NSW moves to fortify check-in app data privacy, prevent police access

The NSW government has moved to strengthen the privacy protections behind QR code check-in data that prevent law enforcement access by enshrining the safeguards in legislation.

The Service NSW (One-stop Access to Government Services) Amendment (COVID-19 Information Privacy) Bill was introduced to parliament on Wednesday and has already passed the lower house.

It follows similar efforts by the Victorian government to further restrict the use of such data by police through its Public Health and Wellbeing Amendment (Pandemic Management) Bill last month.

Concerns around law enforcement access to check-in data have been swirling since June, when it was revealed WA Police had accessed QR code check-in data.

While a health order already bans police from using the data in NSW, Digital Minister Victor Dominello said the government had decided to further strengthen privacy protections on the advice of the Privacy Commissioner.

“The bill takes the long-standing position that check-in data is to be used only for the purpose it was collected, or contact tracing, and enshrines it in legislation,” he said.

“It will ensure that information cannot be accessed for secondary purposes, including for law enforcement and by use of a warrant.

“It will reinforce to the people of New South Wales that the additional collection of their information during the pandemic is only to protect public health.”

Dominello said that while 7.5 million citizens had entrusted the government with their personal data through the COVID Safe Check-in app to date, it would only continue with “public buy-in”

“Trust and compliance is central to their effectiveness, and to our ability to reduce the spread of Covid-19,” he said.

Late last month, the government began proactively alerting citizens who have come into contact with a positive Covid-19 case through the Service NSW app.

The feature came after the one-stop shop for government services began issuing venue exposure alerts without a push notification, meaning that some 700,000 may have gone unnoticed.