Anne Ruston (SA, Liberal Party, Minister for Families and Social Services) Share this | Link to this | Hansard source

I move:

That this bill be now read a second time.

I seek leave to have the second reading speech incorporated in Hansard.

Leave granted.

The speech read as follows—

The Privacy Amendment (Public Health Contact Information) Bill 2020 will ensure that there are strong ongoing privacy protections to support the download, use and eventual decommissioning of the Australian Government's COVIDSafe app.

At release, COVIDSafe was supported by interim privacy protections contained in the Minister for Health's Determination under the Biosecurity Act 2015. Building on this, the purpose of this Bill is to:

1. Enshrine the privacy protections in the Determination into primary legislation by inserting a new Part into the Privacy Act 1988

2. Give the Australian Information Commissioner oversight of COVIDSafe app data, and

3. Introduce additional provisions that clarify protections in the Determination.

The Bill guarantees that the Australian public can have confidence that their privacy will be protected if they download and use COVIDSafe. An increase in the uptake of COVIDSafe will help States and Territories to trace outbreaks and combat the spread of COVID-19.

Background

To understand the Bill's privacy protections, it is first crucial to understand how COVIDSafe operates and handles personal information. You will also see that strong privacy protections have been built into the design of COVIDSafe, as it requires users to provide the minimal amount of information required for contact tracing, which is encrypted until it is required by Health officials.

COVIDSafe is a voluntary app developed by the Australian Government that was launched on 26 April 2020. COVIDSafe can be installed on Android and iOS personal devices to collect information to assist State and Territory health officials when they conduct contact tracing to combat the spread of COVID-19.

When a person downloads COVIDSafe, they are asked to register by entering a limited amount of personal information: a name or pseudonym, an age range, a mobile phone number and a postcode. Once verified by text message, this information is then uploaded in an encrypted form to the National COVIDSafe Data Store.

Once a user has registered, COVIDSafe works by using Bluetooth signals to record encrypted data about close contacts with other users and stores this locally on their device. If this data is not uploaded to the National COVIDSafe Data Store, it is deleted on a rolling 21-day basis. Unlike manual contact tracing, COVIDSafe can record close contacts who are not known to the user – for example, people who sit near a user on the bus, at an event, or in line at the supermarket. When a COVIDSafe user tests positive for COVID-19, they will be contacted by a health official in their state or territory as part of the usual contact tracing process. When making contact, the health official will ask the person if they use COVIDSafe. If they do, the health official will send them a code by text message to enter in the app. If the code is entered, the user consents to uploading the encrypted data about their close contacts to the National COVIDSafe Data Store.

Once information about close contacts is uploaded, state and territory contact tracers can access this information to notify the positive user's close contacts that they may have been exposed to the coronavirus. From this point, contact tracers will inform people at risk of COVID-19 that they have been exposed, without identifying the infected app user. Contact tracers will step people at risk through what to do next, such as getting tested or self-isolating.

COVIDSafe has the potential to significantly speed up existing manual contact tracing processes, and in turn could accelerate the pace at which governments can ease restrictions while still keeping Australians safe.

Biosecurity declaration

The Australian public must have confidence that COVIDSafe protects their privacy for it to be used and highly effective in combating the spread of COVID-19. To this end, the Minister for Health, the Hon Greg Hunt MP, made a determination under the Biosecurity Act on 25 April 2020—before COVIDSafe's launch. This Determination provided strong interim privacy protections for data collected through COVIDSafe, prior to the passage of this Bill.

The Determination contains provisions that:

Finally, the Determination created criminal offences for the breach of the above requirements, with a maximum penalty of five years' imprisonment.

Enshrining the Determination

The Australian Government has now developed this Bill to enshrine the COVIDSafe privacy protections in the Determination in primary legislation.

The protections in the Bill will apply to all COVIDSafe data from the point at which the Bill commences, even if that data was created before the Bill commenced. Until the Bill is passed, the Determination will continue to apply to the handling of COVIDSafe app data.

The Bill will also override the effect of any previously-enacted laws under section 94ZD. This means that the Bill will apply in place of any other laws that may apply, including the Determination, once it passes into law. At that point, those handling the COVIDSafe app data will have a single legislative reference – the Commonwealth Privacy Act.

Criminal offences under the Bill

While I do not plan to address those areas of the Bill which directly replicate the Determination, I note that key criminal offences from the Determination continue to apply, and remain subject to the same penalties. These penalties are imprisonment for five years, a fine of 300 penalty units ($63,000), or both. The offences include:

Committing criminal offences will breach the Privacy Act

The Bill ensures oversight of COVIDSafe app data by the Australian Information Commissioner (the Commissioner). The offences under the Bill will also be breaches of the Privacy Act in certain circumstances. Therefore, (under section 94R) if a person commits an offence under the Bill and that person is either:

then the person's conduct will also breach the Privacy Act.

This gives individuals affected by the breach more options for enforcement because they will have the option to make a complaint to the Commissioner in addition to being able to report the matter to law enforcement.

Broader application of the Privacy Act

The Bill will go further than the Determination by ensuring that COVIDSafe app data must also be treated as 'personal information' under the Privacy Act (section 94Q). This automatically applies a range of existing Privacy Act protections to COVIDSafe app data, including privacy policy, notification, and security obligations. The Commissioner will be able to undertake a formal assessment of whether an entity subject to the Privacy Act, or a State or Territory health authority handling COVIDSafe app data, is complying with the requirements in the Bill.

The Commissioner will also have discretion to refer matters that may constitute a breach of a State or Territory privacy law to the responsible State or Territory privacy regulator.

There is an additional requirement that the Commissioner provide regular public reports on the performance and exercise of her new powers and functions under Part VIIIA.

Application of Notifiable Data Breaches scheme

The Bill applies the existing Notifiable Data Beaches Scheme to COVIDSafe app data under section 94S. The Bill requires the administrator of the National COVIDSafe data store, or a State or Territory health authority handling COVIDSafe app data to notify the Commissioner of any data breach involving COVIDSafe app data. The Commissioner will then have the power to require that breach to be notified to affected individuals.

The notification requirement would be automatic in the event of a data breach (much stronger than the Privacy Act's existing data breach notification requirements).

Summary of further differences between the Bill and Determination

The Bill also includes new clauses which:

I will now outline why these changes have been made.

Requiring the use of COVIDSafe

The prohibition on requiring a person to use the COVIDSafe app has been clarified under section 94H. A person will not be liable for this offence if they require a person to use COVIDSafe before entering their private residence, reflecting the normal expectation that a person is generally free to deny another person access to their home for any reason. However, this exemption is limited—it would not apply to other situations covered by the offence involving a commercial relationship, such as a landlord/tenant relationship, a share house relationship or an employment relationship.

Protections for former COVIDSafe users

Section 94N is a new provision that guarantees that COVIDSafe will not be used to collect any further data from people who have chosen to delete the app. Section 94N provides that if a user re-registers for the app, data collection can resume. This protection provides further assurance that a user's consent is central to COVIDSafe data collection.

Administration of the National COVIDSafe Data Store

The Bill designates the Australian Department of Health as the administrator of the National COVIDSafe Data Store, and allows it to delegate some or all of these functions to certain Commonwealth Government agencies under the proposed section 94Z. The Department of Health must make that delegation via a 'notifiable instrument', meaning the delegation will always be announced publicly. Importantly, an enforcement body or intelligence agency cannot be designated as the Data Store administrator.

Currently, the Digital Transformation Agency (DTA) is responsible for technical administration of COVIDSafe and the National COVIDSafe Data Store, in consultation with the Department of Health. When the Bill comes into law, the Department of Health would formally delegate some of its administrator functions to the DTA to reflect this arrangement. If the Department of Health later delegates these functions to another agency, Health will need to publicly announce that fact via notifiable instrument.

Deleting the National COVIDSafe Data Store

Finally, the Bill also includes a more specific process for deletion of the National COVIDSafe Data Store once the pandemic is over, compared to the Determination. This includes a process for the Minister for Health to determine the end of the COVIDSafe Data Period under section 94Y and by outlining the actions that then need to be taken by section 94P.

Reporting requirements

The Bill includes a requirement that the Minister for Health report to the Parliament as soon as practicable after each 6 month period on the operation and effectiveness of the COVIDSafe app. This underscores the Government's commitment to transparency about the operation and effectiveness of COVIDSafe and the unprecedented privacy and security protections built around the app's data handling.

Repeal of the Bill

Schedule 2 of the Bill will result in the legislation being automatically repealed 90 days after the Minister for Health issues a determination that the COVIDSafe app is no longer required under section 94Y. The Acts Interpretation Act 1901 will apply to preserve the effect of the repealed law so that an investigation into a possible breach of a repealed law can continue or can be commenced after repeal.

Conclusion

This Bill will guarantee that Australians' privacy is protected when they choose to download and use COVIDSafe. By enshrining the Biosecurity Determination into primary legislation, and ensuring the Information Commissioner has the power to hear complaints about the mishandling of COVIDSafe app data under the Privacy Act, the public can be assured that the Government is doing all it can to keep their data as secure as possible. With the passage of this Bill, we sincerely hope that the Australian public will take note of the unprecedented strength of these privacy protections, choose to download the app, and help their fellow Australians combat the spread of COVID-19.

Murray Watt (Queensland, Australian Labor Party, Shadow Minister for Northern Australia) Share this | Link to this | Hansard source

Since the beginning of this public health crisis, Labor has sought to work constructively and in good faith with the government to ensure that Australians are kept safe in this health emergency. As the Leader of the Opposition has said, on many occasions, Labor is looking for outcomes not arguments. That is the spirit in which we approached this bill and the government's contact tracing app more generally. Labor believes that a contact tracing app can be a valuable tool for protecting Australians from COVID-19. But it will only be a valuable tool if a sufficient number of Australians download it. The Prime Minister has said that 40 per cent of the Australian population need to download the app for it to be an effective public health tool. That means about 10 million Australians.

The government is well short of that figure, at the moment. About 5.6 million Australians have reportedly downloaded the COVIDSafe app. Now the Prime Minister appears to be walking away from his target of 10 million COVIDSafe downloads. He now claims that we only need 40 per cent of all smart-phone users in Australia to download the app. But that target is not based on science; it's based on politics. The truth is that many experts believe that the Prime Minister's original 40 per cent target falls well short of what is needed. Researchers at the University of Oxford, for example, have estimated that 56 per cent of the UK population would have to install a contact tracing app for it to be effective, representing 80 per cent of all smart-phone users in that country. Our own Chief Medical Officer said that in his view a good uptake of the app in Australia would be well over half of the Australian population.

Targets should be based on science not politics. So if the Prime Minister is serious about listening to the public health experts, he should be increasing his original target of 40 per cent of the population and doing everything to reach it. He should not be decreasing his target for political reasons. I say this not because I want the Prime Minister to fail. I say this because I want the COVIDSafe tracing app to succeed as a public health measure. To encourage as many Australians as possible to download the COVID-19 contact tracing app the public must have absolute faith that their privacy will be protected and that the data collected by the app will never be misused.

That is why Labor has worked constructively with the government to improve this bill prior to its introduction to the parliament, and we are pleased that many of our suggestions have been adopted by the government. As a result of our engagement with the government this is a stronger piece of legislation, which takes privacy concerns seriously. As a result of the government adopting Labor's suggestions, a number of changes have been made. There is now greater clarity about what data is protected by the strict privacy safeguards contained in the bill. The bill now provides for greater oversight of the COVIDSafe app and the handling of COVIDSafe data by the Office of the Australian Information Commissioner. The bill now makes it clear that no intelligence agency or law enforcement body can be given a role in administering the COVIDSafe data store. Where it is unlikely to prejudice a law enforcement investigation, the bill now allows the Office of the Australian Information Commissioner to continue an investigation, even where the investigation overlaps with an investigation by law enforcement. And the bill now includes a number of public reporting requirements so that the Australian people can be kept informed about the operation and effectiveness of the app and the level of compliance with the privacy safeguards contained in the bill.

Necessarily, this bill was drafted quickly and it has not gone through the usual parliamentary committee processes of review. As such, it has not received the same degree of scrutiny that a bill would typically be subjected to. For that reason, my colleagues and I on the Senate Select Committee on COVID-19 have indicated that we intend to oversee the COVIDSafe app by reviewing its rollout and investigating privacy and other concerns that have been raised in relation to the app. More generally, Labor will keep an eye on how the measures in the bill are implemented, in order to ensure that they are effective and are working as intended. We expect the government to do the same.

This bill does not address every concern about privacy and it does not address any of the concerns that have been raised about the technology. For example, while this bill will give the Office of the Australian Information Commissioner additional responsibilities, it will not provide her with any additional resources. Last Wednesday, the Attorney-General's Department told the COVID-19 select committee that there's no intention to provide additional resources. They said: 'The Privacy Commissioner is able to undertake this work within their existing resources.' With respect, that assertion is just not credible. The Privacy Commissioner, who is also the information and freedom of information commissioner, requires additional resources. We know this, because she needed additional resources before anyone had even heard of COVID-19. You don't have to take my word for it. Have a look at the transcript from Senate estimates last October, when the Privacy Commissioner told Senate estimates that her office was already severely under-resourced, before these additional responsibilities were given to her. The Attorney-General told Labor that his department, despite its evidence to the select committee last Wednesday, is now engaging with the commissioner to ensure that she has the necessary resources to perform the important oversight functions provided for in this bill. Labor looks forward to receiving an update from the Attorney-General over the coming days.

Following the passage of this bill, Labor believes the most important thing the government can do to encourage people to download the COVIDSafe app is to be open and transparent with Australians. To gain the trust of Australians, the Morrison government must trust Australians. Publishing the source code for the app was a good start, but it's not enough. The government must be as transparent as possible about everything to do with the COVIDSafe app, whether it be providing additional technical information in relation to the app or being up-front about how the app is working in practice. I might just say that in evidence to the Senate select committee there were considerable concerns about how well this technology actually worked. I know those concerns remain in place in many parts of the community. This is also a matter that the government must be transparent about and must do everything possible to fix. The government should be transparent about other matters, too, such as the reason it made the extraordinary decision to award the COVIDSafe data storage to Amazon Web Services instead of an Australian certified cloud service provider. That single inexplicable decision by the Morrison government has done more to undermine public confidence in the COVIDSafe contact tracing app than any of the app's fiercest critics. I know a number of my colleagues will be speaking on this matter. There is considerable concern in the Australian community about the government's decision to award this tender to an overseas based organisation. That is something we will be pursuing in the debate today.

The government must also provide the Australian people, including older and culturally and linguistically diverse Australians and Australians with disabilities, with clear, easy-to-understand, accurate information about the app. I was very concerned about the evidence of the Digital Transformation Agency to the Senate select committee last week, in which it was revealed that the app will be provided in English only. Obviously, for many Australians from culturally and linguistically diverse backgrounds some form of translation should be considered for this app. I would urge the government to think about that.

Finally and most obviously, Australians will have no reason to download or keep using the app if the technology does not work or if it is not secure. For that reason, the government must urgently address the technical and security concerns that have been raised about the app by technology experts and members of the public. All you have to do is look at Twitter to see the comments that many technical experts and security experts have raised. Again, I would urge the government to take those concerns seriously. But, with those caveats, I commend the bill to the Senate.

Nick McKim (Tasmania, Australian Greens) Share this | Link to this | Hansard source

The Australian Greens will be supporting the Privacy Amendment (Public Health Contact Information) Bill 2020, because it is not enabling legislation for the app—because the app is already out there on people's devices in significant numbers—but is in fact enabling legislation in the main around privacy protections associated with the data collected via the app. That's a very important distinction. This bill is an improvement on the determination that it effectively replaces. It introduces additional privacy protections that were not present in Minister Hunt's determination. It introduces other remedies that were not present in the determination and it introduces oversight under the Privacy Act that was not present in the determination. It also provides coverage over state and territory health officials. I will speak more about that later.

I want to commend the government for releasing a draft of this legislation publicly. Obviously, this has been a far quicker process than we would normally go through, both in terms of how the government has dealt with it and in terms of how the Senate has dealt with it, but we understand the urgency here, driven by the pandemic we all are living through. I also want to commend the government for introducing protections in this legislation that the Australian Greens and others argued were lacking in the determination. The privacy protections contained in this bill are in fact far more robust than the privacy protections contained in regard to many other data that the government holds. It begs the question as to why the government believes that this data should be protected by more robust privacy protections than, for example, the metadata that the government requires corporations to keep. These privacy protections should be standard, not the exception.

We understand the urgency and respect the need for this legislation, particularly as the COVIDSafe app has been live since 26 April and has been downloaded by approximately 5½ million people. However, we retain concerns around the security provisions associated with the data that this app will collect and we also retain concerns around transparency.

To set a bit of context, I want to touch off on this government's record of privacy breaches and data security mismanagement over the last few years. To say this government has a cavalier attitude towards data security would be a gross understatement. This is the government responsible for our metadata laws in Australia. The metadata laws were sold to the Australian people on the basis of protecting us from terrorism and are now being used by local councils to investigate littering and to investigate people for having unregistered pets. To describe that as scope creep would again be a gross understatement. This is the government that deliberately leaked to a media outlet the private information of a Centrelink client who was critical of Centrelink's illegal robodebt scheme. This is the government that repeatedly leaked private medical information of people seeking asylum to the media in an attempt to undermine the medevac legislation. This is the government responsible for the census fail. This is the government that failed to properly de-identify Medicare data which ended up for sale on the dark web. This app is being championed among others by Minister Robert, who falsely claimed the Centrelink website fell apart because of a denial-of-service attack. If there's scepticism in the community about this government's capacity to protect people's personal information, that is entirely down to the government's own actions and failure to protect people's data in the past and to its cavalier attitude towards data protection.

Nearly two weeks after releasing the app and three weeks after Minister Robert said he would, the government did finally release the source code for COVIDSafe. This is an important step for transparency, and I thank the government and congratulate it for doing that. But the government has also said that it's considering publicly releasing the data management protocols that either have been or will be signed between the Commonwealth government and state and territory governments. Those protocols will govern how state and territory governments handle the data that, in the event of a positive test for coronavirus, is then provided to state and territory health authorities to allow them to go through the contact tracing process. I would ask the minister, if she's able, to update the Senate about whether or not those protocols have been signed and whether the government still intends to make those data management protocols or agreements public.

Another concern the Greens have, and Senator Watt referred to this in his contribution, and this is a concern that's also shared widely through the tech sector and the privacy sector, is around the US CLOUD Act—that is, the Clarifying Lawful Overseas Use of Data Act in the US. The CLOUD Act was enacted in 2018 to provide that US based cloud and technology companies could be compelled to hand over data held offshore, under warrant, to US security agencies. We don't have a bilateral CLOUD Act agreement in place with the US. The government has assured everyone there's nothing to see here and we should move along. However, Home Affairs, in its submission to the Parliamentary Joint Committee on Intelligence and Security inquiry into the Telecommunications Amendment International Production Orders Bill 2020, along with numerous international law firms around the world have advised otherwise. The issue is that, because Amazon Web Services is an American company with its head office in the US, it is entirely possible a US court could exercise personal jurisdiction over its Australian operations and require that data be handed over to US security agencies. When I asked the Attorney-General's Department about this last week in the Senate select committee, they were unable to give a 100 per cent guarantee that this data would not be handed over under US warrant to a US intelligence agency.

The great tragedy of all this, though, is that this situation could have been avoided if the government had awarded or even opened tendering for the hosting contract to one of the three Australian cloud service providers with Australian Signals Directorate certification. They are Australian companies with Australian infrastructure employing Australians technicians and they would not fall under the jurisdiction of the US CLOUD Act. But the government didn't do that. It made the inexplicable and so far unexplained decision to award this contract to AWS, a company with its head office in Seattle. Despite saying we should stay together and we will get through this together, despite continually saying we need to secure Australian jobs and livelihoods, this contract was awarded to a company with a head office overseas.

I also want to refer briefly to some of the messaging that the government's been using around this app, which the Australian Greens regard as reckless or dangerous. The Prime Minister saying that using the app was like putting on sunscreen to go out in the sun was misleading at best, dangerous at worst, because, of course, the app does not offer users any direct protection from contracting coronavirus; likewise, 'slip, slop, slap the app'—again, misleading at best, dangerous at worst. The government shouldn't be cavalier around this issue. It's a pandemic, for goodness sake; people's lives are at stake here.

I also want to touch on the way that the data will be collected by this app and misrepresentations about it. The government has said that when a user tests positive the app will allow the user to consent to the upload of only contacts that came within 1.5 metres of the user for 15 minutes or more, but according to the government's own privacy impact assessment, by law firm Maddocks, the app in fact collects and uploads data about all users who have come within bluetooth signal range for even a minute within the past 21 days. Mobile device bluetooth has a range of around 10 metres, which means it will collect data on anyone who spends time within a 10-metre range of the user. Although the Department of Health has said in response to the PIA that it would put in place restrictions to bluetooth digital handshakes, this bill, not unreasonably, includes no such protections. So I ask the minister whether she is able to respond to that concern in her second reading contribution later.

About 5.5 million people have now downloaded the app, which is about 21 per cent of the total population. It's getting close to the government's goal, although it's worth pointing out that a mathematical model from Oxford University suggests that around 60 per cent of the population needs to use a tracing app to 'stop the epidemic'. This government's goal appears to be only 40 per cent.

As I said, we'll support this legislation, but we do have concerns around the lack of some privacy protections. We believe this bill could be improved, and we'll be moving amendments in the committee stage to give the government the opportunity to beef up protections around the data collected by this app. Those concerns, specifically, regard the limited prohibitions on COVIDSafe app data, which we'd like to see broadened, and the fact that there is no fixed trigger for the sunsetting of this bill. We hold concerns regarding coverage of rules against coercion and transparency of COVIDSafe operations. We hold concerns also about assurances of data being deleted under this bill. These have been met part way by the government in the latest iteration of this legislation; however, more needs to be done, which we will address in our amendments. I also want to touch on the fact that this app is only in English. There are a lot of people in this country for whom English is a second language, and there are many people in Australia who do not have a high level of English comprehension. This app needs to be made available in ways that people can easily understand, and that includes being available in different languages so that people whose first language is not English also have the opportunity to make an informed decision about whether or not to download this app.

I won't be downloading this app, because I simply don't trust the government with data about who I am proximate to. I wish the government had gone down a different route, one that many other governments in the world have gone down, in which there is no centralised store of data. The data simply remains on people's mobile devices and, should someone test positive for coronavirus, a message is sent to people who that person was proximate to, letting them know that they've been proximate to someone who has tested positive, and therefore gives them the opportunity to decide to go and get tested themselves.

The Australian Greens will support this legislation because it's not enabling legislation for the app but is enabling legislation for privacy protections associated with the data collected by the app, and that is a very important distinction.

Matt O'Sullivan (WA, Liberal Party) Share this | Link to this | Hansard source

I too rise to speak on the Privacy Amendment (Public Health Contact Information) Bill 2020. I should start by saying that I've downloaded the app. In fact, I downloaded it as soon as it became available in the App Store; it was a couple of hours before the registrations were available. Like many Australians, I think, I was sitting there pressing refresh, waiting to be able to register it. I didn't start with that sort of enthusiasm. While at that stage I was very enthusiastic to download it, when the idea of the app first came up I did have some reservations about it. While I fully accepted the intentions and what we were trying to do with it, I was very careful to make sure that it wasn't in any way in breach of the standards of privacy that Australians expect. So in the time I have available today I'm going to talk you through what I've done to make sure that this app and the system it uses are protecting our privacy and ensuring Australians can download it with confidence that they will be protected.

As the Prime Minister said yesterday, Australia is winning the coronavirus battle, but we have not yet won. Industrialised contact tracing through the COVIDSafe app will be a primary measure of success as we move down the long road to recovery. It's a critical tool which will enable Australians to get back to life as it was before: to go back to work, TAFE, university and all those great things that we like to do in our spare time and on weekends together, importantly with family and friends. Again Australians are leading the way. Downloads are continuing to trend upwards—we're well over the five million mark now—and this demonstrates that Australians want to get back to business as usual as well as they can. The app is the tool to ensure that this happens as quickly as possible. We know that if that number is to continue to climb people need to have the confidence to download it. It's good to see that, with the unprecedented challenge we face, most of us in this place have downloaded it ourselves.

But there is more to this than political squabbles and pointscoring. Not only should we be downloading the app, if we support it, we should be doing everything we possibly can as individual members of this place to give Australians that confidence also.

Just last week, I held an online forum or conference live on my Facebook page, and I certainly recommend watching it if anyone here hasn't seen it. On that online forum I had Geoff Quattromani, a tech commentator who, like many others in the tech community, has spent much of his time dissecting and examining every function of the app. Many people watched that forum online. It's still available, and many people still are watching it. Geoff is on board with this app. He's encouraging people to download it. On the online forum on Facebook, I was also joined by Chris Rodwell, the CEO of Western Australia's Chamber of Commerce and Industry, and Dr Andrew Miller, the president of the Western Australian branch of the Australian Medical Association. They made the case for how important it is that we start this road to recovery and the next phases of our three-step plan as soon as possible. In every community represented in this place, businesses are being hit hard, particularly those in service and consumer-facing industries, and this flows on to their supply chains—the manufacturing and, in particular, agricultural industries. Our health system, which is geared towards dealing with the coronavirus challenge, will also need to tackle the backlog of elective surgery and other health related concerns. All three of those people on the forum supported the app as an effective tool to get Australians back to these sectors.

It was a good discussion which covered a number of community concerns, particularly about what the app does and, importantly, what it doesn't do. Some people were extraordinarily supportive. We had lots of people online, and they were commenting and asking questions of the presenters on the forum. Some viewed it as doing something for the greater good. Indeed, some needed some convincing, and some were downright against, and that's fair enough. That's to be expected. We are at an unprecedented point in our history, so I and our panel and my office work to resolve those concerns.

Effectively, what this app does is take the process which is already in place from our state health authorities and move it from being a manual process, which takes some time and relies on your memory for the most part, to happening on your smartphone. Some people, when they are told that they've got a positive result, could actually be quite ill, so they're sitting there being treated for their health condition and, at the same time, having to recall who they have been in touch with at a very critical and, no doubt, emotional time for them. So this takes that manual process, digitises it and makes it a more efficient process.

It will not geolocate you. It will not share names or phone numbers. It will just share a unique reference code via the bluetooth handshake. This data will only be shared between the two devices. After you've downloaded it and you've been using it as you're going about your business, there is a second step: if you do test positive, you then also have to opt into sharing that data with the relevant health authorities. So there is a two-step process. If you never contract coronavirus, the data is simply stored on your phone until you delete the app or until the data is deleted after a 21-day rolling cycle. So the data is in your hands. It is in the hands of the phone holder. You decide what you do with it and, in the event that you do share it, the appropriate protections are put in place. It will be stored in Australia, and transmitting or communicating it overseas will be an offence.

There has been no more vocal advocate for ensuring the appropriate protections are in place than me. I'm a bit of a technical person. I'm normally an early adopter when it comes to tech things, but I like to pull these things apart and see how they work. I don't just accept that it works; I want to know why and how. In the initial phases, I admit I did have some concerns. I spoke about them at great length with the government and worked them through, and I also took plenty of feedback from my constituents in Western Australia about this. From all this, along with many of my colleagues who no doubt had a similar position, I've become confident that the product that we are delivering has these protections in place.

As a government, we've heard, listened to and acted upon the concerns of the community. That's why this bill has been introduced: to enshrine privacy protections in legislation. We could have just done it by giving an assurance, but we wanted to make sure that we put in place the legislation so that Australians can be confident that it is law. A breach of a provision of the bill or a breach of the Privacy Act will be a criminal offence.

In addition to codifying the protections of the determination, the bill will introduce the following measures: the national privacy regulator, the Office of the Australian Information Commissioner, will have oversight of the app data and can manage complaints about mishandling of COVIDSafe app data and conduct assessments relating to the maintenance and handling of the data; the Privacy Act Notifiable Data Breaches scheme will be extended to apply to the COVIDSafe app data; the interaction between the powers and obligations of the OAIC in relation to COVIDSafe app data with the powers of the state and territory privacy regulators and the Australian Federal Police will be clarified; the administrator of the national COVIDSafe data store will delete users' registration upon request; an individual will be required to delete COVIDSafe app data if the data is received in error; no data can be collected from users who have chosen to delete the app; and a process will be put in place for the app to be deleted at the end of the COVID-19 pandemic, and users will be notified accordingly. These are strong protections which should give people every confidence to download the app, and I encourage them to do so, as have I.

We are in a unique period of our history, and we must never forget that. As much as it now appears just part and parcel of our everyday lives, we must do all that we can to help Australians emerge out of this crisis. But Australians are rising to the challenge. In fact, they've been doing this for several months already. It's amazing, and I think all Australians can be proud of what their fellow Australians have been doing. Sadly, though, in many cases this has resulted in a loss of income and not being able to attend work, TAFE, university or funerals—the most devastating impact of this situation. Of course, sadly, there have been some lives lost.

Australians have put their lives on hold. We are doing our part to get back to business as usual in the best possible way that we can. So it is time for the parliament to do its part and uphold the confidence that Australians have placed in it. This is why I commend this bill, and, along with it, the rigorous oversight that will no doubt come in the later part of this debate, to the Senate.

Marielle Smith (SA, Australian Labor Party) Share this | Link to this | Hansard source

I also rise to speak on the Privacy Amendment (Public Health Contact Information) Bill 2020. As we've heard from previous speakers, this bill seeks to amend the Privacy Act by introducing a range of privacy protections for information that Australians provide through the COVIDSafe app, the contact tracing app released on 26 April 2020. In the best interests of public welfare, in order to assist in Australia's ongoing COVID-19 response, Labor has agreed to support this bill. Notwithstanding this support, Labor is aware of concerns with the functionality of the app as well as concerns raised by software experts regarding the security of the app. It's important that we speak to these issues in this chamber today and acknowledge them.

Downloads of the app number around five million, or 20 per cent of the population in Australia—only halfway to where we need to be, if we are to meet the Prime Minister's own stated target of 40 per cent of the population connected to the app. Ultimately, the public won't come on board unless they have confidence that their privacy will be protected. Given this government's track record on technology, you can hardly blame them for that reluctance.

The app offers an automated version of contract tracing through bluetooth. It enables a user's phone to identify who is near and to prepare a record of who its user has been near. We are told these records are ready to go, in case a user contracts COVID-19, allowing immediate contact to be made with people who have come into contact with the user. The government has stated the app will only take a very limited amount of personal data from app users, such as their name, mobile number, postcode and age range. We have been assured it won't keep track of where a user is or who a user is with. Appropriately, it makes it an offence to collect, use or disclose that data except in a number of prescribed circumstances, including where the collection, use or disclosure of the data is by a person employed by a state or territory health authority for the purpose of contact tracing.

Furthermore, the bill makes it an offence to retain COVID app data on a database outside Australia or to disclose COVID app data to a person outside of Australia, except where the person is a health official undertaking contact tracing. It also imposes a range of obligations on the government, including to ensure that the COVID app data is not retained on a mobile telecommunications device for more than 21 days, to delete all of an app user's data from the national COVIDSafe data store as soon as practicable upon request and to delete all COVID app data from the national COVIDSafe data store when the health minister is satisfied that COVIDSafe is no longer required to prevent or control the spread of COVID-19 in Australia.

The bill also gives the Privacy Commissioner specific oversight to ensure appropriate enforcement. Labor's shadow Attorney-General has sought assurances from the government on whether the Privacy Commissioner has sufficient resources to enable her to fulfil the additional oversight responsibilities under the bill as well as other protective amendments for the bill which are appropriate to seek and implement.

Ultimately, Labor wants see this app work. I've downloaded it, as have many of my colleagues. A contact tracing app can be a valuable tool in our fight against coronavirus. But the government needs to be very clear about whether the app works and what protections are in place to protect Australian citizens. We have consistently raised and sought reassurances concerning functionality, privacy and consent. Broadly speaking, we have raised issues at the Senate select committee hearings into the COVID response, including why the app doesn't work on iPhones unless it's open in the background and why it's not compatible with things like the diabetes monitoring app. I am particularly concerned about what protections are in place for Australians' data and for Australians' privacy.

We need to acknowledge that legislation alone cannot build confidence in the COVIDSafe app. It won't give the public the confidence they need to download this app on the levels we need to see them downloading the app for it to work. That's why Labor has called on the government to address the technical concerns raised about the app by ensuring the thing works as it should, as it was intended to do. The government needs to provide additional resources to the Privacy Commissioner so Australians can be confident that, in addition to having the powers she needs to protect the privacy of app users, she has the resources she requires to exercise those powers in an appropriate circumstance. The government needs to be transparent and provide Australians with as much information as possible so that they can have confidence in this app and what it means for their data, privacy and security.

I want to briefly comment on the awarding of this important contract to Amazon Web Services. America is of course one of our enduring allies—a nation state with which we share many of the same values. I'm not in a position to pass judgement on why this contract could not be given to a local firm and whether there is an issue of capability or cost, or a combination of these factors or any others. What I am in a position to say is that data management in the modern world we live in is becoming an ever-growing national security responsibility which our government needs to manage and needs to manage better. The same sensitivities we engage in when it comes to intelligence and national security issues should equally apply here.

Just as we engage in issues of sovereignty when discussing the sustainment and rebuild of the nation's submarine fleet, so must we consider the necessity of data sovereignty. Indeed, if there is one sentiment that many Australians have been relaying recently during the COVID-19 crisis, it is that Australia needs to get back to producing things and to reclaim a certain amount of sovereignty, so that we are able to take charge of our own futures and be less reliant on others. If there is one thing Australians are producing plenty of in our digitalised economy, it is data. Some say that data in the 21st century is what oil was in the 18th century—an immensely untapped, valuable asset. Not only would increasing our sovereign capability in this area be good for local jobs and our economy; it would also improve our national security credentials. In times of crisis, as we can see here, this matters.

I think it's also important that, when discussing this app, we take an opportunity to reflect on what is an ever-growing digital divide in Australia. We know technology is not available to all Australians equally, and that if you have access to technology you have access to a greater range of opportunities in Australia than if you do not. This divide is growing larger and larger. It's particularly evident in issues of age, where we know plenty of older Australians have difficulty accessing and using technology. For many years we have seen this produce negative outcomes for their participation in our economy.

If you take the issue of financial payments, not having access to a smartphone and, therefore, to certain payment platforms through the phone that other Australians have makes payments very difficult. During this COVID crisis, more businesses have moved to not accepting cash or trying not to accept cash, changing to digital payments, which leaves those without access to these sorts of technologies even further behind and even more anxious about how they participate in the economy and participate in our world. We are seeing fewer bank branches and fewer ATMs. We are seeing banks and businesses rely more on contactless payments. This app just represents another example, like contactless payments, where the divide between those who can afford and access and use technology is far greater.

There are plenty of people, I'm sure, in Australia who would like to download this appropriate, participate in what government is doing here and be part of protecting their fellow citizens from COVID-19, but, because of their lack of access to the right technology, they're not able to do so. As our reliance on technology grows stronger and, indeed, as government's reliance on personal hand-held technology in their policy responses grows even stronger, we need to have a conversation in this place about how we ensure that we don't have a whole section of our community left behind by this digital divide.

Notwithstanding these issues that I've raised, I support the development of this app and, as I said, I did download the app. I was happy to do so and happy to participate in supporting my community and protecting my community the best I could. If it's used appropriately, if it's implemented properly, it will be an important tool in our fight against this devastating virus. But just because I've said it's important, just because I've downloaded it, does not mean I do not acknowledge the privacy risks and the issues around data sovereignty and digital access, as I've raised today. I think it's important that we have that conversation. It's not a single conversation. It'll be an important part of our role in monitoring the rollout of this app and the use of this app to ensure those issues are carefully looked at and carefully managed. It's over to the government now, with the app's implementation, to protect Australians' privacy, sovereignty and, ultimately, health. We will be watching them closely, but, in the interim, I'm happy to support this app.

Matthew Canavan (Queensland, Liberal National Party) Share this | Link to this | Hansard source

I rise to support this bill, the Privacy Amendment (Public Health Contact Information) Bill 2020, and to commend the government for their timely rolling out of these protective measures that are supporting the good outcomes that we have seen so far in our fight against the coronavirus. I think we in this country can take pride in having established a record of firsts when it comes to taking action against the virus. We were one of the first countries to restrict travel from Wuhan, and China, where the disease originated. There was some controversy when we did that. Some believe that that was an overreaction, but it has proved to be incredibly wise and prescient of us to have taken that action. Likewise, it was followed up with further restrictions on travel as the disease spread to other countries in the world. Obviously, we took extremely serious action to shut down businesses and reduce the risk to Australians—some of the first in the world, particularly given the scope and scale of the virus at the time that we took those actions. And here we are today discussing the use of an app in Australia which has been rolled out and has already been out there for a few weeks, and we're one of the first Western countries in the world to have this technology up and running. I do recognise that some other countries, like Singapore, have this app ready to go. It's technology they had in place, given their experience with SARS and previous pandemics, but the Australian government has been very quick to see what worked around the world and adopt those technologies for the benefit and health of Australians as soon as possible.

This app is designed to be one of the measures we are taking to reduce the risk of coronavirus, and it's going to become even more important as we take the essential steps to open up our economy and to help people get back on their feet, get back into their job and reopen their business to the extent they can. What will become extremely important in that environment is our ability to test for and trace and suppress outbreaks of the virus that almost inevitably will occur from time to time.

I want to pay tribute to our health authorities that are already doing tracing, or were doing tracing pre the COVIDSafe app, for their performance and their work. It's a laborious and intensive process, and I do commend the health authorities for what they have done. And, even without this technology, they've done a remarkable job in quickly getting on top of outbreaks, be they in aged-care homes or, more recently, in the abattoir in Melbourne. Those frontline workers deserve our enormous gratitude. Their systems are working well but they are not fail-safe systems; they do rely incredibly on the goodwill and cooperation of people who are infected—and their memory. As we know, one of the risks with this virus is its long incubation period compared to other coronaviruses or flus, and that means those that are infected have to go back a long period of time, up to 14 days, and try to remember who they had close contact with, for following up all those potential cases. That's obviously not a foolproof process. Technology can help and assist here, and that's what this app is all about.

I want to put it on the record that I do understand the concerns that some have expressed around privacy. I do understand that those concerns are elevated when data is being provided to governments. Even though the Australian government will not itself access this data, it's being provided, potentially, to state and territory government authorities—which I will come to. I completely understand the concerns about data provided in that way. It has to be well managed, protected and regulated. That's what we're doing here in this bill, and I support that.

I also support the rights of those Australians not to download the app. Although I have encouraged and do encourage Australians to do so—and I will get to the reasons why I think it's important to do so, even for your own purposes—I do want to say that we should respect those who have a different view. We are very fortunate to be a free and open society where we tolerate differences of opinions, and, as I said, there are legitimate concerns there, but, on balance, I think they are being protected rightly, and we should download this app. But if that is not the view of some Australians, I respect that and I think their decision should be respected.

Notwithstanding that, we have seen, of course, millions of Australians taking action to download the app. I welcome that and encourage more to do so. I do so because I think this app is of incredible importance to the individual, to the person themselves, not just to protect the community. If I were to be infected—and I hope that I won't be, but if I were to be infected—I'd want to provide information to authorities about who I'd been in close contact with in the previous 14 days. I'd want to be able to cooperate. And I think most Australians would. This technology can be a tool to help you do that, because it is difficult to remember where you've been and what you've done two weeks before. So having a piece of technology that helps record that effectively for you, automatically, I think is of enormous advantage.

I use other apps, like Google Maps, which provide data, information, to a third party. I use them because I don't want to go back to the world of the UBD—it's a lot easier to use apps like Google Maps. There's also great benefit in using social media to connect with other people. You do give up some data there, but you get a corresponding benefit. Likewise, here, yes, the data, the information, is potentially provided, if you're infected, but you get a corresponding benefit in terms of being able to help and assist our frontline health workers, who are doing the best they can in difficult environments. As I said earlier, we should be supporting those Australians who are out there on the front line of our health system, and this app helps support them.

It's not our only tool, of course, but the fact that the government has been able to roll it out so quickly is imperative. I do want to get to the fact that we're strongly protecting the data in this app, and doing so here with this legislation today. I think it's important to stress, as other speakers have, that, while the app is on your phone collecting data, the data is only stored on your phone for that period before you may be infected. The data is not recording location or where you've been; all that it's recording is simply bluetooth interactions with other phones that have the app that are in close proximity to you at the time. It makes a record of those over time, and only if you then choose does the data get uploaded to the state and territory authorities who can access it to help with their test and trace activities. So you'd only choose to do that if you had to provide that information, which would be in the event of you having been infected and being asked to track and trace back who you had been in contact with. So you control the data. You control it. You don't lose control of the data by just downloading the app. You only upload the data when and if you're in that situation of having to help our health authorities, and I think that's a well-designed feature which should be widely advertised.

As we've outlined in this bill, we're making sure we put added protections in place to ensure the information can only be used for the purposes of testing and tracing for the COVID-19 virus. That was outlined in a regulation made by Greg Hunt when the app was launched a few weeks ago. What we're doing today is enshrining those protections in legislation. I don't believe protections of this nature have been used before, but it shows the seriousness with which we're fighting this virus that we are enshrining specifically in law that the information collected here can only be used for these purposes and no others. And penalties will apply if people are using the information for other reasons.

I'll finish where I started: that we have been able to achieve the remarkable reduction in coronavirus cases because we have been taking first steps—because we have been moving ahead of the curve, so to speak. The rollout of this app is another example of where we are doing that. I'd encourage all Australians to do it. I commend the government for getting it out so quickly and for the protections they're enshrining in law today.

Kristina Keneally (NSW, Australian Labor Party, Deputy Leader of the Opposition in the Senate) Share this | Link to this | Hansard source

I rise in support of the Privacy Amendment (Public Health Contact Information) Bill 2020. I and the Australian Labor Party are supporting this bill because it will protect and enshrine in law the protections the Australian public deserves and expects when it comes to the government—to any government. I want to thank the close to six million Australians who've downloaded the COVIDSafe app. I do encourage more people to download it. This is just one small step that Australians can take as part of our national effort to stop the spread of COVID-19.

Downloading this app does not replace hand washing or hand sanitising. It does not replace social distancing. And we must remember: there are still people in our community with health problems or compromised immune systems, and we should refrain from visiting them. Importantly, if you are sick, do not go to work. The app does not solve any of those problems. It is an assistance to our effort to ensure that COVID-19 remains flattened and the community remains safeguarded from the virus.

COVID-19 does still exist in the community. We have undertaken a monumental effort to suppress its spread as much as possible. Children stopped going to school and started learning from home, teachers learned how to move their classes online and parents became teachers' aides. Hundreds of thousands of Australians have worked from home. Sadly, many thousands have lost their jobs and been forced to stay at home.

Now, as our combined health efforts continue and we begin the economic recovery, we must look at ways we can ensure the virus does not take hold in our country again. This app is one of those ways, and, with an app like this, the law must protect the privacy of Australians. Prior to the release of this app, state and territory public health officers have undertaken manual contact tracing. Manual contact tracing means someone diagnosed with coronavirus painstakingly trying to remember the people they have come into contact with and when. While our public health officials have carried out excellent contact tracing in this country, even if you have a near-perfect memory or an impeccable diary, there will always be gaps as to who you have come into contact with. The contact tracing app, this app, relies on technology to digitise this process, to supplement, not replace, manual or paper based tracing, to make sure we can continue to suppress the virus. Not only does the app provide the opportunity to improve the timeliness of contact tracing, it also offers the opportunity to improve reliability.

To be a valuable tool, the app has to work. Australians have to have confidence that there are sufficient safeguards in place to ensure that their privacy is protected. The government released the app with some safeguards in place. The health minister made a determination under section 447 of the Biosecurity Act in relation to the COVIDSafe app on 25 April. The determination included a number of privacy protections for information that Australians provided to the app, and now this bill replaces that determination. Through this crisis, particularly when it comes to passing important legislation, Labor has always been constructive. We have not stood in the way during this unprecedented crisis, because it has required an unprecedented response. That's why we will support the passage of this legislation.

While not perfect, the bill will introduce very strong privacy safeguards. In some respects, these safeguards are unprecedented in Commonwealth law. Like the determination which preceded it, the bill would make it an offence to collect, use or disclose app data except in a number of prescribed circumstances. These include where the collection, use or disclosure of the data is by a person employed by a state or territory health authority for the purpose of contact tracing. The bill would also impose a range of obligations on the Commonwealth, including: to ensure that COVIDSafe app data is not retained on a mobile telecommunications device for more than 21 days; to delete all of an app user's data from the National COVIDSafe Data Store as soon as practical, upon request; and to delete all COVIDSafe app from the National COVIDSafe Data Store when the health minister is satisfied the COVIDSafe app is no longer required to prevent or control the spread of COVID-19 in Australia.

Labor—in particular, my Parliamentary Joint Committee on Intelligence and Security colleague the shadow Attorney-General—has worked with the government to improve the legislation and strengthen protections that the Australian people deserve. I thank the government for accepting a number of those suggestions. There will now be greater oversight of the COVIDSafe app by the Privacy Commissioner. The Office of the Australian Information Commissioner is an independent statutory agency overseen by the Australian Information Commissioner and Privacy Commissioner. The legislation now requires the health minister and the Privacy Commissioner to produce regular public reports about the app every six months. There are now additional oversight and certification responsibilities on the Privacy Commissioner to ensure that the Commonwealth complies with its obligation to delete all COVIDSafe data when the app is no longer in use.

It is reasonable to see how the Privacy Commissioner's workload will increase as a result of these important responsibilities. Labor urges the government to ensure that the Privacy Commissioner has sufficient resources to fill the additional oversight responsibilities. The Office of the Australian Information Commissioner should not be stretched or have to reduce its other capabilities to undertake these important COVIDSafe app oversight duties. Importantly, there is a new provision clarifying that law enforcement and intelligence services may not be given any role in administering or accessing the COVIDSafe Data Store. These protections are unprecedented and mean Australian law enforcement officials and security agencies will not be able to access the app data.

There are legitimate concerns about the government's decision to award the data storage contract relating to the app to Amazon Web Services in the United States. This means that COVIDSafe app data may be obtainable by the United States law enforcement authorities. This concern could have been avoided if the government had chosen to award the data storage contract to an Australian based, owned and operated cloud service provider. In fact, at a time when the Australian economy needs as much stimulus as possible due to this unprecedented economic crisis, I'm perplexed as to why the government did not award the contract to an Australian company.

Regrettably, the concerns about Australian web services cannot be addressed in legislation. Australian law does not override American law, in the same way that American law does not trump ours. However, the government—in particular, the Minister for Foreign Affairs and the Minister for Home Affairs—could address these concerns in non-legislative means. The Foreign Minister could seek diplomatic assurances from the United States, and the Minister for Home Affairs could ensure that access to COVIDSafe app data is excluded from any security or intelligence-sharing arrangement with the United States. He could do this as part of the CLOUD Act executive agreement which is currently being negotiated with the United States. I urge the Minister for Home Affairs to pursue this option as it will provide further assurances to the Australian public and hopefully will result in more downloads of the app. If the government wants this app to be embraced by millions more Australians—something that could continue to keep COVID-19 at bay—they would be taking these steps.

There is no 'set and forget' when it comes to social distancing or washing hands, and the same applies to this app. Labor remains committed to seeing how the measures in the bill are being implemented to ensure that they are working as intended. We will do that through the Senate Select Committee on COVID-19, of which I am a member along with Senators Gallagher and Watt from Labor. We have already had the opportunity to scrutinise the app and we will continue to do so because parliamentary scrutiny is one of the pillars of our democracy. It was through the COVID committee that we learnt the health department never provided the government any advice about targets. In an interview on Perth radio station 6PR on 15 April, the interviewer asked the Prime Minister: 'Reports are that as many as 40 per cent of the population might need to download it for it to work. Is that right or not?' The Prime Minister replied: 'Yes, it is. You'd need at least that.' Forty per cent was the target the Prime Minister set, back on 15 April, for the app to be effective. He had no advice from the health department that that was the target needed. However, in question time in the other place yesterday, the Prime Minister stated: 'We have no real target.' He then said that any target related to a percentage of the number of smartphones in Australia rather than to the Australian population. It's easy to get close to achieving a target if you keep moving the goalposts.

It's small things like this that can make the public question their trust in government. The federal government, along with the state and territory governments, have asked the community to trust them. I acknowledge and understand the reservations and the concerns people have had about the idea of this app, because I myself have also had them. As the saying goes, you can't constantly lie and expect the people to trust you. I'm not calling this government liars when it comes to this app or legislation but, for far too long, the Morrison government have treated the parliament, the press gallery and the Australian people with contempt. They have shirked scrutiny and they have refused to be held accountable. They have dismissed legitimate questions as 'gossip' or said they are matters for 'the Canberra bubble'. They've said one thing and then turned around and done another. And far too often the government chooses marketing spin over substance, ads over outcomes, and marketing over what matters. So you can understand why some Australians have been sceptical about an app such as this and the ability of this government to ensure their privacy. Let's remember: the Australian people first found out about this app not because the Australian parliament was advised but because the New Zealand parliament was told about it. The people of New Zealand were told about the Australian government's plan for this app before the people of Australia were.

We will never know if the government's lack of communication and rush to announce this app have impacted the app's download numbers, but there's one thing I will make clear: the COVIDSafe app does not track your location; it only relies on bluetooth, and only when you come into close contact with someone else—approximately 1½ metres—for 15 minutes or more. This data is then stored on your phone and will remain there for 21 days. It will only be released to health authorities if you choose to release it to them, whether it's because you've been diagnosed with COVID-19 or because someone you have come into contact with has. Finally, if you do release your data to state and territory health authorities, it can only be accessed by them. Regrettably, some of these facts weren't communicated clearly or effectively by the government when this app was first announced in the New Zealand parliament. This was a misstep by the government, and they've been having to clean up this mess ever since. This is what happens when you roll out a minister who wasn't aware he was charging taxpayers tens of thousands of dollars for excess internet downloads to be your spokesperson for this app. I commend the health minister for cleaning up after the social services minister and clarifying any confusion the government has created about this app.

I have downloaded this app because I understand the importance to the broader community of being able to effectively contact-trace outbreaks of COVID-19. This app can be a critical tool in the COVID-19 exit strategy if it works well and if our privacy is safeguarded. We definitely won't be standing in the way of the app, and now is definitely not the time for further amendments or political stunts in this parliament. We will not let the perfect become the enemy of the good. We want this app to be a useful tool, and that depends on getting it right. That's why Labor has worked with the government on amendments to strengthen the privacy protections in the app. The government must be as transparent as possible about everything to do with the COVIDSafe app, including providing additional technical information in relation to the app and being up-front about how the app is working in practice.

This legislation will give Australians more confidence that their privacy will be safeguarded if they choose to download the app. It can play a role alongside social distancing, paper-based contact tracing, handwashing, staying at home when we are sick and all of the other public health measures Australians have taken up in order to safeguard themselves, their family, their community and their country against the threat of coronavirus.

Rex Patrick (SA, Centre Alliance) Share this | Link to this | Hansard source

I thank the whips for assisting me as I juggle committee and chamber duties. Centre Alliance will be supporting the bill before the Senate this morning, the Privacy Amendment (Public Health Contact Information) Bill 2020. I will acknowledge that, as Senator Keneally pointed out, the government has been quite willing to negotiate amendments and work with other parties to improve the bill. In fact, Centre Alliance have been talking with the Attorney's office and have worked with the government on a number of amendments. There are still some amendments that we will put to the Senate during the committee stage. But, in principle, the process has been good, and I thank the government for that.

I'm on record as saying that I haven't downloaded the application, but I'm neutral as to whether people should or shouldn't. It's a matter for their own circumstances. I have been concerned that the protections that have been put in place have been done by way of ministerial determination, because that means that, with the stroke of a pen, they can be changed at any time. I think what's happening today makes it a much more robust arrangement and certainly puts me much more at ease in respect of the privacy issues. So I think that's a tick in the box, assuming this passes the parliament today.

There are some concerns about the application, however, that I think we need to air and that the government needs to be up-front about. As I said, I'm neutral; I think everyone should download the application based on their own circumstances. I think there are likely to be fewer and fewer privacy reasons now for not downloading it. However, I think we need to be up-front about the performance of the application. We are asking people to download an application that sits on their phone, and we know, anecdotally—as I've heard from a number of people I've talked to that have the app—that it drains the battery pretty quickly, for example. That's a small penalty to pay in relation to dealing with a pandemic, but only if the application ends up having a useful effect.

This leads to a couple of issues which I think need to be addressed, the first being that this application originated in Singapore. When it was first talked about, there were discussions about its origin and the fact that 20 per cent of the Singaporean population had downloaded the app. Yet at the COVID committee I asked—and have not yet received a response—whether or not the Australian government sought any advice as to the app's effectiveness. What effectiveness does a 20 per cent take-up give you in terms of health outcomes? We heard the Prime Minister talk about 40 per cent here. But, as the Department of Health confirmed, we did no modelling, so we don't know whether 40 per cent gives you 2X, 3X or 4X in terms of outcome. It's not been modelled. We don't know, because the department hasn't modelled it, what the right take-up is. I think that is a problem and it's a problem that should be addressed. We want to make sure that we have legitimate targets for the population. There is a report out of Oxford university that suggests the take-up rate needs to be above 50 per cent. I think we just need to be straight-up with the Australian public, and we also need to know these numbers ourselves so we can make sure we pitch and contribute to achieving those numbers. Is this linear in terms of the take-up verses the outcome, or is there some sort of other curve shape that says the application is pretty much useless unless at least 30 per cent download it? I'd like to see that data; I'd like to see the modelling done. The government hasn't committed to doing that, and I think that's a mistake.

The second area of concern is how effective the application is. In the COVID committee, we asked officials about whether or not the application is actually effective. The answer was talk about how many people had downloaded it. That's the answer to a different question. There are concerns—and the DTA gave evidence to the Senate—that there is degradation in the performance of the application in circumstances where the application is in the background, or, indeed, in circumstances where the phone is locked. I think it's proper that that deterioration be quantified, and that information should be provided to the Australian public. I have put questions on notice asking for the test data to be provided to the Senate, and obviously to the Australian public, and hopefully the DTA will be compliant in providing a significant amount of test data—not just the best cases but also the situations where it doesn't work at all, the point being just to be open and upfront.

From all the evidence that I heard, I suspect the application is not doing very much at this point in time. That's not a criticism of government. Back when the application was proposed, we were in a different situation than we are in now. We were looking at the upside of a curve. We're now looking at a flattened curve. I applaud the government for throwing everything at this application when it was conceived, for saying, 'This could be a tool that will contribute.' But, if there are problems with it, just be honest with the Australian public. Let them be well informed so that they can make a good decision about downloading it. If it's the case that it's not working well now, but in two weeks time we get an upgrade from Apple and Google, as foreshadowed in respect of bluetooth, we then let the public know that, and we don't take a marketing approach. We take a well-informed approach where we inform the Australian public.

I thought it was worth sharing that with the Senate. I do support the bill and I do support the application. As the bill lays out, it is a matter of choice for people as to whether to download it. Let's be very open and honest about its utility, about how well it is working at this point in time and about what the required uptakes are, such that we can protect the Australian public. I commend the bill to the Senate.

Sarah Henderson (Victoria, Liberal Party) Share this | Link to this | Hansard source

It's my great pleasure to rise and speak on the Privacy Amendment (Public Health Contact Information) Bill 2020, a bill that I commend to the Senate. I'm pleased to see bipartisan support for the bill. This is the first time I have spoken in the Senate since the outbreak of the coronavirus pandemic. I want to place on record first and foremost my thanks to the Australian people. The response to the pandemic has been extraordinary. The ability of the Australian people to stand up, to listen to the government, to listen to the professional medical advice, to listen to our frontline health workers and to respond as they have has been incredible. We have seen a dramatic flattening of the curve. I think most Australians would be very, very proud of how our nation has performed, particularly when you consider what is happening overseas in some countries. I also want to thank the nearly six million Australians who have downloaded the COVIDSafe app. We know that this is not a be-all and end-all but an important tool to slow the spread of the virus. Of course, this bill is all about making sure that there are appropriate health protections.

I also want to pay tribute to the Prime Minister and to his leadership team, particularly Senator Cormann; the Treasurer, Mr Frydenberg; and the health minister, Mr Hunt. The measures that our government have put in place in response to the pandemic have been overwhelmingly positively received by the Australian people. In saying that, I also acknowledge the role of the national cabinet, which I think has been very important as well. Our government is all about making sure that we save lives and livelihoods. Whether it's the jobseeker payment, JobKeeper, the stimulus payments we're providing, the early release of super, the cash flow boost, the government backed loans, the childcare fee relief, the health response, telehealth, our domestic violence response or our response with 100 new respiratory clinics, right across the health sector, I think all Australians can be very, very proud of the work of the national cabinet, including, of course, the work of our government.

I also want to acknowledge and say thank you to our frontline health workers—our doctors, nurses, cleaners and paramedics—and those who work on the frontline in our economy at the moment, in our supermarkets, our pharmacies, our cafes and our restaurants. The restrictions have been very, very difficult. We are seeing an easing of those restrictions. As I said, Australians have responded absolutely magnificently to the challenge, and I do very much acknowledge the incredible effort of all Australians.

This bill is all about protecting the privacy of Australians. We have reiterated and made clear how important it is to download the COVIDSafe app. As the Prime Minister has said, it's a bit like putting on sunscreen when you go out in the sun. It gives us protection as a nation. It is the ticket to ensuring that we can actually ease our restrictions. The COVIDSafe app is an important public health initiative that will keep you, your family and our community safe from further spread of coronavirus. It is all about speeding up contact tracing. Public health officials, of course, are doing a magnificent job, when there is a positive diagnosis, of identifying those who have come into contact with someone who has been diagnosed positively, but the COVIDSafe app speeds up the process. That's why it is so important for as many Australians as possible to download the app.

The app uses bluetooth to look for other phones, like a bluetooth handshake. There is no way that someone's location can be recorded, so it's very, very limited in its use. It only keeps contact information for 21 days, and this covers the maximum incubation period for the virus and the time it takes for someone to be tested for COVID-19. To be effective, users should have the app running in the back ground when coming into contact with others. The phone does not need to be unlocked for the app to work, but the bluetooth does need to be activated. It then securely makes a digital handshake, which notes the date and time, the distance and the duration of the contact. All information collected by the app is securely encrypted and stored in the app on the user's phone. No-one, not even the user, can access this information. Unless and until a person is diagnosed with COVID-19, no contact information collected in the app is disclosed or able to be accessed.

There are very, very strong privacy measures already in place with the app. There have been a number of amendments that have also been accepted, and they are to ensure that there are strong ongoing and further privacy protections to support the download, use and eventual decommissioning of the Australian government's COVIDSafe mobile application. Very briefly, the key additional protections which have been included are that the Office of the Australian Information Commissioner will have oversight of the COVIDSafe app data. The Information Commissioner can manage complaints about mishandling of the COVIDSafe data and conduct assessments relating to the maintenance and handling of that data. The Privacy Act's Notifiable Data Breaches Scheme will be extended to apply to COVIDSafe data. There will be clarification of the interaction between the powers and obligations of the Information Commissioner in relation to COVIDSafe data with the powers of state and territory privacy regulators and the Australian Federal Police. The administrator of the national COVIDSafe data store will delete users' registration data upon request. An individual will be required to delete COVIDSafe data if they receive it in error. No data can be collected from users who have chosen to delete the COVIDSafe app. A process will also be put in place for COVIDSafe data to be deleted at the end of the COVID-19 pandemic, and users will be notified accordingly. The amendments also make changes to some of the language used in the Biosecurity Act determination in order to better match the language and the structure of the Privacy Act. A couple of other technical changes which ensure the workability of the amendments will be included. It's now clearer that penalties do not inadvertently apply to individuals, businesses or agencies who only collect COVIDSafe app data incidentally to the collection of non-COVIDSafe app data, such as backing up mobile devices. In essence, we have been very receptive to some of the concerns that have been raised in relation to the privacy of the COVIDSafe app.

I would like to finish my contribution by again calling on all Australians to please download the app. It is incredibly important. Of course it doesn't replace all of the other health advice which is so important—the social distancing, maintaining a space of at least 1.5 metres from anyone else, essentially acting as if people that we come into contact with actually have the virus to minimise the spread of the virus, the hand washing, and all of the other critical health advice which has been provided. If we can speed up that contact tracing through the app, this will of course ensure that we can mitigate the risk and minimise the spread of the virus. Again, I want to say thank you to the Australian people for everything this nation has done to slow the spread of the virus and to respond so magnificently to this pandemic. I commend this bill to the Senate.

Andrew Bragg (NSW, Liberal Party) Share this | Link to this | Hansard source

This is Australia's ticket to normality in the form of an app. Before I touch on the app, I do want to reiterate the remarks made by other senators about Australia's performance in the face of this pandemic. There is no other jurisdiction, no other country, you'd rather be living in than Australia at this juncture, based on all the health factors, whether that be transmission or whether that be fatalities. We've been able to do that while keeping large parts of the economy open, which I think is very encouraging and obviously a better result than some other jurisdictions.

In terms of contact tracing, which is something that I've experienced as someone who unfortunately contracted the coronavirus, it is a very manual process. It does require you to sit down with state health officials and try to piece together where you've been and who you've been in touch with so that other people can be made aware that they need to self-isolate. In my case, I had basically 10 days between transmission and actually being diagnosed with coronavirus. In that time I travelled throughout the metropolitan and country areas of New South Wales, and I came in touch with many, many people. The level of anxiety that you have when you think that you may have infected someone with coronavirus is quite high. If the speed and accuracy of contact tracing can be improved through an app, then that is going to relieve the anxiety and really improve health outcomes. In the case of my interaction with Senator Patrick, if the app had been already up and running and we'd both had it on our phones, it's a fair case to say that I probably wouldn't have been able to pass on the coronavirus. That is a real-world example of the app in practice.

It doesn't track your geolocation. It does not use location services. It uses bluetooth technology to do a digital handshake when you have come in touch with someone—really close personal contact—for 15 minutes. We're talking about a metre and a half apart. It makes a digital record, and then that's able to be stored away in the case that someone is diagnosed as a positive case.

The privacy safeguards, I know, are very important to people and have been the subject of some debate. This bill establishes that the OAIC will run the arrangements. It establishes rules for the collection, use and deletion of data. Very importantly, it ensures that the data is only available to the health workers in each state and territory. That means that it is only people who need to undertake contact tracing who will be able to access the data. We have established it as a criminal offence for anyone to use that data in any other way.

There has been some discussion this morning in the chamber about the question of whether or not this data could be transferred to another jurisdiction. There is no case to be made for that in any way. The laws that would be passed by this parliament if this bill is endorsed by this chamber would make it a criminal offence for the data to be transferred to another country. Just because a company, Amazon Web Services, which is doing business in Australia happens have a US parent, it doesn't mean that Australia's laws don't apply. Australia's laws always apply. Frankly, this sort of nativism and anti-international agenda, whether you're looking at migration or foreign investment, has no place in a modern society like Australia.

I just want to thank the state health workers, because, having been through the coronavirus, I know that the contact tracing the state health workers are doing is quite a stressful and challenging task. In New South Wales, which is the biggest jurisdiction and has had the most cases—probably because Sydney is Australia's global city—they have really done an amazing job. Yesterday was International Nurses Day. A lot of the people who are doing the contact tracing are nurses by profession. I have a number of nurses in my family, and I'm very proud of them, and I owe a great debt to the people who looked after me and my family in the state health system.

Often people want to think about the esoterics of legislation. This app will relieve the burden on the state health workers who are having to perform manual contact tracing, so the more people who download the app, the lighter the load will be on the nurses and the health workers. But of course it will also have the dividend of providing more accurate and up-to-date information about people who have come in touch with a positive case of coronavirus.

Technology improves lives. I see that every day in the fintech inquiry that I chair. This is another great example of technology giving us a much faster ticket to freedom and consolidating our efforts as a jurisdiction—and this is the jurisdiction, the country, you want to be living in as the world faces this shocking pandemic.

Malcolm Roberts (Queensland, Pauline Hanson's One Nation Party) Share this | Link to this | Hansard source

As a servant to the people of Queensland and Australia, I have pleasure in saying that One Nation will be supporting the Privacy Amendment (Public Health Contact Information) Bill 2020. That doesn't mean that I will be downloading the app, as I'll explain. But, firstly, I would like to compliment the Attorney-General for the work that went into this bill. When Minister Hunt's regulations came out to accompany the app launch, my office had a number of reservations about the level of security provided on the data. This bill was needed to clear up those issues, and it has done so. I will mention these things in passing, for the benefit of our constituents, and then I will move on to the security risks that the app itself still represents.

I did have a concern that the government was giving bad players an opportunity to access data on the server without detection. There are two aspects to this. There is the app itself and then there is the uploading of data to the server and the storing and the use of that data. So I did have a concern that the government was giving bad players an opportunity to access data on the server without detection. The decision to ask the Office of the National Data Commissioner to overview data storage and access is a wise choice that addresses this concern. We are pleased with that.

I was also worried about Amazon having access to both the client file, which is needed to identify app users, and the data file for COVID-positive users. This in effect gave Amazon access to significant personal information of app users. Let me explain bit more. The separation now of the key file and the data file itself, under the supervision of the commissioner, is the best way of making sure Amazon and the government keep each other honest. Well done. In other words, we've got Amazon storing the data and the government having the keys. Both are needed. It can't be separate. Not one party can have control.

There is one issue here to do with the cryptography on the unique user IDs. The open-source app that the COVIDSafe app took as a starting point only requires 32-bit encryption. I had hoped the app developers would have taken that up to 128-bit and would ask the commissioner to consider that.

Let me turn to a number of security issues in the app itself that need to be addressed. My office has put out a detailed sheet on this; so let me quickly mention them here and move on. First, the user ID can stick in the phone case, causing a phone to broadcast multiple different user IDs over extended periods of time, which increases the chances of a phone being tracked. Second, the COVIDSafe app overrides phone security settings to use the same handshake address for a phone over the life of the app, instead of changing every few minutes. This is a major security issue in the app. Third, the COVIDSafe app stores the make and model of the other phones it has matched in plain text, where it can be easily read. This approach is not necessary, since this data could easily be tracked when the app is registered, instead of storing it in the phone.

Fourth, if someone has named their phone—such as, in my case, Malcolm's iPhone—under some circumstances, this real name is what the other phone stores. App users who have named their phone with their real name may be exposing themselves to danger. This results from the app using different ways of broadcasting data to maximise the chance of a match. This tells us that the developers have taken a deliberate decision to compromise safety to achieve the most number of matches.

Fifth, data stored to the cloud is not deleted. If a cloud service is used to back up or sync a phone, the COVIDSafe app contact log gets backed up to the cloud. This can be viewed by anyone with a sign-in without the phone user's knowledge. I acknowledge that this bill makes the behaviour illegal, but not storing some of the data in plain English would have been a far better choice.

Sixth, an app running in the background will not match with another app running in the background on an iPhone. Seventh, the app does not meet the government's own standard for app accessibility, WCAG 2.0 A. It fails accessibility tests on font size and field width. Aren't people with a disability the first people that need to get this app? So that was sloppy.

Eighth, errors that were detected early in the release of the app have still not been fixed. Registration fails over wi-fi, which is used in poor reception areas. Bluetooth conflicts with external devices. Power management on an iPhone interferes with the app. Three per cent of older phones cannot use the app. An alert message advising users that they have tested positive for COVID was being accidentally triggered. This was fixed by deleting the message. So, currently, the app can't be used to alert users when they actually do test positive.

I must however compliment the government for this sudden concern about security. Where was the concern about peoples' privacy in this government's capture and use of the metadata of every Australian? This government is storing texts, telephone call details, social media posts, websites visited and website comments for every Australian. At Senate estimates, we discovered that, in 2019, there were 297,000 accesses of the metadata records of everyday Australians by 22 different government agencies. How many of these accesses were accompanied by a warrant? None; not one warrant. I understand this government feels the need to get this app in wide use and is prepared to write good data protection rules to achieve that. So I would ask the government to show it really cares about the privacy of everyday Australians by revisiting the wider issue of government use of private data, because the government's track record on security is poor.

As I've explained, the shortfalls initially in our assessment of the app were to do with data storage and access of that. That has now been resolved, or will be resolved once this privacy bill passes. However, the reverse is the case for the app. We were originally happy with the app, and we now see a number of flaws in it around security issues with regard to people being able to track the phone owner, the phone user, and that is not acceptable.

I also want to make a comment about the blackmail that is being used by the government to push this app. Minister Hunt said, 'You want to go to the footy? Download the app.' We have just heard Senator Bragg saying, 'This is our ticket to freedom.' No, it's not. There are far more effective tickets to freedom. The Australian people have already shown a highly responsible approach to managing this COVID virus. We need to stop the blackmail, stop the control that is pushed over us, and we need to get back to the freedoms that are inherent in being everyday Australians. Part of our birthright, part of the citizenry that we have, is that we are entitled to rights and freedoms. When we have permission from a government to do something that is not a freedom. That is the reverse, because it is being withheld until the permission is granted. We need to rely upon the trustworthiness, the competence and the sense of responsibility of everyday Australians right around the country.

Let me summarise by saying that this bill is necessary, and that is why One Nation will be supporting it. It is welcome. Secondly, the app is not up to scratch, and that's why I won't be downloading it. Thirdly, we need to get back to freedom properly.

Richard Di Natale (Victoria, Australian Greens) Share this | Link to this | Hansard source

I rise to speak to the Privacy Amendment (Public Health Contact Information) Bill 2020. Let me start by sending my profound thanks to the many unsung heroes of this pandemic—the doctors, the nurses, the healthcare workers, the patient care attendants and the health officials, all of whom have put themselves on the line. But, beyond health, the childcare workers, the teachers, the scientists, the supermarket employees and the cleaners—the people who have allowed us to continue to function as a society—have, at great risk, sacrificed so much to help save the lives of others and to support us during this critical time.

I've spoken to many of my medical colleagues about the real-world implications of this virus and they have told me some harrowing stories. When the data was emerging from Europe and we heard those stories about what life was like in ICU in Italy and other parts of Europe, I spoke to some of my colleagues who themselves are anaesthetists and intensivists. They were discussing how they would live apart from their families during this epidemic, so that their children, their wives and their elderly parents weren't put at risk. I want to say thank you to them.

At a personal level, of course it has been difficult for many people. I resigned to self-isolate. I didn't think it would be forced on the entire Australian community. I've stayed at home; I've followed the advice of health experts. Lucy, the boys and I are finding new ways of doing everyday things. I know it has been hard on my elderly parents. They miss their grandkids; they miss the social connection. It has been tough on everyone, but it must also be said that it could have been a hell of a lot tougher.

Australia's response so far to COVID-19 has been, by most measures, a success. There's a hell of a long way to go, but, to date, we've made some good decisions and had some good luck because we're an island continent; we're a long way from the rest of the world. There's the tyranny of distance, but, when it comes to a pandemic, there's also the tyranny of proximity. We're lucky that this pandemic reached us in summer. We think there might be some seasonal variation with regard to the way this virus behaves—so, yes, we've had some good luck, but we've also made some very good decisions. When it comes to a government that has made some terrible decisions over so many other issues, you have to ask yourself: why? The simple answer is that this response has been led by the medical and public health experts on the basis of the best possible evidence and modelling. The Australian Health Protection Principal Committee has brought together the vast expertise of our public health community. We are absolutely blessed to have some of the best public health professionals anywhere in the world helping to drive the response to this epidemic. They made some tough decisions early that proved to be the right decisions such as restrictions on travel, particularly from China, then Europe and other countries across the world. We've seen a proportionate response in terms of the restriction of activities, driven—it must be said—by significant pressure from some state jurisdictions. Overall it has led to us flattening the curve, which was our objective at the start.

I have to say, I've asked myself a number of times: why it is that the government decides to listen to the experts when confronting a major threat to our health, yet ignore the experts and the science when faced with a threat not just to human health but to all life on earth? Look at our response to climate change to date. We know what the answer is: a response driven by vested, powerful interest groups; by money; by massive corporate donations; by the lobbying that goes on behind closed doors; and by the threat of campaigns from some of those vested interest groups. Just imagine if, in terms of responding to the threat of catastrophic climate change, this government had put science and expertise front and centre—more jobs, more investment, clean air, energy independence, freedom from the shackles of big energy companies. Yet they have failed comprehensively to deliver.

As I said, the response to COVID-19 to date has been a success. I've tried to cut the government some slack along the way; we are confronted with significant uncertainty when it comes to how we respond to this virus. But it must be said that early on many of the messages were confused and contradictory. It must be said that, when it came to outbreaks like that on the Ruby Princess, there were some very, very poor decisions made. It should cause a rethink to the way we structure border security in this country.

There were many other lessons learnt. We learnt that when it came to personal protective equipment in our medical stockpile, the government simply did not have enough to keep our health workers safe. There was a lot of talk about providing ventilators during the initial stages of this pandemic. But ventilators are no good if you don't have the personal protective equipment to operate them, the gowns, the masks and the face shields. On talking to my colleagues in intensive care units, they weren't concerned about access to ventilators; they were concerned about access to personal protective equipment. Through the course of this pandemic, we've learnt that the medical stockpile was dangerously unprepared. We must learn those lessons and learn them for any future pandemic.

The government have got to make sure that they conduct a detailed review of the medical stockpile not just when it comes to personal protective equipment but when it comes to all facets of the drugs and other equipment necessary when confronted with a pandemic like this. That means ensuring that we've got local manufacturing capacity to produce those goods when and where they need it. We've also called for the government to make the influenza vaccine free for all Australians. We know how critical it is, with the flu season upon us, that vulnerable Australians—indeed, all Australians—protect themselves against the risk of influenza. We do know that if someone were to contract the flu, they would be at significantly higher risk of complications from COVID-19.

We've supported the rollout of the broadscale telehealth item numbers. It has been a hell of a long time coming, and we know now that it has served Australians very well during this pandemic. It's of concern that many Australians aren't seeing medical professionals during this crisis. I would encourage everybody to continue to maintain a relationship with their local doctor, with their community health centre and with practice nurses because those chronic medical conditions—diabetes, heart disease, hypertension—all need to be managed, and need to be managed with regular engagement with a health worker. See a doctor. Make sure that you're getting the appropriate treatment that you need.

The government has to keep these telehealth items in place after this crisis. They are an essential part of modern medicine. They give people more choices about how they engage with health practitioners, and they've got the potential to go some way to bridging the divide between urban and rural and remote communities with respect to health care. Of course, it's not just in health care. We know that, in so many other industries, the move to use online technologies has the capacity to reduce pressures on commuting and to support women in the workplace and more family friendly work environments. We need to speed up support for everybody to be able to access those technologies.

To the COVIDSafe app, I have to start with the government's track record when it comes to establishing legal protection for the use of data that they collect. Their track record is abysmal. From mandatory data retention to the My Health Record site, the government has a history of surveilling its own citizens and failing to protect private information. The data retention laws allowed warrantless access to personal data. We fought against it and we lost. It's absolutely crystal clear that the My Health Record legislation, for example, required amendment, and we achieved that in the Senate as a result of long and sustained advocacy so that personal data could be protected and that important reform could be implemented. We saw people's Medicare numbers, a key piece of identity information, being sold on the dark web. That caught people by surprise. So the government's track record on managing people's data is not good.

However, I am pleased that the government has listened to the criticism directed against it when it comes to this app and is looking at tightening up the protections in this legislation for the data collected by the COVIDSafe app. Of course, it doesn't guarantee that the data's safe. It doesn't mean that there might not be some scope creep in the future, and that's why it is so critical that the Senate support amendments that will be moved by my colleague Senator McKim to further ensure protections. I'd urge all senators to support those amendments.

I say to all Australians: this is clearly a voluntary decision. People need to weigh up the decision for themselves. I've had to do that personally—to weigh up this government's track record on data protection against my role as someone who's been a public health specialist and a GP. I'm aware that, from a public health perspective, this app does have the potential to help contact-tracing officials to more quickly and effectively identify and contact people who may have come into contact with COVID-19.

It's new technology. We aren't sure just how effective it'll be. It's not going to render traditional contact tracing redundant. It won't be a panacea, but it may help and, if it can stop an outbreak faster, it has the potential to save lives. So it's on the basis of weighing up those options and considering that, if we were to download this app, we could potentially save lives that I have decided that I will download this app. Whether we download it or not, it's so critical that we continue to invest in our public health workforce and that we continue traditional contact tracing because that is at the heart of a sustained response to this pandemic. That's why I support this legislation and that is why I will be downloading this app.

Right now the concern is that we are potentially facing, with the easing of restrictions, a second wave. We've seen that in many other jurisdictions, such as South Korea and China, and that is obviously of concern to many of us here. We don't know right now what the pathway out looks like. We know that the hunt is on for a vaccine. I'm watching that closely. There's a very promising candidate here, at the University of Queensland, but the truth is there have been many candidates for vaccines and many failed candidates for vaccines. A vaccine to treat this pandemic is a possibility, not a certainty. Remember, when HIV first emerged, we were promised that a vaccine would be developed within a few years. Many decades down the track, we still do not have one.

Look, many armchair experts will tell you what they believe the pathway out of this is. The truth is that none of us knows exactly what the blueprint to move forward through this pandemic looks like. What I do know is that restricting people's activities has bought us some time and that some of the decisions informed by our public health experts have bought us time. I know that the virus is likely to be with us for years. I know that easing restrictions risks another peak in the pandemic. But I also know that the longer these restrictions are in place the harder life will be for many people.

This isn't a trade-off between health and the economy, because poverty and unemployment and lack of access to education also have a profound impact on peoples' health. It's why we need to continue to invest in the response that's needed, it's why we need to continue to trust expertise and it's why I will be downloading this app.

Slade Brockman (WA, Liberal Party) Share this | Link to this | Hansard source

I too rise to speak on the Privacy Amendment (Public Health Contact Information) Bill 2020 and thank all colleagues who have come previously for their contribution. It's good to see what I think is unanimity around this chamber on the benefits of having a contact tracing app such as this one in place to assist us in dealing with what has been an absolutely shocking pandemic. None of us could have predicted just a few short months ago where we would be today and what we would be discussing today. We probably all thought a few months ago that we would be talking significantly about economics. We would have just seen a budget handed down, and obviously that is not the case. Instead we are dealing with one of the most serious crises to hit the globe in a very long time.

As we look at the way we have so far—and there is a long way to go—dealt with this global pandemic in Australia, I just say the Australian people have been absolutely magnificent in working with the government, both our government and the state governments, and in dealing with this pandemic. I think the Australian people have done themselves very proud indeed. We see them taking the steps required to make sure we deal with this pandemic in a responsible way, in a way that protects the most vulnerable in our community.

As many senators have already said, this app is not a panacea unto itself. This app doesn't mean we can stop washing our hands or coughing into our elbows or maintaining safe social distance or not gathering in large crowds for the foreseeable future. But what this app does do is it adds a very important tool to the toolkit of the public health officials who are attempting to do the contact tracing, which is so important. We've all heard it: the test, trace, suppress. When someone has become exposed and contracted this very dangerous virus, this app will assist greatly those state public health officers who are trying to track down the contacts of that person as quickly, efficiently and effectively as possible.

It's designed to help keep you safe. It's designed to help keep your family safe and your community safe, by slowing down and, as I said, by tracing and suppressing this virus. Early notification of possible exposure is extraordinarily important in dealing with those local outbreaks, which we know will happen and we've seen already—the meatworks in Victoria and the outbreak in Tasmania a little while back. We've seen these outbreaks, and we know that this app will help quickly track and trace the people involved in those outbreaks.

There are significant protections involved, and, like my colleagues, I congratulate the ministers responsible in this area. In particular I'll thank my colleague from Western Australia Christian Porter for his responsiveness in dealing with some of the concerns about the treatment of data when the idea of this app was initially being discussed and as the initial phase of development was underway. I think all the ministers involved in this process have been extraordinarily responsive in making sure we get the balance right. There are understandable concerns and there is a balance to be struck, but I think in seeing the fact that this place seemingly will support this bill in a unanimous fashion recognises that those ministers have been responsive and that the correct balance has been struck.

There are a number of layers of volunteerism about this app. First of all, you choose to download it, and I absolutely encourage you to do so. For those millions of Australians who have, I thank you. When you're thinking about the rest of Australians who are thinking about when and whether to download the app, I would just absolutely urge you to think about why we adopt something like this. We adopt it to help protect our families, our parents, our grandparents. We adopt it to help protect our essential service workers, who many in this place have thanked. I certainly add my voice to the thanks to our many essential service workers, from the health system to those who have been continuing to work in our grocery stores making sure we've got food to eat, right across the economy. Those essential parts of the economy that have kept going at risk to themselves will help to be protected if you download this app.

We are helping to protect the vulnerable, those with a suppression of their immune system due to an underlying health condition. We're helping to protect the old. When my family is out walking in the park we want to say 'G'day' to the older Australian who lives up the road from us. We want to do that in the confidence that we have as many systems and structures in place as we can to protect as many of our vulnerable Australians as we can.

Of course there's a secondary voluntary point in the app, and that is: unless and until a person is diagnosed with COVID-19, no contact information collected in the app is disclosed or able to be accessed. I think that is a very important second part of the way this app functions. It's very important to providing that balance and providing that level of certainty to the Australian public. I really do urge all Australians to think seriously, if you haven't already, about downloading this app, about doing everything we can to make sure that our path out of this pandemic is as smooth and as efficient and as quick as it possibly can be.

Janet Rice (Victoria, Australian Greens) Share this | Link to this | Hansard source

Before I speak specifically on the bill that's before us, I want to use this opportunity to talk about the massive impact that COVID-19 has had on our society and our economy. It's the first time that I've had a chance to speak about COVID-19 and the pandemic in this chamber since it rose, having not been here for the last two sitting days. It is such a massive thing that our globe is going through, certainly within my lifetime: its unexpected nature—how our lives have been turned upside down, how our economy has been turned upside down, how our society has been turned upside down; and then the responses to it—how things that were seen to be impossible we've realised we have to do, like the huge support for the communities in terms of maintaining jobs. Clearly from the Greens' position there's more that we feel the government needs to be doing. But, in general, as a society we are all in it together and we have all worked together to get us through this time of crisis in the best shape possible.

I really want to pay tribute to the people who have been there on the frontline getting us through—the healthcare workers obviously, but those other frontline workers too. I was thinking today, here in Parliament House, at the high risk, having brought people in from all over the country, and there are the cleaners going about their business. They are the people who are on the frontline—they are the people who are having to go from office to office and who are most at risk—and the people working in public transport and the people stocking the shelves at the supermarkets. Whereas, so many of us have had the ability—obviously with its problems as well—to work from home. They are the people whose jobs can't be done from home. So I really want to send my thanks to them.

I also want to acknowledge the huge impacts on people—obviously the people who have lost loved ones, and it's devastating. But at least we can look, because of the work that we've done in Australia, at how the loss of life has been much more limited than in other parts of the world. I really do give thanks for that.

I also acknowledge the impacts on people who haven't lost their lives but are going to have ongoing health concerns. Suddenly their lives have been changed. They thought that life was going forward and they now have to deal with the after-effects of stroke or other neurological or lung problems. And, of course, there are people who have lost employment; people who haven't been able to continue with their studies; people who find themselves not knowing what life has ahead for them; people who are really struggling with the social isolation; and people who are struggling with mental health problems, whether it's young people or older people. People are really doing it tough because of the social isolation and the physical distancing that's going on.

I also want to acknowledge how this pandemic has made very clear the role of government, the importance of having government action and the importance of us all working together, being able to trust that our government is taking action in our interests and that the action is transparent and accountable. It's been a real test for our democracy. I have been pleased to see that, during this pandemic, trust in our democracy has gone up, and that can only be a good thing. Obviously, that trust has to be earnt and that transparency and accountability is crucial.

I move on to the Privacy Amendment (Public Health Contact Information) Bill 2020. First of all, so much has already been said about the privacy issues surrounding the app. I support the remarks that have been made by my colleagues, including the member for Melbourne, in the other place, and my colleague Senator McKim here, and the comments that Senator Di Natale made just before. I'm aware that this legislation concerns privacy issues rather than the app itself, but clearly the two are related. You don't have one without the other. Journalist Bernard Keane has critiqued the app, arguing that it provides a false sense of security. What it will deliver primarily is a false sense of security for people and a sense that something is being done, which, by the way, is standard for technological solutionism. There's a belief that a social or economic problem can be solved with maybe a keystroke and some great, new piece of tech, without anyone having to make hard decisions or undergo sacrifices. It's the inflation of micro-level solutions—'A particular tool will help me with a problem or address a need of mine'—to complex, macro, global-level problems.

The truth is, as we know, that this app is only a tiny part of what needs to be done and it's going to be a long, hard struggle to save lives in the face of this pandemic. COVID-19 has changed so much of our lives and we're not about to snap back either economically or socially. We don't have any silver bullets yet. There's been all the discussion about this app. Regardless of the privacy issues and people's concerns, weighing up the privacy issues with the value of having the app, this app still has faults. I am going to wait and see whether the amendments that the Greens are putting up today are adopted to overcome some of those privacy concerns before I make a final decision to download the app. My decision on whether to download the app has also been seriously influenced by the fact that it actually doesn't work very well on my iPhone. What's the point of me having an app on my phone that isn't actually working when I am waiting in a queue doing my emails or talking to somebody on the phone? It's just when you would want it: waiting in a queue at the supermarket or somewhere for 15 minutes. And, of course, there's the issue of the 15 minutes, as well as the usefulness of it. When you're in those circumstances, when you might be doing something else on your phone and the app is not working, what's the point of it? The technology may overcome these problems, but it's not a silver bullet.

In terms of tackling this pandemic, there is no one thing that will solve it. Even if we get to have a vaccine, its impact will depend crucially on surmounting a range of other challenges: clear science communication, effective public health systems, and effective international aid that supports our neighbours to make sure that people all around the world can access this vaccine as they deal with the same challenges. So much depends on other, harder challenges: how we as a society care for each other, public health, mental health support and income support. These are the crucial issues that we have to face and these are the challenges that this app isn't going to fix. And getting the privacy concerns right isn't going to fix these challenges either.

In particular, I want to talk today about a community that faces a set of unique challenges in the midst of this pandemic. Over the past weeks as we've experienced this pandemic, I've met with several organisations and individuals from lesbian, gay, bisexual, transgender, gender-diverse, intersex and queer communities to check in on their work and get their insight into what COVID-19 has meant for them and the people they work with. Their concerns echo the points covered in the paper put together by Equality Australia, published after they assembled a roundtable of LGBTIQ+ and allied organisations to discuss COVID-19 impacts on LGBTIQ+ communities. Some of the issues that Equality Australia raised include the health disparities which put some LGBTIQ+ people at greater risk of severe health consequences from contracting COVID-19; the mental health disparities, particularly in rates of depression and suicide, which place LGBTIQ+ people at significant risk when faced with physical-distancing measures and greater isolation; a sudden loss of community support and cultural spaces; barriers to finding comfort and connection with our chosen families; and the possibility for some of living in unsafe and/or unsupportive environments. The third broad area of impacts is the historical and continuing experiences of discrimination, which make accessing inclusive health care, support, services and information, and interacting with law enforcement, more challenging, while LGBTIQ+ organisations are themselves insufficiently supported to meet the increased demand for their services. Equality Australia said that this potentially devastating combination of impacts and consequences may be further compounded and magnified for those with additional needs based on other attributes, such as disability or age.

With regard to other LGBTIQ+ organisations, I recently met with Joe Ball, the CEO of Switchboard Victoria. It was incredible to hear about the work that that organisation are doing during this crisis. They've been continuing to provide a support line even as we face a pandemic. They made the hard decision that they wouldn't have volunteers staffing their line, so they've had a massively increased financial impost from employing paid staff. But they also made the decision that the paid staff staffing their helpline still needed to be able to come into their headquarters, because it was just not safe for people, mentally, to have to cope with what they were hearing on that helpline; they needed to be there to support each other. Tragically, I hear that many of the calls they've been receiving are from people who are in fear for their safety because they've had to shift locations or change how they live due to health risks during this pandemic. Their work is crucial and must be supported.

Another organisation I've spoken to is Minus18, who work with young queer people. They are facing compounding challenges because of the massive unemployment that has hit young people. Overwhelmingly, they are people in casualised employment; they are working in the hospitality and tourism industries. They are losing their jobs and have been struggling to be supported, even after that. The Equality Australia report spoke about the resilience, resourcefulness and creativity of LGBTIQ+ people in the face of this crisis. I want to acknowledge and pay tribute to all of those characteristics and more. This is an incredibly difficult time for everyone, and people in LGBTIQ+ communities and their families face unique and acute impacts.

This app tackles a tiny part of the challenges that we, as a society, face. It's a tiny contribution to what needs to occur to keep everyone in our society safe and healthy in the face of this pandemic. I know that much more is being done, but much more remains to be done. We need to be considering more urgent government action to provide more support. LGBTIQ+ people and their families, in particular, must be able to access services without fear of discrimination, and they must have access to safe housing and other services in this crisis. Governments at all levels need to fund these services. They need to be focusing on this as well as applications like this app. They need to be funding the services that people need, from health to housing, and not cut corners on this. I know from speaking to these frontline services that we get amazing bang for the buck from them. Even without any funding, they stretch their resources to the limits. They should be adequately funded and properly resourced as part of the national response to this pandemic.

As we're considering this app today, there is still more work to be done to make sure that it is fit for purpose and that it doesn't compromise people's privacy. But, as I said, it is only a tiny part of what we still need to do to keep our society safe and healthy in the face of this pandemic.

Jenny McAllister (NSW, Australian Labor Party, Shadow Cabinet Secretary) Share this | Link to this | Hansard source

I appreciate the opportunity to make a contribution to the debate on the Privacy Amendment (Public Health Contact Information) Bill 2020. Like many people in this place, I made the decision quite quickly to download the app. I did it with some reservations. The government's record, practically, in securing private information, is not a strong record. But, more concerning, the government's interest in protecting privacy, particularly digital privacy, appears to be extremely limited. My experience with the government is that both their practical capabilities in terms of effecting any protections they may wish to put in place and their willingness to do so have combined to produce a series of problems in relation to government digital projects, and that made me very hesitant. I should, of course, indicate that that hesitation is not particularly about my own privacy; it's about the overall framework for privacy that has been put in place by the government. That said, the government appears to have made quite serious attempts, both in the original determination by the minister and in the bill that is before the chamber at this time, to put in place serious safeguards to support privacy. It's on that basis that we're supportive of this legislation.

My hope is that this experience will encourage the government to give consideration to these same matters when it develops other interventions that also go to privacy. Part of the problem, of course, is that, when we ask the community to engage with the government's app, they've seen all of the other instances where government has appeared indifferent to their privacy, and we reap what we sow. But on this occasion Labor has sought to support the government's public health response, and it has seen that this app represents a sincere attempt to support a broader public health response to contain the impact of the pandemic.

I want to turn to the broad nature of that response. At its heart, the government has asked all Australians to trust the health advice being provided by government and to trust in one another that, together, the actions that we all choose to take voluntarily, without compulsion, will support the health of our citizens. Not everybody is equally vulnerable to the impacts of COVID-19. It's clear that people with pre-existing health conditions are more vulnerable both to contracting the virus and to the impacts of the virus. It's clear that there are some parts of our community for whom the social determinants of health render them vulnerable over their lifetime to poorer health outcomes who are themselves more vulnerable to the impacts of the virus. In my own conversations in my own family, I've made it clear to younger family members that, yes, they may not be impacted as severely by this virus, but older people in our community, people that they know, people that they love, are likely to be impacted and it's on that basis we all have engaged in the social-distancing measures that have been requested of us. It is fundamentally an approach built on trust—trust in the scientific advice, trust in the medical advice, trust that government is acting in our best interests, trust that governments are collaborating within the federation to protect the Australian community, trust that all of the people around us—all the people in our neighbourhoods and in our workplaces—are doing our best with the advice we have to prevent the spread of the virus. It makes us realise what an important asset trust actually is in a democratic system. It should provide cause for reflection in this place about what is required amongst parliamentarians, amongst political representatives, to build and sustain trust, not just in this policy area but in all policy areas, because it is fundamental to our ability to respond to the circumstances we find ourselves in now and it will be fundamental to our ability to respond to challenges that will arise in the future.

I do want to sound a note of caution about over-reliance on the app as a public health solution. The government laid out a range of measures necessary to protect the community, and we shouldn't think that the app itself provides a kind of magical protection. Indeed the government's own criteria for take-up of the app seems to have changed dramatically. At first it was indicated what was required was 40 per cent of the population. It now appears the goalposts have moved and what is required for the app to be effective is 40 per cent of the adult population who use a mobile phone. That shift alone should provide some indication that this is not an exact science and, in fact, what is required is the implementation of a whole suite of measures, most of which do not rely on technology. Most of the measures rely, as I said earlier, on individual citizens taking a decision to voluntarily make choices that will protect fellow citizens by limiting our interaction with one another.

I do think that now that we have moved out of the acute phase of this crisis and into what will be a long period of transition back to some kind of normality, we should think carefully about the opportunities to engage civil society in support of that objective. We are blessed with leaders right across our community who stand up in their local communities and voluntarily play a role. They choose to play a role as a leader of a sporting association, choose to play a role as a leader in a school P&C, choose to play a role as a leader in a local environment group. These are leaders who are fundamental to establishing the kind of trust at a local and personal level within a community that allows our society to function. They are leaders who are not often recognised but who would be immensely valuable in the fight we are presently engaged in to contain this pandemic. They are probably infinitely more powerful than an app and, as we develop our response and roll it out across the community, we ought to be thinking about the kinds of community engagement that might be possible if we really leverage the power of civil society to respond to the challenge before us.

This app is important. It will give our remarkable public health officials new tools to engage in contact tracing. It will supplement the data that they already have before them when they engage in that contact tracing process. I want to place on record my thanks, particularly to the health workers in my home state in New South Wales, who have been working so hard, such long hours in a sensitive environment with people who are unwell, for engaging in contact tracing. This app will do a great deal to support their work and it's on that basis we provide support but we do need to remember that the public health response is much broader than simply a piece of technology. I urge government to continue thinking about that, to be respectful of the community, to understand that a genuine response over a long period of time is going to need to involve many, many people and that the best way to do that is through transparency and an overall posture of respect to those many leaders in our community who already do so much to keep all of our organisations working.

Tim Ayres (NSW, Australian Labor Party) Share this | Link to this | Hansard source

I am very grateful for the opportunity to make a few remarks on the legislation before the Senate, the Privacy Amendment (Public Health Contact Information) Bill 2020. Labor's proposition for this legislation is the same as Labor's approach to all of the government's responses to the COVID-19 pandemic. In all of the government's public health and economic responses, we have taken a cautiously constructive approach. We have pointed out where there are problems. We have supported through this parliament wave after wave of economic propositions. The first tranche of the government's economic response was clearly insufficient, and we pointed that out at the time. With the second and third tranches of the government's economic response, we pointed out the deficiencies of all of those propositions but supported them through this place. That's the approach that we've taken in relation to the COVIDSafe app.

I do think that our approach in relation to the COVIDSafe app has been more successful in developing change in the government's approach to the legislation and the practical implementation. There have been some constructive changes and constructive discussions that have happened over the last couple of weeks that have improved the application of the COVIDSafe app. Those safeguards are, I think, useful in improving the operation and privacy aspects of the app. But, critically, our job as members of parliament is to make sure that we're encouraging as many Australians as possible to sign up to and to use the app properly to maximise its effectiveness.

There are new provisions that impose six-monthly reporting requirements on the Minister for Health and the Privacy Commissioner in respect of the COVIDSafe app. There is a new provision that confers additional oversight and certification responsibilities on the Privacy Commissioner to ensure that the Commonwealth complies with its obligations to delete all of the COVIDSafe data when the app is no longer in use. There is also a new provision—there because of Labor advocacy—clarifying that law enforcement and intelligence services may not be given any role in administering the COVIDSafe data store. Those are very significant improvements. Those changes are only there because Labor has engaged in constructive negotiations and discussions with the government. It doesn't mean that the bill is perfect. It doesn't mean that all of the issues are resolved. But we do believe that the perfect should not be the enemy of the good.

We believe that there should be a unanimous view coming out from leaders in the community, encouraging Australians to sign up to the app. But that hasn't been the approach that everybody in the parliament has taken. Some members of this parliament—all of them on the government side—have taken the opportunity to yahoo and carry on in their communities, and a number of them have quite deliberately set out their personal objections and encouraged other Australians to take a cynical approach to the app. That's been, I think, quite destructive.

I was being interviewed on radio in New England shortly after the local member, Mr Joyce, had been interviewed. He had been telling anybody who would listen that there was no way that Barnaby Joyce, the member for New England, would be signing up to the COVIDSafe app. I don't criticise Australians who make the decision not to sign up to the app for making that decision. That is entirely a matter for them. I do say that people in positions of leadership, people who've had significant positions of leadership in this country and who, it appears, aspire in the future to have significant positions of leadership, have a responsibility to use appropriate language. Those who aspire, in a quite uniquely destructive, National Party kind of way, to future positions of leadership, like that which we saw over the course of the last week—I don't think the word 'spectacle' does justice to what happened in Eden-Monaro over the course of the last week—where we saw the spectacle of that toxic self-interest unfurl and unravel for the Australian people, have a responsibility to use cautious language, to use language that's appropriate and to actually have read a few things before they open their mouths.

There are significant issues that are given rise to when there is an app like this that collects the kind of data that it collects, and it's quite appropriate for people concerned about civil liberties and about privacy to ventilate those concerns and to make sure that those concerns are satisfied. That is not what the member for New England was doing. He has never before in his political life shown the slightest regard for issues of privacy or of civil liberties. What he was doing was a sort of performance art, yahooing for the crowd in an effort to garner the support of people who are cynical about the government's activities in this area.

I haven't seen Mr Joyce talking about the data that people hand over to Google or the data that people hand over to Facebook. He's been nowhere to be seen on some of the difficult questions that government and our intelligence community have had to grapple with, in terms of the appropriate levels of privacy protections and data protections, when dealing with the kinds of issues that they deal with. He's been nowhere to be seen on any of those issues. But on this issue he's been popping up on regional radio, as a sort of toxic dwarf, trying to garner support for himself. That's not a model of leadership for members of parliament or senators. That's not what's happened for the majority of the parliament.

There are criticisms—I think valid criticisms—of the approach that the government has taken. I listened carefully to the comments that Ed Husic made about the government's decision to award the data storage contracts to Amazon Web Services, and I think his remarks were—I appreciate now in hindsight—a useful commentary. There were alternative Australian providers of data services who could have been considered. The government has chosen an overseas provider, and that comes with some risks. Some people say the requirement for individuals to download COVIDSafe is too narrow; the bill doesn't ensure that the COVID app data is retained in the data store for the minimum period necessary to complete contact tracing; and the bill doesn't prescribe some of the appropriate core design principles. Those are, I think, legitimate criticisms, but we are where we are and the legislation is in front of us. Improvements have been made, and I think it's time for the Senate chamber to support the legislation and move forward.

Five million Australians have downloaded the COVIDSafe app. It is not clear, and it has never been clear, what the threshold is for COVIDSafe to be effective in doing its work. At one point, the government said 40 per cent of Australians signing up was an effective level. The government's backtracked very quickly away from that proposition. It is now unclear—and I hope that this is dealt with in the course of the Senate committee inquiry into the government's coronavirus response—what an effective level is for Australians to sign up and properly utilise the COVIDSafe app.

As I say, it's very important that the legislation is passed. It's very important that Australians download the app. It's very important that Australians use the app properly—making sure their bluetooth is turned on when they leave home; making sure they do all the right things—but, as Senator McAllister said prior to me stepping up to make a few remarks, it is not a magic response that is going to take the place of all of the other things that must occur to keep Australians safe in the context of this virus. We cannot have an overreliance on the COVIDSafe app. We need to encourage Australians to participate in it, but we can't allow that to become a reason for Australians not to follow the directions of public health authorities and not to do the things that we have so successfully done as a community. We still need to do social distancing, probably for many months to come. It's true that each of the states has had a different response and a different approach to the restrictions that have been applied to Australians and Australian businesses over the period. It is very important that Australians in each of our communities follow the directions and work constructively with the state governments.

The national cabinet has been an interesting process to observe. In some respects, the national cabinet has helped, I think, this Prime Minister to not make some pretty bad decisions. The national cabinet's been pretty useful at restraining some of the Prime Minister's worst instincts when it comes to dealing with the crisis. When you look overseas, you can see the sort of robotically conservative politics that we've seen in the American political system. We must guard against that kind of behaviour, that kind of politics, emerging on the Australian scene. There are plenty of people on the other side of politics who are interested in promoting those sorts of propositions. We've seen armed demonstrations inside state parliaments in the United States—people with weapons charging into the parliaments. That's not the American democracy or politics that I remember being such an inspiration to democracies around the world.

We've seen strange copy demonstrations around the country. The Prime Minister says it's okay for people to go and do that, and I suppose it is if they follow the social-distancing requirements. But we have seen emerging expressions from some members on the other side of politics—some members of the Liberal Party, particularly in Victoria, really starting to harden their opposition to the approach that the Andrews government has taken. It's a narrow, shallow, venal approach that has been, I think, a real problem in terms of our job here, which is to inspire confidence and trust from the Australian people in the government's approach. I noticed Mr Tim Smith, a local MP that nobody had ever heard of before, on his feet and getting stuck into the Andrews government's approach. That's inconsistent with where the Prime Minister's been and where the national cabinet's been. It's inconsistent with the kind of unity that we need to inspire around our struggle against this dangerous pandemic virus, and it's inconsistent with the approach that we should be taking to the legislation that's in front of the Senate this afternoon.

Marise Payne (NSW, Liberal Party, Minister for Foreign Affairs) Share this | Link to this | Hansard source

I thank all senators for their contribution to the debate on the Privacy Amendment (Public Health Contact Information) Bill 2020 today. The bill will implement the strongest possible ongoing privacy protections for data collected and generated by the Australian government's COVIDSafe app. Passage of this bill today will give the Australian public the greatest confidence that their personal information is secure when they choose to download and use COVIDSafe, thereby helping Australia to combat the spread of COVID-19.

The bill was designed to replace and enhance the interim privacy protections for COVIDSafe app data that were provided by the Minister for Health's biosecurity determination. This bill, very importantly, enshrines these privacy protections in primary legislation by inserting a new part into the Privacy Act 1988. Key provisions from the determination formalised by the bill include the criminal offence for unauthorised collection, disclosure and use of COVIDSafe app data and the criminal offence for requiring another person to download and use COVIDSafe or upload their data to the national COVIDSafe data store.

The bill also goes further than the determination. It does this by introducing new additional privacy protections, the most significant of which extends the Australian Privacy Principles, the Notifiable Data Breaches scheme and the oversight of the Australian Information Commissioner to COVIDSafe app data. This means that a breach of the bill will also be a breach of the Privacy Act, including cases of breach by state and territory health officials.

This is not the only privacy protection that this bill strengthens. The law now includes provisions that guarantee no further data can be collected from former COVIDSafe users and that establish a clear, legislatively defined process for how all data in the national COVIDSafe data store will be deleted when the COVIDSafe app is no longer required.

A number of points have been raised in the debate today. Let me refer to those briefly. Firstly, the contract with AWS is a combination of hosting, development and operational services, which is more extensive than services provided by pure hosting providers. While there are several Australian CLOUD providers that could have provided elements of the service that AWS has provided, AWS's ability to scale very quickly in this pandemic context and to provide a broader range of services is beneficial for the purposes to which the COVIDSafe app is to be put. In relation to the CLOUD Act, any transfer of data to any country outside Australia will constitute a criminal offence under the provisions of the bill and attract a penalty of five years imprisonment.

I understand there are also issues raised in relation to the Office of the Australian Information Commissioner. I would affirm for the record that, since this government was elected, funding to the Office of the Australian Information Commissioner has increased by over 75 per cent. As we do with all agencies, we'll continue to work with the OAIC to understand their resourcing requirements moving forward.

All of the agreements with the states and territories are signed. All of the states and territories have received appropriate training and are ready to access the data. Those agreements will of course need to be revised to take account of the final form of the amendments made to the Privacy Act 1988 by the parliament. We will also seek the approval of the states and territories to release those revised agreements.

This bill goes to unprecedented lengths to protect data collected and generated by the COVIDSafe app. It is important that we do that. As reiterated by the Prime Minister, the Attorney-General and the Minister for Health in recent days, we have made COVIDSafe app data the most private and secure personal information in the country, whether that information is collected by a government agency or a private organisation.

By passing this bill through the Senate and into law, I sincerely echo the Attorney-General's own sincere hope that it gives all Australians the confidence they need to download and use the COVIDSafe app, as I have and as 5.83 million Australians have. Achieving a high uptake of COVIDSafe is important to help state and territory contact tracers get on top of outbreaks. It's very important work that they do, and it will build upon the work of over five million Australians, as I have said, who have already downloaded the app and are helping us to stop the spread of COVID-19.

Question agreed to.

Bill read a second time.