Privacy Amendment (Public Health Contact Information) Act 2020
An Act to amend the Privacy Act 1988, and for related purposes
1 Short title
privacy-amendment-public-health-contact-information-act-2020.pdf, p.5
The Act is the Privacy Amendment (Public Health Contact Information) Act 2020.
2 Commencement
Commencement rules for provisions in the Act.
privacy-amendment-public-health-contact-information-act-2020.pdf, p.6
1 Section 1
15 May 2020
2 Section 2
Schedule 1, effective one day after Royal Assent.
16 May 2020
3 Section 3
The day after this Act receives the Royal Assent.
4 Section 4
Schedule 2, items 2 to 4, at the end of 90 days after a specified day.
14 November
3 Schedules
Legislation in Schedules is amended or repealed according to its terms.
1 Subsection 6(1)
Defines terms related to contact tracing and COVIDSafe app data.
privacy-amendment-public-health-contact-information-act-2020.pdf, p.7
2 After Part VIII
privacy-amendment-public-health-contact-information-act-2020.pdf, p.8
94A Simplified outline of this Part
Prohibits uploading COVID app data without consent, retaining or disclosing uploaded data outside Australia, decrypting encrypted COVID app data, and requiring participation in relation to COVIDSafe.
Imposes rules and privacy protections on State or Territory health authorities.
Implicates Commonwealth oversight over COVID app data.
Cancels the effect of inconsistent Australian laws.
94B Object of this Part
Encourage public acceptance and uptake of COVIDSafe.
privacy-amendment-public-health-contact-information-act-2020.pdf, p.9
Obligation to encourage public acceptance and uptake of COVIDSafe.
94C Constitutional basis of this Part
privacy-amendment-public-health-contact-information-act-2020.pdf, p.10
94C(1) Constitutional basis of this Part
Relies on Commonwealth's legislative powers
94C(2) Constitutional basis of this Part
Requires relation between identifiable temporal intervals
Provision has effect as provided by subsections (3) to (5)
94C(3) Constitutional basis of this Part
Confining references to COVID app data within quarantine purposes
94C(4) Constitutional basis of this Part
Confining references to COVID app data to a specific service
94C(5) Constitutional basis of this Part
Australia's obligations under the International Covenant on Civil and Political Rights
94D Collection, use or disclosure of COVID app data
94D(1) Collection, use or disclosure of COVID app data
Prohibition on collecting, using or disclosing COVID app data without permission.
94D(2) Collection, use or disclosure of COVID app data
Permitted under certain conditions for collection, use, or disclosure of COVID app data
94D(3) Collection, use or disclosure of COVID app data
Permitted collection of COVID app data under Australian law.
Permits the collection of COVID app data under Australian law.
The collection of non-COVID app data is permitted under an Australian law.
The collection of COVID app data is permitted under Australian law.
Recurring trace: Collection of COVID app data is permitted under Australian law.
Imposes an obligation to delete COVID app data after collection.
The COVID app data must be deleted as soon as practicable after the person becomes aware that it had been collected.
The person has an obligation to delete COVID app data after collection.
Imposes an obligation to not access, use or disclose COVID app data after it was collected.
The person must not otherwise access, use or disclose the COVID app data after it was collected.
The person has an obligation to not access, use or disclose COVID app data after collection.
Permits the deletion of COVID app data after collection.
The person has permission to delete COVID app data after collection.
94D(4) Collection, use or disclosure of COVID app data
Incidental collection of COVID app data does not affect admissibility as evidence.
94D(5) Collection, use or disclosure of COVID app data
Prohibition on disclosure of COVID app data obtained from sources other than the National COVIDSafe Data Store
Prohibition on disclosure of COVID app data
(5) COVID app data is data relating to a person that...
94D(6) Collection, use or disclosure of COVID app data
Contact tracing is required for persons who have tested positive for COVID-19 or are in contact with them.
Notification of contact and provision of information and advice.
Obligation to notify and provide information.
Contact tracing is a process that includes notification of contact and provision of information and advice.
94E COVID app data on communication devices
Uploading COVID app data without consent is an offence.
privacy-amendment-public-health-contact-information-act-2020.pdf, p.14
Prohibits uploading COVID app data without consent.
Consent is required for uploading COVID app data.
The upload must occur during the period when consent is not given.
Uploading COVID app data without consent occurs during a specific time period.
The offence spreads to those who upload COVID app data without consent.
The key defines a specific legal provision.
Those who upload COVID app data without consent are affected by the offence.
The system can analyze the uploaded data to determine if consent was given.
The system can determine if consent was given for uploading COVID app data.
The uploaded data must be validated against the SHACL schema.
The uploaded data is validated against the SHACL schema.
94F COVID app data in the National COVIDSafe Data Store
94F(1) COVID app data in the National COVIDSafe Data Store
Retaining COVID app data outside the National COVIDSafe Data Store is prohibited.
94F(2) COVID app data in the National COVIDSafe Data Store
Disclosing COVID app data outside Australia is prohibited.
94G Decrypting COVID app data
Decrypting COVID app data is prohibited.
privacy-amendment-public-health-contact-information-act-2020.pdf, p.15
94H Requiring the use of COVIDSafe
94H(1) Requiring the use of COVIDSafe
Requiring the use of COVIDSafe on a communication device.
Prohibits requiring another person to download COVIDSafe.
(1) A person commits an offence if the person requires another person...
94H(2) Requiring the use of COVIDSafe
Refusing to use COVIDSafe or taking adverse action against another person is an offence.
Prohibition of refusing to use COVIDSafe or taking adverse action.
The person refuses to enter into, or continue, a contract or arrangement with another person.
Prohibition of refusing to allow another person to enter premises.
The person refuses to allow another person to enter premises that are otherwise accessible to the public.
Prohibition of refusing to provide goods or services to another person.
The person refuses to provide goods or services to another person.
Prohibition of taking adverse action against another person.
The person takes adverse action (within the meaning of the Fair Work Act 2009) against another person.
Prohibition of refusing to receive goods or services from another person.
The person refuses to receive goods or services from another person, or insists on providing less monetary consideration for the goods or services.
Prohibition of refusing to consent to uploading COVID app data from a communication device.
The person has not consented to uploading COVID app data from a communication device.
94H(3) Requiring the use of COVIDSafe
94J Extended geographical jurisdiction for offences
Section applies to all offences against this Division.
privacy-amendment-public-health-contact-information-act-2020.pdf, p.16
94K COVID app data not to be retained
Data must not be retained on a communication device for more than 21 days.
94L Deletion of registration data on request
privacy-amendment-public-health-contact-information-act-2020.pdf, p.17
94L(1) Deletion of registration data on request
Data administrator must delete registration data upon request.
Prohibition on using or disclosing deleted data
(b) if it is not practicable to delete the data immediately—must not use or disclose the data for any purpose.
Data deletion must occur as soon as practicable
(1) If the COVIDSafe user or former COVIDSafe user in relation to a communication device, or a parent, guardian or carer of that person, requests the data store administrator to delete any registration data of the person that has been uploaded from the device to the National COVIDSafe Data Store,
Obligation on data administrator to take reasonable steps
(a) must take all reasonable steps to delete the data from the National COVIDSafe Data Store as soon as practicable;
94L(2) Deletion of registration data on request
Parent, guardian or carer must provide consent for deletion of registration data on request.
94L(3) Deletion of registration data on request
Data administrator must confirm data deletion upon request.
Data administrator must confirm data deletion.
94L(4) Deletion of registration data on request
Section does not apply to de-identified data
94M Deletion of data received in error
Delete COVID app data received in error and notify administrator.
94N Effect of deletion of COVIDSafe from a communication device
privacy-amendment-public-health-contact-information-act-2020.pdf, p.18
94N(1) Effect of deletion of COVIDSafe from a communication device
Cannot collect COVID app data from a person who is a former COVIDSafe user in relation to that device.
Prohibition of collecting COVID app data from a former user
94N(2) Effect of deletion of COVIDSafe from a communication device
Person is a former COVIDSafe user if COVIDSafe has been deleted and not downloaded again.
94P Obligations after the end of the COVIDSafe data period
94P(1) Obligations after the end of the COVIDSafe data period
Prohibition on collecting COVID app data and making COVIDSafe available after the end of the COVIDSafe data period.
(1) After the end of the day determined under subsection 94Y(1)
(a) collect any COVID app data; or (b) make COVIDSafe available to be downloaded.
Temporal relationship between the end of the COVIDSafe data period and the obligation to not collect COVID app data or make COVIDSafe available
Temporal relationship between the obligation to not collect COVID app data or make COVIDSafe available and the end of the COVIDSafe data period
Spread of obligations after the end of the COVIDSafe data period to all relevant parties
94P(2) Obligations after the end of the COVIDSafe data period
Delete COVID app data from National COVIDSafe Data Store after end of day determined under subsection 94Y(1)
94P(3) Obligations after the end of the COVIDSafe data period
Inform Health Minister and Commissioner of COVID app data deletion.
Information about COVID app data deletion.
94Q COVID app data is taken to be personal information
COVID app data is personal information for the purposes of this Act.
privacy-amendment-public-health-contact-information-act-2020.pdf, p.19
Imposes obligation on states to treat COVID app data as personal information.
94R Breach of requirement is an interference with privacy
94R(1) Breach of requirement is an interference with privacy
An act or practice in breach of a requirement constitutes an interference with privacy.
94R(2) Breach of requirement is an interference with privacy
Interference with privacy is an act or practice for the purposes of subsection (1) of this section.
Interference with privacy is an act or practice.
94S Breach of requirement may be treated as an eligible data breach
94S(1) Breach of requirement may be treated as an eligible data breach
Data store administrator must treat breach as eligible data breach if certain conditions are met.
Must treat breach as eligible data breach.
94S(2) Breach of requirement may be treated as an eligible data breach
Treat breach of requirement as an eligible data breach
Imposes a duty on the State or Territory health authority
Establishes a temporal relation between the breach and the individual at risk
Implies that the individual is at risk from the eligible data breach if the breach is taken to be such by the State or Territory health authority
Propagates the obligation to treat breaches as eligible data breaches through the State or Territory health authority
Represents knowledge about the breach and its implications for the individual at risk
94S(3) Breach of requirement may be treated as an eligible data breach
Notify the Commissioner of reasonable grounds to believe an eligible data breach has occurred.
Subdivision B of Division 3 of Part IIIC requires notification.
The data store administrator or State/Territory health authority must notify the Commissioner.
Subdivision B of Division 3 of Part IIIC requires notification within a certain timeframe.
The notification must occur within the specified temporal interval.
The data store administrator or State/Territory health authority must notify the Commissioner if there are reasonable grounds to believe an eligible data breach has occurred.
Only compliance with sections 26WK and 26WL is required if the Commissioner requires so.
The data store administrator or State/Territory health authority must notify the Commissioner only if required to do so by the Commissioner.
Part IIIC applies in relation to such a breach as if...
The data store administrator or State/Territory health authority must use the Part IIIC system for notification.
94S(4) Breach of requirement may be treated as an eligible data breach
Commissioner must require administrator or authority to comply with breach if it may result in serious harm.
Commissioner must require administrator or authority to comply
Commissioner must require administrator or authority to comply if breach may result in serious harm
Breach may be likely to result in serious harm
Commissioner must require administrator or authority to comply if breach may result in serious harm and subsection (5) does not apply
Commissioner's requirement is a type of administrative action
94S(5) Breach of requirement may be treated as an eligible data breach
Commissioner may decide not to require compliance or allow extended period for compliance under certain circumstances.
94S(6) Breach of requirement may be treated as an eligible data breach
The Commissioner may have regard for advice beyond the limited scope of paragraph (5)(b)
94T Commissioner may conduct an assessment relating to COVID
privacy-amendment-public-health-contact-information-act-2020.pdf, p.21
94T(1) Commissioner may conduct an assessment relating to COVID
Commissioner may conduct an assessment relating to COVID
94T(2) Commissioner may conduct an assessment relating to COVID
Entity or authority must provide information or document within 14 days after notice.
Prohibits entity or authority from failing to provide information.
94U Investigation under section 40 to cease if COVID data offence
94U(1) Investigation under section 40 to cease if COVID data offence
Cease investigation under section 40 if COVID data offence opinion formed.
Imposes a duty on the Commissioner to cease investigation.
...the Commissioner forms the opinion that...
94U(2) Investigation under section 40 to cease if COVID data offence
The Commissioner must inform and provide a copy of the complaint to the relevant authorities.
The Commissioner must perform the action.
94U(3) Investigation under section 40 to cease if COVID data offence
Must provide written notice to the Commissioner if proceedings for an offence are dropped.
94U(4) Investigation under section 40 to cease if COVID data offence
May give a written notice to the Commissioner if an investigation will not be jeopardized by continuation.
94U(5) Investigation under section 40 to cease if COVID data offence
Commissioner may continue investigation upon receiving notice
94V Referring COVID data matters to State or Territory privacy
privacy-amendment-public-health-contact-information-act-2020.pdf, p.22
94V(1) Referring COVID data matters to State or Territory privacy
Commissioner may decide not to investigate matter or further investigation.
(i) the complainant has made, or could have made, a complaint relating to that matter...
Commissioner may decide not to investigate.
Temporal overlap between investigation and referral to State/Territory authority
(b) before the Commissioner commences, or after the Commissioner has commenced...
Investigation and referral overlap in time.
Recurring trace of investigation and referral to State/Territory authority
Spread of investigation and referral to State/Territory authority
(ii) that matter could be more conveniently or effectively dealt with by that State or Territory authority;
Analysis of investigation and referral to State/Territory authority
(a) a complaint has been made under section 36...
94V(2) Referring COVID data matters to State or Territory privacy
Transfer complaint to State or Territory authority and provide notice.
Notice in writing to the complainant stating that the complaint has been transferred.
94V(3) Referring COVID data matters to State or Territory privacy
Complaints are taken to have been made to the relevant State or Territory authority.
Imposes an obligation on the State or Territory.
(3) A complaint transferred under subsection (2) is taken, for the purposes of this Act, to have been made to that State or Territory authority.
The State or Territory must take the complaint.
Indicates an overlap between the temporal intervals of the complaint and the relevant authority's processing time.
The complaint overlaps with the relevant authority's processing time.
Indicates a recurring relationship between the complaint and the relevant authority.
The complaint is recurrently related to the relevant authority.
Indicates a diffusion relationship between the complaint and the relevant authority.
The complaint diffuses to the relevant authority.
Indicates a recognition relationship between the complaint and the relevant authority.
The complaint is recognized by the relevant authority.
94W Commissioner may share information with State or Territory
privacy-amendment-public-health-contact-information-act-2020.pdf, p.23
94W(1) Commissioner may share information with State or Territory
Commissioner may share information with State or Territory for specified purposes.
Commissioner has permission to share information.
94W(2) Commissioner may share information with State or Territory
Commissioner may share information with State or Territory under certain conditions.
...with a State or Territory privacy authority under this section.
Information must be shared within a reasonable timeframe.
...the Commissioner is satisfied on reasonable grounds that...
...the State or Territory privacy authority has satisfactory arrangements in place for protecting the information or documents.
State or Territory must have satisfactory arrangements in place.
Commissioner must be satisfied on reasonable grounds.
...the Commissioner is satisfied on reasonable grounds that the State or Territory privacy authority has satisfactory arrangements in place for protecting the information or documents.
94W(3) Commissioner may share information with State or Territory
Commissioner may share information with State or Territory
94X Application to State or Territory health authorities
privacy-amendment-public-health-contact-information-act-2020.pdf, p.24
94X(1) Application to State or Territory health authorities
Applicability to State or Territory health authorities
94X(2) Application to State or Territory health authorities
No application of Australian Privacy Principle 9 in relation to government related identifier assigned by State or Territory.
Prevents application of Australian Privacy Principle 9
...in relation to a State or Territory health authority:
Prevents application of this Act in relation to data or information that is not COVID app data.
...in relation to data or information that is not COVID app data.
94Y Determining the end of the COVIDSafe data period
94Y(1) Determining the end of the COVIDSafe data period
The Health Minister must determine a day to end the COVIDSafe data period.
The Health Minister must determine a day.
94Y(2) Determining the end of the COVIDSafe data period
Consultation requirement for Health Minister's determination
Consultation from Commonwealth Chief Medical Officer or Australian Health Protection Principal Committee
94Y(3) Determining the end of the COVIDSafe data period
Recommendation for Health Minister to make a determination
Requires a relation between identifiable temporal intervals
Conditional commencement is Undertaking, not Prohibition
94Z Agencies may be determined to be data store administrator
privacy-amendment-public-health-contact-information-act-2020.pdf, p.25
94Z(1) Agencies may be determined to be data store administrator
Secretary of Health Department may determine agency as data store administrator
94Z(2) Agencies may be determined to be data store administrator
Agency must limit its role as data store administrator.
94Z(3) Agencies may be determined to be data store administrator
The Secretary of the Health Department cannot determine that certain entities are data store administrators.
that any of the following is the data store administrator
The Secretary of the Health Department must not determine under subsection (1)
94ZA Reports on operation and effectiveness of COVIDSafe and the
94ZA(1) Reports on operation and effectiveness of COVIDSafe and the
Report on operation and effectiveness of COVIDSafe and the National COVIDSafe Data Store
Must report on operation and effectiveness
94ZA(2) Reports on operation and effectiveness of COVIDSafe and the
Report on operation and effectiveness of COVIDSafe within 3 months after a specified day.
94ZA(3) Reports on operation and effectiveness of COVIDSafe and the
Report on COVIDSafe operation and effectiveness must be laid before Parliament within 15 sitting days.
94ZB Reports by the Commissioner
privacy-amendment-public-health-contact-information-act-2020.pdf, p.26
94ZB(1) Reports by the Commissioner
The Commissioner must prepare a report on the performance of functions and powers under this Part.
The report must be prepared at specific intervals.
(1) The Commissioner must, as soon as practicable after: (a) the end of the 6 month period starting on the commencement of this Part; and (b) the end of each subsequent 6 month period (if any) starting on or before the day determined under subsection 94Y(1);
94ZB(2) Reports by the Commissioner
Report must be prepared within 3 months after a specified day.
94ZB(3) Reports by the Commissioner
The Commissioner must publish a report on the website.
Temporal relation between report publication and website update
94ZB(4) Reports by the Commissioner
Commissioner must report on certain matters
94ZC COVID app data remains property of the Commonwealth
COVID app data remains property of the Commonwealth
privacy-amendment-public-health-contact-information-act-2020.pdf, p.27
94ZD Operation of other laws
94ZD(1) Operation of other laws
Cancels effect of provisions permitting or requiring conduct under other laws.
94ZD(2) Operation of other laws
Permits conduct despite provisions of this Part.
(2) However, the cancellation does not apply to a provision of an Act if...
Identifies overlapping intervals between commencement and conduct.
Identifies recurring intervals between commencement and conduct.
Diffuses information about permitted conduct.
Recognizes permitted conduct despite restrictions.
1 The whole of the instrument
privacy-amendment-public-health-contact-information-act-2020.pdf, p.28
2 Subsection 6(1)
3 Part VIIIA
4 Transitional
Continuation of powers and obligations after commencement
privacy-amendment-public-health-contact-information-act-2020.pdf, p.29