Australia’s ‘COVIDSafe’ law for contact tracing: an experiment in surveillance and trust
Graham Greenleaf, Katharine Kemp · International Data Privacy Law · 2021
Australian government has emphasized contact tracing and the use of a ‘contact tracing app’, namely the ‘COVIDSafe app’, as core measures in the fight against the spread of COVID-19.1 Use of the app has been widely promoted as part of the federal government’s ‘Stay COVID Free – Do the 3’ campaign.2 Prime Minister Morrison compared installing the app—as ‘a matter of national service … helping save someone’s life’—3with failing to do so—‘like not putting on sunscreen before going out into the blazing sun’.4 But, while the app was said to be ‘Australia’s ticket to a COVID-safe Australia’, there has been significant controversy about whether the privacy protections underlying the app are sufficient to establish the public trust necessary to encourage voluntary use of the app and whether the app will in fact create substantial benefits for contact tracing.5 Essentially, contact tracing can assist in stemming the rate of infection by identifying those who were in contact with an infected person in sufficient proximity for a sufficient time to have potentially become infected themselves.6 This allows relevant contacts to be contacted by health officials who can advise them to receive testing, isolate and/or receive treatment to improve their own outcomes and avoid infecting others. Contact tracing apps are intended to assist identification of contacts of persons infected by the virus, by using mobile phone-based technology to provide contact tracing officials with additional information about contacts with people where the infected person may not remember a contact or may not know the other person’s identity or contact details (for example, where the contact was in a restaurant, on public transport, at a live event, or in a waiting room).7 The key element of apps based on Bluetooth technology, such as the COVIDSafe app, is mutual recognition by devices with the app installed and running and the creation and storage of records of such ‘contact events’.8