April 1, 2020
PUBLIC STATEMENT
Mobile device tracking of COVID-19 infected persons
Prime Minister Scott Morrison has confirmed that the Commonwealth government is progressing with Singapore-style digital options for contact tracing: the identification, contacting and monitoring of those who may be infected with COVID-19, and their contacts.[1] In addition, the Australian government has now launched a Coronavirus Australia app and WhatsApp group, to provide Australians with information, and advice, about the pandemic. The Coronavirus Australia app permits the voluntary registration of a person’s self-isolation but does not, currently, provide for contact tracing.[2] At present, in Australia, contact tracing is conducted manually and directly with the affected person.[3]
NSWCCL supports the appropriate and generalised use of aggregated, anonymised map data for tracking people’s movements; to assist health services and determine where to target critical medical resources. Contact tracing is essential. However, any collection or use of a person’s sensitive personal data for digital contact tracing must come with the imposition of strict limitations.
The move to monitor citizens’ movements may set a dangerous precedent. Contact tracing and the wider application of mobile device tracking would enable the Australian government to assemble a person’s location history into a single, searchable database. Mobile device tracking, in Australia, could involve tracking infected persons to ensure compliance with self-quarantine, as in Israel (see below). South Korean authorities publicly share details of the age, gender and location of persons infected with COVID-19, by mobile phone alert and on the government’s health website.[4] Often that information is sufficient to identify the infected person.
NSWCCL calls for complete transparency from the Australian government of its development and use of any mobile device tracking technology in this emergency.
Last week, Israel’s cabinet passed an emergency law to enable use of mobile phone data for tracking infected people, to ensure compliance with self-quarantine and for contact tracing.[5] This follows the introduction of emergency surveillance measures taken by a number of governments around the world, notably China and South Korea. South Australia Police have said that they are already implementing tracking of non-compliant infected persons.[6]
It has been reported that the Australian government is seeking legal advice on a proposal to track the mobile phones of quarantined returned travellers. If service providers are compelled to hand over users’ data, despite years of resistance to the use of telecommunications data for surveillance purposes, legislative amendments to the Biosecurity Act 2015 [the Act], are then likely to be required. The Act does not specifically allow for the tracking of the telecommunications of people in quarantine or isolation.[7]
However, the Act does permit, in a declared human biosecurity emergency, the Commonwealth Health Minister to issue “any direction to a person” or “determine any requirement” to prevent or control the emergence, establishment or spread of a disease such as COVID-19.[8] Importantly, the Act also provides that the Minister must be satisfied that the requirements are: likely to be effective in, and appropriate to, achieving its purpose; no more restrictive or intrusive than required in the circumstances; and, applied for a period that is no longer than necessary.[9]
A requirement is not effective in achieving the purpose if a person’s willingness to comply is reduced. For example, increased privacy concerns may deter people from carrying mobile phones or reporting reliable infection information. Compliance is supported by features such as opt-in and anonymising measures.
A requirement is not effective in achieving its purpose if it is not accurate. In terms of tracking the spread of the disease, a phone is able to determine its position with an accuracy of 7-13 metres. COVID-19 infected persons may spread the disease within 1.5 metres of each other.[10]
A requirement to collect sensitive data for tracing or tracking may not be appropriate to achieve the purpose. According to technology experts, it should be possible to implement mobile device tracking without establishing a national database that could facilitate government surveillance.[11] Israel, for example, has provided assurances to its citizens that information will not be saved on the database of the security forces.[12]
Without a Bill of Rights or a statutory cause of action for serious invasion of privacy, it is problematic for Australians to remedy injustices due to restrictive or intrusive laws. In an emergency, individuals may be arbitrarily or mistakenly targeted and should be guaranteed redress through an easily accessible complaints system, coupled with independent judicial oversight.
Israel’s emergency tracking law has been approved for 30 days.[13] Exceptional or emergency powers risk becoming institutionalised over time and must have clear, short periods of application. “Sunset clauses” ensure that laws do not continue for longer than is proportionate to the situation, considering especially that there may have been little or no scrutiny by parliament. Lack of parliamentary approval and judicial oversight have been criticisms of the Israeli legislation.
In Australia, any implementation of mobile device tracking capability should also be accompanied by an independent oversight role for the Office of the Australian Information Commissioner (or other government office), accompanied by the appropriate resources to fulfil that oversight role effectively.
To date, the Commonwealth and State governments have appeared to have acted in good faith in the most extraordinary circumstances. However, Australia will not have a functioning parliament until August 2020, compelling all to be even more alert than usual to the manner in which powers are being awarded and implemented during this period.
Michelle Falstein
Convenor, Privacy and Data Retention Action Group
NSW Council for Civil Liberties
Contact: [email protected]
[1] The Australian (25 March 2020) Now surveillance goes viral; Corona crackdown- police ready to use mobile phone data to track victims
[2] ABC News (29 March 2020) Federal Government launches Coronavirus Australia app and WhatsApp feature https://www.abc.net.au/news/2020-03-29/federal-government-launches-coronavirus-australia-app/12100680
[3] Department of Health, Australian Government (26 March 2020) Coronavirus Disease 2019 (COVID-19) CDNA National Guidelines for Public Health Units https://www1.health.gov.au/internet/main/publishing.nsf/Content/7A8654A8CB144F5FCA2584F8001F91E2/$File/interim-COVID-19-SoNG-v2.4.pdf
[4] BBC News (5 March 2020) Coronavirus privacy: Are South Korea's alerts too revealing? https://www.bbc.com/news/world-asia-51733145
[5] ABC News (18 March 2020) Israel enables spy power to track people suspected of having coronavirus
https://www.abc.net.au/news/2020-03-18/israel-enables-spy-services-to-track-coronavirus-patients/12066256
[6] Op.cit. The Australian (25 March 2020)
[7] ibid
[8] Ss. 478 & 477 Biosecurity Act 2015, respectively
[9] Ss 477(4) & 478(3) Biosecurity Act 2015
[10] Knight, W (15 March 2020) Phones Could Track the Spread of Covid-19. Is It a Good Idea? Wired https://www.wired.com/story/phones-track-spread-covid19-good-idea/
[11] Peter Eckersley of the Electronic Frontier Foundation in Knight, W. ibid.
[12] Op.cit. ABC News (18 March 2020)
[13] ibid.
