Source document: https://docs-lawep.s3.us-east-2.amazonaws.com/1697632366804.pdf (Australia)
7 May 2020 Senator the Hon Sarah Henderson Chair Parliamentary Joint Committee on Human Rights Parliament House, Canberra ACT 2600 Dear Ms Henderson, Re: SUBMISSION TO THE PARLIAMENTARY JOINT COMMITTEE ON HUMAN RIGHTS Biosecurity (Human Biosecurity Emergency) (Human Coronavirus with Pandemic Potential) (Emergency Requirements—Public Health Contact Information) Determination 2020 (Cth) Privacy Amendment (Public Health Contact Information) Bill 2020 (exposure draft) We write to you in relation to this Determination made on 29 April 2020 by the 1.
Minister for Health, the Hon Greg Hunt MP and the exposure draft of this Bill released on 4 May 2020.

The Determination, made under the Biosecurity Act 2015 (Cth), and the draft Bill, amending the Privacy Act 1988 (Cth), set out the conditions for operation of the COVIDSafe app scheme which the Commonwealth government has introduced.
Overview: concerns about compatibility with the right to privacy In this submission we set out our concerns about the extent of the privacy 2. protections contained in the Determination and the draft Bill.

We recognise that the COVIDSafe app scheme pursues a legitimate objective (the protection of public health and individuals’ rights to health) and that the government has taken steps to provide significant protections.
However, we consider that its impact on the right to privacy of individuals is potentially greater than is required to achieve the purposes of the scheme.

There are less intrusive alternatives which would provide more extensive protections, are practicable and will not impede the achievement of the overall goals of the scheme.
The introduction of the COVIDSafe app thus gives rise to issues of compatibility with the right to privacy contained in Article 17 of the International Covenant on Civil and Political Rights.

3.

Issues surrounding the efficacy of the COVIDSafe app to function as proposed due to the technical difficulties of Bluetooth running as a background application may UNSW SYDNEY NSW 2052 AUSTRALIA also have a bearing upon the proportionality of the response.
iPhones are primarily affected and ‘account for more than half the smartphones in Australia’.1 Accordingly, the Determination and the Bill should contain further protections 4. as set out below to ensure full enjoyment of the right to privacy.

The government should also be more transparent about the scheme.

Following our recommendations may well encourage more Australians to download the app, thus increasing its chances of success.
Lack of a statement of compatibility As a result of its status as a non-disallowable instrument, there is no formal 5. requirement under the Human Rights (Parliamentary Scrutiny) Act 2011 for the Determination to be accompanied by a statement of compatibility with Human Rights in its Explanatory Statement – and indeed none was provided.
The Explanatory Statement states: ‘The Determination is drafted to avoid trespassing on rights and liberties to the greatest extent possible, consistent with the imperative of implementing the measures necessary to prevent or control the emergence, establishment and spread of COVID-19 in Australian territory.’ (Explanatory Statement, p 2) The Committee has regularly expressed its concern about the failure of 6. proponents/makers of non-disallowable subordinate instruments to provide statements of compatibility where those instruments have the potential to encroach on the enjoyment of human rights.
This instrument illustrates why statements of compatibility should be provided: it has significant implications for the right to privacy and statements of compatibility are meant to ensure that the drafters have approached the development of the scheme applying an explicit human rights framework.

We encourage the Committee to urge Ministers to ensure the submission of statements of compatibility in the case of instruments which patently have an impact on human rights, as this one does.
The Explanatory Statement does not analyse the provisions of the 7.

Determination and the operation of the scheme in terms of the analytical framework used by the Committee to assess human rights compatibility.

Indeed, the phrase ‘human rights’ does not appear in the Explanatory Statement and there is no explicit consideration of the criterion consistently employed by the Committee that proportionality requires the adoption of less restrictive measures where reasonably possible.

8.
8.

No Explanatory Memorandum has yet been released in relation to the Bill and thus no statement of compatibility is currently available.
However, as we understand 1 Max Koslowski, ‘COVIDSafe downloads reach 5 million as experts question technical flaws’, Sydney Morning Herald (online) 5 May 2020 <https://www.smh.com.au/politics/federal/covidsafe-downloads-reach-5-million-as-experts- question-technical-flaws-20200505-p54q2n.html>; see also Digital Transformation Agency evidence to the Senate Select Committee on Covid-19, 6 May 2020.
UNSW SYDNEY NSW 2052 AUSTRALIA 2 the government proposes to introduce the Bill into Parliament at next week’s sittings and is likely to seek its rapid passage, we are providing these comments at this stage in the hope that they will assist the Committee in providing its analysis of the Bill before the legislation is passed.

Compatibility of the COVID-19 app and scheme with the right to privacy: the availability of less restrictive alternatives 9.
Where the government urges the population to adopt technology (here, the COVIDSafe app) in response to a public health emergency, it is important to consider the impact on human rights.

In this case, the relevant right is the right to privacy.
The right to privacy is ‘the right not to have one’s privacy, family and home life or correspondence unlawfully or arbitrarily interfered with’.2 It includes informational privacy, which requires effective measures ‘to ensure unauthorised persons are not able to access personal information’.3 Here, we are particularly concerned with the need to ‘adopt legislative and other measures to protect people from arbitrary interference with their privacy’ when using the COVIDSafe app.4 As noted in the Committee’s Guidance Note 1, international law recognises 10.
‘that reasonable limits may be placed’ on the right to privacy provided that limitations have a clear legal basis, a legitimate objective and a rational connection to that objective and are proportionate to the achievement of the objective.

The only question here is whether the rollout of COVIDSafe is proportionate to the legitimate objective to protect public health, given the relevant legal regime set out in the Determination and the Bill.
Within proportionality, the primary questions are whether there are ways to achieve the same aim with less impact on the right to privacy and whether the safeguards provided are effective.

In our view, changes to the legal framework and additional transparency 11. measures would help ensure this is the case.

We therefore believe that the Determination and the Bill should be considered by the Committee with a view to suggesting further improvements to better protect human rights.
In particular, we make the following recommendations (with associated explanations): Recommendation Explanation States and territories should be encouraged to pass corresponding legislation Although the Bill states that it applies to State and Territory health authorities (cl 94X), it would be preferable for equivalent provisions to be contained in state and territory law, particularly since cl 94ZB cannot directly override 2 Parliamentary Joint Committee on Human Rights, Guide to Human Rights (June 2015) 1.108.
3 Ibid 1.112-113.

4 Ibid 1.110.

UNSW SYDNEY NSW 2052 AUSTRALIA 3 The following should be made publicly available:5 The source code of the app.

- - Advice referred to in the Explanatory Statement for the Determination from the Digital Transformation Agency, the Acting Secretary of the Health Department and the Commonwealth Chief Medical Officer.

Evaluations of the COVIDSafe app over time.


- - Clear statements as to the data collected by the app (which, contrary to some statements to date, is not limited to information about users who come within 1.5 metres for at least 15 minutes).

The federal Privacy Commissioner should be requested to state and justify an opinion on whether the COVIDSafe app and its operation is a necessary and proportionate response given the risks to privacy.
The purposes to which de-identified data will be put and the processes used to de- identify data for statistical purposes should be made public.

conflicting state and territory legislation.

The application of the Determination to states and territories is also unclear.

This will enhance transparency and allow the public to evaluate the effectiveness, necessity and proportionality of the app.

Release of the source code was recommended in the Privacy Impact Assessment by the law firm Maddocks.
Current Bluetooth technology does not have the precision to only collect information of those phones within 1.5m, meaning that a broader range of contact, including those in separate rooms or even apartments, may be collected.6 Signal strength can be influenced by a number of factors, some of which are unrelated to distance, making it difficult to distinguish a close contact from other contacts.7 The effectiveness of the app is likely to depend on technical issues (some of which have been identified), the role of the app in Australia’s overall COVID-19 response, and assumptions about the natural history of COVID-19.
Aside from contact tracing, the draft Bill permits the data store administrator to use the COVID app data ‘for the purpose of, and only to the extent required for the purpose of, producing de-identified 5 Graham Greenleaf and Katharine Kemp, Australia’s ‘COVIDSafe App’: An Experiment in Surveillance, Trust and Law (April 30, 2020).

(2020) University of New South Wales Law Research Series 999.

Available at SSRN: https://ssrn.com/abstract=3589317.
6 Ariel Bogle and Olivia Willis, ‘Can Australia's coronavirus contact tracing app COVIDSafe lift the country out of lockdown?’ ABC News (online) 6 May 2020 <https://www.abc.net.au/news/science/2020-05-06/coronavirus-contact-tracing-app-covid- safe-lockdown-lift/12217146>.
7 Sam Biddle, ‘The inventors of Bluetooth say there could be problems using their tech for coronavirus tracing’, The Intercept, 5 May 2020 <https://theintercept.com/2020/05/05/coronavirus-bluetooth-contact-tracing/> UNSW SYDNEY NSW 2052 AUSTRALIA 4 statistical information about the total number of registrations through COVIDSafe’ (cl 94D(2)(f)).

It seems then that COVID app data may be de- identified for the purpose of determining the total number of COVIDSafe registrations and no other purpose.
However, the definition of ‘COVID app data’ states that it does not include ‘information that is de- identified’ (cl 94D(5)(d)).

These words should be followed by the words ‘pursuant to section 94D(2)(f)’ to clarify that permitted de-identification is limited in this way.
As in the Privacy Act 1988 (Cth) more broadly, de-identified data is treated as a category rather than as a scale of risk despite the fact that all data derived from personal information can be re- identified in at least some circumstances (such as by a person with existing knowledge derived from other data).

Transparency would be improved by making explicit the processes used to render negligible the risk of re- identification.
Although cl 94ZB of the Bill ensures it overrides other laws, there may be loopholes, for example where Part 15 of the Telecommunications Act is used to seek assistance in decrypting data not on a device (but, perhaps, backed up in the cloud).

Clear statements contained within the operating Act/s that powers do not apply to COVID app data are preferable.
On current drafting, it is possible that a person could get data about individuals while in Australia and take that to a foreign country provided they never ‘retained’ it on ‘a database outside For clarity, the Bill should amend not only the Privacy Act, but also federal laws concerning court and agency powers to obtain or use COVID app data.
Clause 94F of the Bill (and s 7 of the Determination) should be amended to provide that no data from the app can be taken out of Australia, with the exception UNSW SYDNEY NSW 2052 AUSTRALIA 5 of the situation contemplated in s 7(4) / cl 94F(2)(c).

Australia’.

This loophole should be closed.


Clause 94K of the Bill (and s 7 of the Determination) should be amended to provide that data relating to individuals’ COVID-19 status and contacts be deleted from the data store and by state and territory health authorities after 21 days.

The government should introduce amendments into the Telecommunications Legislation Amendment (International Production Orders) Bill 2020 (IPO Bill) and related agreements with the US to specifically exclude COVID app data.
Note that the IPO Bill will make it possible for Australia to enter into an agreement with the US that would enable cooperation in accessing data stored in the other country.

The definition of COVID app data in cl 94(5) of the Bill and s 5 of the Determination should be clarified to explicitly include all data (including decrypted, transformed and processed data) in or obtained from the data store.
Clause 94ZA in the Bill should be amended to replace the reference to “property of the Commonwealth” with a more explicit statement of the rights and powers retained by the Commonwealth.

While information is deleted from a device after 21 days, there is no similar provision that it be deleted from the data store or by health authorities.

After 21 days, data will no longer be useful for contact tracing.

De-identified data, which may be useful for research, is already exempted.
Given the data will be held by a US company, there is also the possibility that US agencies may seek to access the data under US law, in particular, the Clarifying Lawful Overseas Use of Data Act (‘US CLOUD Act’).

This possibility has been rejected by the Secretary of Home Affairs, based on discussions with the US Department of Justice.8 This relies on diplomatic assurances, that should be confirmed in due course through any forthcoming agreement between the US and Australia.
Although the current definition is arguably sufficiently broad to include this, it would be preferable to state this clearly and avoid any ambiguity.

The Bill (cl 94ZA) provides that “COVID App data is the property of the Commonwealth” even after it is disclosed to or used by others including state and territory health authorities.
This is a strange proposition given that data is not an object of property rights 8 The Guardian reporting on Digital Transformation Agency evidence to the Senate Select Committee on Covid-19, 6 May 2020.

UNSW SYDNEY NSW 2052 AUSTRALIA 6 under Australian law.9 If this provision is to protect the data from uses by other actors, it should be redrafted.
These recommendations originate from Graham Greenleaf and Katharine Kemp, ‘Australia’s ‘COVIDSafe App’: An experiment in surveillance, trust and law’ (above n 5) Clause 94H of the Bill and s 9 of the Determination should be amended to state that it is prohibited to make any of the enumerated activities (1) a condition of exceptions to stay at home orders issued by any government, or (2) a condition for receiving favourable treatment or financial incentives.
A COVIDSafe Privacy Advisory Committee should be created in the Bill.

Conclusion We urge the Committee to recommend that the Determination and Bill be amended in the ways set out above.
Yours sincerely, Professor Lyria Bennett Moses, Ms Genna Churches, Dr Monika Zalnieriute Allens Hub for Technology, Law and Innovation UNSW Sydney Professor Andrew Byrnes Australian Human Rights Institute UNSW Sydney Professor Jackie Leach Scully Disability Innovation Institute UNSW Sydney Dr Katharine Kemp Lead, Grand Challenge on Trust UNSW Sydney Professor Graham Greenleaf Faculty of Law UNSW Sydney 9 Lyria Bennett Moses, ‘Who Owns Information?
Law Enforcement Information Sharing as a Case Study in Conceptual Confusion’ (2020) UNSW Law Journal, forthcoming.

UNSW SYDNEY NSW 2052 AUSTRALIA 7