) Share this | | Hansard source

I rise today to speak in support of the Privacy Amendment (Public Health Contact Information) Bill 2020. I did have quite a long speech prepared, but I will make it brief because I don't think there's any doubt in the House as to where I stand on the COVIDSafe app. I see it as a very important tool in the ongoing management of the coronavirus pandemic. I am of course in support of any measures that are taken to reduce the impact of the SARS-CoV-2 virus. I'm very grateful for the efforts of Chris Bowen, shadow health minister, and Mark Dreyfus, shadow Attorney-General, for the work that they've done with the government to improve the app itself and the privacy provisions of the app. It's very important that I point out that the app itself uses bluetooth technology—it doesn't use geolocation—and that the privacy provisions have been described as the greatest privacy provisions of any legislation brought into this parliament. So I am fully in support of the app.

Whilst I'm now a politician, I'm first and foremost a paediatrician, and I know firsthand how difficult contact tracing can be for conditions such as whooping cough, measles, typhoid fever, meningococcal disease and many others. Contact tracing is very time-consuming. It's often fraught with missing contacts. The COVIDSafe app is a 21st century way of contact tracing that will be very important if we are to loosen our social-distancing restrictions and get to a more open society as people start to move around and start to have more contact. So let there be no doubt that I am fully in support of this legislation and the app itself.

As a physician, I have looked after people with end-stage renal failure and people on ventilators who can't be taken off a ventilator and eventually die. It's no great way to die. Anything we can do to reduce those deaths would be wonderful. The COVIDSafe app will be part of that support of dealing with the coronavirus pandemic.

There are issues that have been discussed—in particular, the difficulty in dealing with people who have glucose monitoring apps on their phones. These are being dealt with, as are some of the other difficulties in the use of the app, and I have no doubt that the app will be modified over the coming weeks. But it is important that we put it in place. It is important that we all download it, for all our sakes, and I am fully in support of it.

I've practised medicine for over 40 years, and I've been quite strident in expressing my views and my opinions about the coronavirus pandemic that we're all facing. We don't know how it's going to end. We don't know what's going to happen. We don't know whether this virus will persist in the community for many years. We don't know whether it will be a seasonal virus. We don't know whether it will mutate to be a milder illness. But we do know that there are over four million people in the world—probably double that—who are already infected, and over a-quarter-of-a-million people are dead. We need to save lives. This COVIDSafe app will be part of that solution, and I fully support it—let there be no doubt. There's nothing more for me to say.

7:08 pm

Photo of Bob KatterBob Katter (Kennedy, Katter's Australian Party) Share this | | Hansard source

I come from North Queensland. North Queensland is like Tasmania. There is no town in North Queensland that is within 400 kilometres of the nearest town. Mackay and Sarina are near enough to 400 kilometres from Rockhampton. Charters Towers is 400 kilometres from Emerald. Mount Isa and Cloncurry are 400 kilometres from Hughenden and Longreach. So we're an island.

The area below Charters Towers is called the Desert Uplands, and I won't go into the reasons—the geography or anything of that nature. But it's just that we are a very, very isolated region, and we identify very strongly as North Queenslanders. Most people from North Queensland are told, 'You're from Queensland.' They'll say, 'No, I'm from North Queensland!'

We are an area like Tasmania. The area should have been cut off immediately.

I'm very experienced in dealing with plant disease outbreaks. I went through the citrus canker, the papaya fruit fly and the black sigatoka. I went through each of those, and also bluetongue outbreaks in cattle and various other similar diseases in livestock. What you immediately do is cordon off the contagion area or cordon off the clean areas. That hasn't been done in Queensland. In fact, almost every single case that we have had in North Queensland has come from Brisbane. Instead of cordoning off the clean area, they locked us into the unclean area. In fact, we were locked into the high contagion area of Australia—South-East Queensland—against our will. That in itself is bad enough, but when I see the people who are advocating all these draconian conditions in Queensland, when I look at them, I can't help but be reminded of the famous comment by the foreign affairs minister in the 1800s in Russia. When he received word that Russia had taken Tashkent, he said, 'What in hell's name are we interested in taking Tashkent for?' But then he also said, 'I must admit, I had a terrific erotic impulse when I learned the news.' I think a lot of people here are getting very, very excited by the power, prestige and notoriety that they are getting at the expense of my homeland, which has a million people—it's not as if North Queensland is small; a million people live there, which is twice the population of Tasmania and almost the population of South Australia, and it's a rapidly growing area.

The last case we had must go on the public record. There is person out there advocating the most draconian measures, which are having quite an horrific effect on the First Australian communities of North Queensland. One community is now rioting continuously, another community is holding demonstrations and a third community is about to explode because the police—be it wise, good or bad—picked up three young blokes. The courts fined them $1,300. This is in the paper. Of course, they couldn't pay it, so they went to jail. For those of you who don't know much about the history of Queensland, there was the infamous 'act', the Aboriginal affairs act. It was called 'the act', and there were many books written about it. For almost 100 years you could not go onto a community reserve or leave one without the permission of the superintendent, who was a white fella. Well, now they're saying, 'The act is back again.'

The person imposing these draconian measures will not protect us by isolation. Almost every single doctor in North Queensland has signed a document petitioning for the quarantining and protection of North Queensland—almost every single doctor. I'm excluding the doctors employed by the government; obviously they're not going to sign. They would lose their jobs immediately, of course. And I'm excluding the temporary doctors who have come in from overseas, but, outside of them, I think they're up to 120 or 130 doctors who have signed up. That's almost every single doctor. But does Brisbane taking any notice of this? No.

I'm getting to the important point. The draconian measures imposed upon us are costing us lives now with cabin fever. I don't have to explain that to the House that there's a downside to this, a very serious downside. Everyone will notice that mental health issue have gone up and up and up. But the person imposing this sent an officer of her department, the health department, from Brisbane, a high contagion area, into the greatest fortress of defence that we have in northern Australia, the Cairns Base Hospital. It's the biggest hospital in northern Australia, and she sent an employee of the health department into that hospital without checking whether that person was contagion free. Well, that person wasn't, and we had an outbreak of the disease in the very fortress of protection that we need: the biggest hospital in northern Australia—not North Queensland; northern Australia. So when you tell us that we've got to lock down like this, yet you apply none of those principles to yourself, and you light up the most important bastion of protection that we have, then please excuse me for thinking that there's a double standard operating here.

For the 400th time I plead with the federal government. If, when we have a pandemic covering the nation that has the potential, on the basis of Britain or Italy or Spain, of 4,000 or 5,000 lives being lost, you say that the federal government has no responsibilities, you don't understand the Australian Constitution. Or you may say that health is the subject of the state governments. It's not when you have a nationwide pandemic. I'm not going into the legal arguments here. I haven't got time. I would like to canvass them, but I can't do that tonight. I would ask the federal government please to carry out your responsibilities and put pressure on the state government for regional quarantining, as we do for plants and vegetables, as we do for livestock. You cordon off the contagion area or, if it's widespread, you cordon off the clean areas. Obviously, Tasmania and North Queensland should leap to your mind, and arguably south-western Australia and probably the Northern Territory, when you say 'cordoning off'. Then you know you've got these areas that are clean.

We had a talk—which is public, so I'm not telling tales out of school—from the health authorities in Townsville. They gave us the figures from the Townsville hospital. They put their normal monthly application in for three items, and they got 100 per cent. In the gloves and masks and gowns, which you desperately need for protection, there was only 30 and 40 per cent of their normal assignment. And in the critical area of antiseptics and wash-downs and sanitisers, there was zero. There's no excuse for this. The Dalby ethanol plant has opened up. Arguably, the best killer of germs on the planet is ethanol. Listerine mouthwash is ethanol, for example. They've reopened the plant, and 60 million litres a year can come out of that plant, so there's no excuse for anywhere in Australia not having access to antiseptics. But our northern facilities have been stripped and the weapons we need to fight this virus have been sucked into the south-east corner, so not only have you given us no protection but you have taken the protection we normally have away from us. I didn't complain about that for two months because they had the contagion and we didn't. But you've given us the contagion, so I'm squealing long and loud at this stage. You've given us the contagion and you've taken away our weapons to fight the contagion. There's no excuse for it. The Dalby ethanol plant, the second biggest plant in Australia, was producing no litreage at all; it was closed down. You've reopened it. David Szymczak, God bless him, and United Petroleum reopened it, and they're going to full production of 60 million litres a year.

I come to the issue we're discussing here, the app. There are very powerful reasons for voting for this, and I don't criticise anyone for doing so, but I'm not going to vote for it. When I went to school, all of us, to my horror, had to read two books: Brave New World and 1984. There's great justification for the draconian powers being exercised, and I pay the governments full credit for moving swiftly and imposing those draconian measures, but now it's a matter of long-term freedoms. I think we're in a different ballpark here. There have been many times in history when we have given away—sacrificed—our freedoms, and there's always a reason for that. Often, at times, there's a very good reason why your freedom should be sacrificed, but those reasons do not look really good in the longer term of human history. I have taken great delight in doing press on this and saying: 'Don't worry, because we have a politician's promise that they're not going to use this tracking of every second of your life that they now have on record for nefarious purposes and there will be a cut-off point somewhere in the future. You've got a politician's promise!' Every time I've said that, I've been greeted with laughter, because it's funny—a politician's promise! But it's the only protection that we have from going into Orwellian's brave new world in George Orwell's 1984or into Aldous Huxley's Brave New World. I was a very young man when I read them. I was 16 or 17 years of age, and I was petrified with fear. To this very day I am still petrified with fear. For those of you who like movies, you might drop along and see The Shining where the bloke goes berserk on account of cabin fever. But I doubt there are too many members in this place who haven't heard the stories of cabin fever. We've had one young man hang himself and another person attempt suicide, that I know of. No-one is running around and publicising these things.

I'm the last person on the planet to be an admirer of Donald Trump, although in some areas I do, but his statement is a very valid statement: you must consider what you are sacrificing and what you are getting from these sacrifices. There is a balance here. Quite frankly, I'm not going to go on the app, and, if you want to throw me in jail, well, throw me in jail. In this place, just remember that history judges you. As a person who wrote a moderately best-selling history book, I can tell you that they can judge you very, very harshly indeed.

In the short time left I want to end on a positive note. We are an area that can be cut off. We are contagion free. You want your giant projects, because you've got to go into public works now. You have a depression, and the only way you can work your way out of a depression is with public works. If you absorb money in public works, you're going to bankrupt your country. You've got to have money-making projects. The Galilee rail line, the transmission line of copper, and Hells Gate Dam—there are three giant projects sitting there waiting to happen, and this is the moment in which they should happen. America did wonderful things during the Great Depression and we did nothing—sorry, we put a rock wall around the gardens in Balmain! That's what we did during the Great Depression. Let us not repeat that in this coronavirus depression. (Time expired)

7:21 pm

Photo of Christian PorterChristian Porter (Pearce, Liberal Party, Attorney-General) Share this | | Hansard source

I thank all of the members for their contributions on the Privacy Amendment (Public Health Contact Information) Bill 2020. I thank the member for Kennedy. I think Aldous Huxley said the technology process has merely provided us with even more efficient means of going backwards, but I think, obviously, Aldous has been proven wrong in recent decades, because we're moving forwards. Member for Kennedy, this is definitely a piece of technology that will help us move forward.

The Privacy Amendment (Public Health Contact Information) Bill 2020 will implement the strongest possible ongoing privacy protections for data collected and generated by the Australian government's COVIDSafe app. By passing this bill we can give the Australian public the greatest confidence that their personal information is secure when they choose to download and use COVIDSafe, helping Australians combat the spread of COVID-19.

The bill was preceded by a biosecurity determination app that outlined interim privacy protections for COVIDSafe app data. The first and most important thing this bill does is enshrine these privacy protections in primary legislation. This will be achieved by inserting a new part into the Privacy Act 1988, and the key provisions from the determination are formalised by the bill. They include the criminal offence for unauthorised collection, disclosure and use of COVIDSafe app data and the criminal offence for requiring another person to download and use COVIDSafe app data. The bill also implements additional privacy protections which were not included in the determination, and the most significant of these additional protections extends the Australian privacy principles, the Notifiable Data Breaches scheme and the oversight of the Australian Information Commissioner to COVIDSafe app data. Under these changes, a breach of the bill will also be a breach of the Privacy Act, including when the bill is breached by state and territory health officials.

Other additional privacy protections which have been added to the bill include provisions guaranteeing that no further data can be collected from former COVIDSafe users and putting in place a clear process for how all data in the national COVIDSafe data store will be deleted when the COVIDSafe app is no longer required.

Finally, the bill contains provisions that clarify parts of the determination and deal with a number of technical matters. New sections have been included to ensure that the bill overrides any other inconsistent laws to articulate the constitutional basis of legislation and put in place a process for automatic repeal of the legislation once COVIDSafe is no longer needed.

In conclusion, I'd like to acknowledge the constructive approach of the opposition, particularly the member for Isaacs, whom I've been dealing with on this bill. I note the bill contains privacy protections which are of an unprecedented level of strength, designed to protect data collected and generated by the COVIDSafe app. There is no more private or secure data that can possibly be volunteered to either a government agency or a private organisation than COVIDSafe app data. By passing this bill I sincerely hope that it gives all Australians the increased confidence they need to choose to download and use COVIDSafe, because a high uptake is very important to helping state and territory contact tracers get on top of outbreaks and to prevent the further spread of COVID-19. I endorse the bill to the House.

Photo of John McVeighJohn McVeigh (Groom, Liberal Party) Share this | | Hansard source

The original question was that this bill be now read a second time. To this the honourable member for Isaacs has moved as an amendment that all words after 'That' be omitted with a view to substituting other words. The immediate question is that the words proposed to be omitted stand part of the question.

Question agreed to.

Original question agreed to, Mr Katter dissenting.

Bill read a second time.