KEY TAKEAWAYS:           

• Privacy of personal data Vs government mandated access
• Is your privacy at risk from new technology
• Why should you care?

The COVID-19 pandemic has created an unprecedented opportunity for governments and law enforcement agencies to justify expanding their data collection powers. In response to this emergency, there is increased use of personal data and new technologies to manage outbreaks. This article highlights how privacy concerns are balanced against countervailing public health interests with a specific focus on the Service NSW application.

New South Wales residents had their dream of a “normal” New Year shattered with the onset of the Northern Beaches COVID-19 outbreak. The New South Wales government took swift action and introduced several new public health orders to contain the virus’s resurgence, one being the mandatory use of the Service NSW application for contact tracing.

While the promotion of such contact tracing technology is reminiscent of the federal government’s COVIDSafe app launch, there is one crucial difference between the two platforms. Users of the COVIDSafe application are afforded protections under the Commonwealth’s Privacy Act 1988 with specific amendments to protect COVIDSafe user data. Conversely, the Service NSW application’s Privacy Management Plan[1]  specifies they handle user data following the 12 Information Protection Principles set out in the Privacy and Personal Information Protection Act 1998 (NSW)[2] and 15 Health Privacy Principles set out in the Health Records and Information Privacy Act 2002 (NSW).[3]

In short, the Privacy Management Plan stipulates that your data can be used for:

• the primary purpose of which it was collected,
• a directly related secondary purpose,
• for another (undisclosed) purpose if the person has consented, or
• if Service NSW reasonably believes that the use is necessary to prevent or lessen a serious and imminent threat to life or health.

Additionally, there are notable exemptions to needing consent, including using your personal information for law enforcement and investigative purposes.

So, why should you care? Say you chose to attend a protest and, out of good faith, decide to check-in using the Service NSW application. During the protest, the police determine that what is transpiring does not align with current Public Health Orders pertaining to protests. Subsequently, the police request the personal details of all who “checked in” at the protest for “law enforcement and investigative purposes”. As a result, the police are now aware of who you are, your contact details, your attendance at a specific protest and any other information you may have provided through the Service NSW application. Such circumstances exemplify how new technologies aimed at reducing the spread of COVID-19 can be co-opted to heighten police powers significantly and place the privacy of your personal information at risk.

[1] https://www.service.nsw.gov.au/system/files/2020-12/service-nsw-privacy-management-plan.pdf

[2] Part 2, Division 1.

[3] Schedule 1.