Document ID: chunk:federal_register_of_legislation:C2020A00044:clause:1_94d:p1
Version: federal_register_of_legislation:C2020A00044
Segment Type: clause
Provision Reference: sch 1 cl 94D (pt 1/3)
Character Range: 8833–11499

94D  Collection, use or disclosure of COVID app data
 (1) A person commits an offence if:
 (a) the person collects, uses or discloses data; and
 (b) the data is COVID app data; and
 (c) the collection, use or disclosure is not permitted under this section.
Penalty: Imprisonment for 5 years or 300 penalty units, or both.
 (2) The collection, use or disclosure is permitted if:
 (a) the person is employed by, or in the service of, a State or Territory health authority, and the collection, use or disclosure is for the purpose of, and only to the extent required for the purpose of, undertaking contact tracing; or
 (b) the person is:
 (i) an officer or employee of the data store administrator; or
 (ii) a contracted service provider for a government contract with the data store administrator;
  and the collection, use or disclosure is for the purpose of, and only to the extent required for the purpose of:
 (iii) enabling contact tracing by persons employed by, or in the service of, State or Territory health authorities; or
 (iv) ensuring the proper functioning, integrity or security of COVIDSafe or of the National COVIDSafe Data Store; or
 (c) in the case of a collection or disclosure of COVID app data—the collection or disclosure is for the purpose of, and only to the extent required for the purpose of:
 (i) transferring encrypted data between communication devices through COVIDSafe; or
 (ii) transferring encrypted data, through COVIDSafe, from a communication device to the National COVIDSafe Data Store; or
 (d) the collection, use or disclosure is for the purpose of, and only to the extent required for the purpose of, the Commissioner performing the functions or exercising the powers of the Commissioner under or in relation to this Part; or
 (e) the collection, use or disclosure is for the purpose of, and only to the extent required for the purpose of:
 (i) investigating whether this Part has been contravened; or
 (ii) prosecuting a person for an offence against this Part; or
 (f) in the case of a use of COVID app data by the data store administrator—the use is for the purpose of, and only to the extent required for the purpose of, producing de‑identified statistical information about the total number of registrations through COVIDSafe; or
 (g) in the case of a use of COVID app data that the data store administrator is required by section 94L to delete—the use consists of access by the data store administrator for the purpose of, and only to the extent required for the purpose of, confirming that the correct data is being deleted.
 (3) Subsection (1) does not apply to the collection of COVID app data if:
 (a) the collection