Ever since contact tracing apps started to be implemented around the world as a way to keep the Covid pandemic at bay, privacy and civil rights advocates have been warning that this type of personal data collection could easily prove prone to abuse.
And as the example of Australia’s Western Australia state shows, not only have false promises been made that data collected by the SafeWA app would be used only for infectious disease tracking – the app was released and used nearly 250 million times before it was legally defined through a bill.
The Western Australia parliament only adopted the law – The Protection of Information (Entry Registration Information Relating to COVID-19 and Other Infectious Diseases) Bill 2021 – after it was revealed that the police accessed data from the app while investigating two crimes – a murder and a stabbing case.
The use of SafeWA is mandatory and citizens use it to enter various venues in the state – and it is from these businesses that the police requested and received the data in question. But the app promises that all data is encrypted and kept for 28 days, and explicitly states that attendance data is recorded “solely for the purposes of contact tracing.”
To make matters even worse in light of the police making use of this data, SafeWa’s description also says that only the state’s authorized contact-tracing health personnel can access the records, once a positive Covid case has been identified.
The new bill was adopted in urgent procedure in order to, as state Attorney General John Quigley put it, “maintain community confidence in SafeWA.” The legislation spells out that the harvested data can only be used for contact-tracing, prescribes how data is to be stored and deleted, and also threatens those who fail to adhere to these rules – like the venues that cooperated with the police in the two criminal cases – with fines.
The Western Australia government framed this rushed legislation as “further protection of information” obtained through contact registers and an “extra assurance” that registers are protected and will be handled as promised all along.
The state mandated contact registers over six months ago, at the end of 2020.
