Data collection by government app ‘far exceeds’ what is necessary or relevant
The Australian government must correct errors and clarify potentially misleading statements about privacy protection for its Covid-19 contact-tracing app, according to University of New South Wales legal academics.
Graham Greenleaf, a professor of law and information systems, and law lecturer Katharine Kemp say the CovidSafe tracking app “far exceeds” collection of relevant data needed to manage the spread of the pandemic.
“A very significant issue, which has the capacity to undermine trust, is the government’s misstatements in the media about the data collected and disclosed by the app, and the excessive collection of data by the app in practice,” they write in a draft research paper published by the university.
Greenleaf and Kemp say that government services minister Stuart Robert has repeatedly stated that CovidSafe only records contacts with other app users “when their phones are within 1.5 metres of the user’s phone for at least 15 minutes”.
“The minister and others have also said that when a user tests positive and gives their consent, the app only sends a log of their contacts with other app users who were within 1.5 metres of the user for at least 15 minutes,” they write.
“Neither of these statements is correct. The government should alert the public to these misstatements and correct the misunderstanding.”
Greenleaf and Kemp say that according to a Department of Health privacy impact assessment, the app “actually records all ‘digital handshakes’ between users’ phones when they are within Bluetooth signal range—not just within 1.5 metres—and even for one minute, not 15.”
“If a user tests positive and gives their consent, all of those contacts over the previous 21 days are uploaded to the National Covid Data Store and all are decrypted, regardless of duration or distance,” they write.
“This means that vastly more potentially revealing data concerning a person’s interactions and associations may be collected than the popular understanding. It also far exceeds the data which could be relevant for contact tracing.”
The app was launched a week ago by the federal government to assist in contact tracing to control the spread of the Covid-19 virus in Australia. It has been downloaded by three million people, which data analysts claim is less than a third of the participation rate needed to make the app effective.
“Many in the media and government, as well as high-profile figures in business and tech, have openly exerted moral pressure in favour of using the app, even shaming those who don’t, characterising them as putting trivial privacy concerns ahead of the interests of the nation,” Greenleaf and Kemp write.
“A more balanced approach is required, one that recognises there should be no requirement for Australians to give up more privacy than is necessary and proportionate.”