While Australia and New Zealand have successfully flattened the COVID-19 curve, the approaches of each country have somewhat differed, both in relation to the level of restrictions imposed on citizens, as well as the type of contact tracing technology deployed.
Australia and New Zealand stand alongside Germany, South Korea and Singapore as examples of countries that followed the advice of their scientists and moved into lockdown in a timely way to limit the spread of the COVID-19 virus.
Australia, similar to other countries, experienced a doubling of COVID-19 positive people every two days as it went into lockdown. The containment of the coronavirus in Australia and New Zealand is a result of a multipronged strategy that includes prompt lockdowns restricting movement and requiring social distancing; quarantining of international travellers for 14 days; and a high rate of testing and contact tracing.
The governments of both countries have developed their own voluntary app to speed up and support the manual tracking process of people who have been in contact with individuals who tested positive for COVID-19. Australia’s COVIDSafe app is a modified version of Singapore’s TraceTogether using Bluetooth technology to track encounters between the user’s phone and other phones that are using the app. New Zealand’s COVID Tracer app enables users to record their visits to specific businesses and organisations that have registered with either the Ministry of Health or the Ministry of Business, Innovation and Employment.
Australia’s COVIDSafe App
Australia launched its COVIDSafe app on 26 April 2020, with one million downloads in the first 24 hours. By the end of the first week, over four million people had downloaded the app. While the initial download rate of the app was positive, the rate then slowed. A month later, at the end of May, just over six million people had downloaded the app, which is nearly 25 percent of the population, although still a distance from the government’s 40 percent take-up target.[1]
The COVIDSafe app is considered by Australia’s Chief Medical Officer and the Government as a key tool to expedite contact tracing to enable lockdown restrictions to ease and enable Australians to return to everyday living more quickly. Privacy has been a central consideration in the development of the app and the COVIDSafe legislation, passed by Parliament on 14 May 2020, enshrines that the app is voluntary and no one is required to download it.[2]
How It Works
Following the approach of Singapore’s TraceTogether software, the COVIDSafe app uses Bluetooth technology to find other COVIDSafe app users. Australians are asked to provide a name (which can be a pseudonym), a contact phone number, a postcode and an age range. The app records the date, time, distance, duration of the contact and the other user’s reference code. The app does not collect location data. The information is encrypted and stored on the user’s phone. The contact information stored on phones is deleted on a 21-day rolling cycle. Users who test positive for COVID-19 have the option of uploading the encrypted data on their device to the National COVIDSafe data store. The uploaded data is information about other users who have been in contact within 1.5 metres for 15 minutes or more.
Privacy Protections
Privacy was a central consideration in the development of the COVIDSafe app. At the time the COVIDSafe app was launched, the Privacy Impact Assessment (PIA) report, the Department of Health’s Agency Response to the PIA, and the Privacy Policy for the app were made publicly available.[3]
Prior to passing the legislation on 14 May 2020, the Health Minister issued a Determination under the Biosecurity Act to protect people’s privacy and restrict access to information obtained from the app. The Determination enabled State and Territory health authorities to access the information solely for contact tracing, but only with the explicit consent of the user.[4] The only other access was by the COVIDSafe Administrator, including deletion of registration information at the user’s request.
On 5 May 2020, the Australian Government released the draft Privacy Amendment (Public Health Contact Information) Bill 2020, (COVIDSafe Act), which was subsequently passed by both houses of Parliament on 14 May 2020. The COVIDSafe Act enshrines privacy protections contained in the Health Minister’s Determination under the Biosecurity Act 2015. Breaching the requirements of the legislation is a criminal offence, a breach of the Privacy Act 1988, or both.
The COVIDSafe Act protects the app as being voluntary, stating that no one can be forced to download or use COVIDSafe or upload its data to the National COVIDSafe data store. The Act makes it a criminal offence, punishable by up to five years in prison or a $63,000 fine per breach, or both, to misuse the data or pass it on without the explicit permission of the user after contracting COVID-19. Data will be deleted every 21 days and the administrator of the National COVIDSafe data store will delete users’ registration data upon request. The legislation provides a process to be put in place for COVIDSafe data to be deleted at the end of the COVID-19 pandemic and users to be notified accordingly.
Over Collection of Data
Privacy academics Professor Graham Greenleaf and Dr. Katharine Kemp stated that ‘[a] crucial problem with the legislation is it allows the government to collect much more personal data than is necessary for contact tracing.’[5] They refer to the PIA of COVIDSafe and point out that the app collects data about ‘all other users who came within Bluetooth signal range even for a minute within the preceding 21 days.’ As Greenleaf and Kemp point out, the data collected should be minimised to that which is necessary and technically possible.
Data Storage
The data collected by the COVIDSafe app will be stored in Canberra in the National COVIDSafe data store. After it emerged that the government contract for storage of the COVIDSafe data was awarded to U.S. tech giant Amazon Web Services (AWS), concerns were raised about the global tech giant being awarded the contract over an Australian provider and the potential access to the data by the U.S. government, given the extraterritorial reach of the U.S. CLOUD Act 2018.
In response to the concerns, Health Minister Greg Hunt stated that he received advice from Attorney-General Christian Porter’s office that protections under Australia’s Biosecurity Act 2015 would prevail over the CLOUD Act.[6] The Department of Health’s information webpage about COVIDSafe explains that the Australian Government’s Digital Transformation Agency had existing contracts with AWS, that the data is required to be stored in Australia, and AWS does not have access to the national COVIDSafe data store.[7]
Cybersecurity Concerns
Cybersecurity concerns have focused on the risks around a National COVIDSafe data store, as well as cybercrimes. The Australian Cyber Security Centre reports that from 10 March to early June 2020, there were more than 1,100 related COVID-19 scams reported to the Australian Competition and Consumer Commission (ACCC), 95 cybercrime reports related to COVID-19 themed scams and online frauds, 20 cybersecurity incidents affecting COVID-19 response services and/or major national suppliers, and over 150 malicious COVID-19 theme websites.[8]
Prior to the release of the COVIDSafe app, it was independently reviewed by the Cyber Security Cooperative Research Centre and CSIRO’s Data 61 with a team of cyber experts. The app’s source code was made available on 7 May 2020. While it was a further demonstration of transparency and enabled further scrutiny, the server code on ‘which all the important encryption is done’ was not made available.[9]
Limitations of Bluetooth Functionality
It has been slow going fixing Bluetooth bugs and there were challenges getting the app to work properly on iPhones.[10] The Apple version of the COVIDSafe app needed to be open for the Bluetooth functionality to work on iPhones, which drains the battery. However, an updated version enables the iPhone screen to be locked as long as the app is open. Upon releasing the second update to COVIDSafe, the Digital Transformation Agency’s media release on 14 May 2020, explained:[11]
We are continuing to make iterative improvements to enhance COVIDSafe’s Bluetooth performance.’
Today’s update includes new code from the United Kingdom Government’s National Health Service (NHSX) that improves the COVIDSafe app’s Bluetooth performance on iOS devices, including when the device is locked.
We continue to work with Apple and Google on further enhancements that will improve COVIDSafe’s performance.’
Google and Apple
In April 2020, Google and Apple announced a joint collaboration to enable the use of Bluetooth technology to help governments and health agencies to reduce the spread of COVID-19. User privacy and security are central to the design.
On 21 May 2020, Google and Apple released their contact tracing API to 22 countries, including Australia. The Exposure Notification System enables those who test positive to COVID-19 to alert others so they can isolate and/or get tested. Importantly, device location is not collected; it holds data only on users’ phones with no central data repositories and only official public health authorities are allowed to use the system whose apps ‘meet the specific criteria around privacy, security and data control.’
This decentralised approach is in contrast to Australia’s centralised data store for those who test positive and consent to upload their personal information and those they have been in contact with, which is then sent to the relevant state or territory carrying out the contact tracing. The collection of additional personal information, such as phone numbers, means that if the Australian government wants to utilise the Exposure Notification System, it will need to make modifications to the COVIDSafe app.
Differences in Australian and New Zealand Approaches
While Australia embarked on a suppression strategy of COVID-19, New Zealand implemented a higher level of lockdown restrictions, pursuant to the COVID-19 Response (Urgent Management Measures) Legislation Act 2020, with the objective of eliminating COVID-19.[12] New Zealand’s first reported COVID-19 case was on 28 February 2020 and on 26 March 2020, Prime Minister Jacinda Ardern, implemented the COVID-19 Alert System Level 4 – Lockdown.
By 26 April 2020, New Zealand had 1,121 confirmed COVID-19 cases and 18 deaths, with only four new cases reported on the preceding day. New Zealand’s approach required all nonessential services to be shut down, so basically only supermarkets and pharmacies remained open. This was significantly more restrictive than Australia’s lockdown, which enabled cafes and restaurants to continue to provide take-away services and other retail outlets to remain open.
On 8 June 2020, New Zealand was COVID-19 free after the recovery of the last person with COVID-19 and 17 days without a new case. The following day, all restrictions were lifted. Controls at the border remain in place, however, with a mandatory 14-day quarantine or self-isolation.
While Australia’s strategy was suppression, with the first confirmed case late in January 2020, the extent of containing the pandemic before the launch of the COVIDSafe app was impressive. There were 6,710 reported cases and 83 COVID-19 deaths in Australia. In the preceding six days leading up to the app’s launch on 26 April 2020, there were only between eight and 22 people testing positive across the entire country. On 8 June 2020, New South Wales, with a population of eight million, reported two new COVID-19 cases for the first of June 2020.[13]
Australia, with one of the highest levels of testing rates for COVID-19 per capita globally, has experienced a 1.4 percent mortality rate, which is slightly lower than New Zealand’s mortality rate of 1.5 percent. While these rates are low, there are other countries with lower mortality rates, such as Singapore at 0.43 percent, which is in stark contrast to the United Kingdom’s 14.2 percent mortality rate and 5.8 percent in the United States, according to Johns Hopkins University & Medicine Coronavirus Resource Center – Cases and mortality by country chart as at 7 June 2020.[14]
Contact Tracing in New Zealand
While the focus on technology to assist in contact tracing is a key plank for the Australian Government to enable the continuing containment of the virus, the New Zealand approach places less importance on the role of technology in contact tracing. On 19 April 2020, Prime Minister Ardern said in a COVID-19 media update:[15]
An app will only ever supplement the work that we have to do for contact tracing. And, again, most countries who have an app like this will highlight that you have to have the foundation of people and a people-centred network of contact tracers.’
The Prime Minister also asked New Zealanders to keep a diary of their daily movements to help with contact tracing. [16]
While the shutdown was very effective in New Zealand for containing the spread of COVID-19, Level 4 restrictions were reduced to Level 3 restrictions on 27 April 2020. This coincided with increasing concerns about the very serious economic challenges that were mounting, including from a group of academics who launched a campaign called ‘Plan B’, arguing the Level 4 measures were too strict and would create more serious problems. On 7 May 2020, Prime Minister Ardern set out Level 2 rules, with the Cabinet making a decision to reduce the level of restrictions on 11 May 2020.
On 20 May 2020, the New Zealand Ministry of Health launched its voluntary NZ COVID Tracer app together with the privacy impact assessment.[17] The Trace app enables users to create a digital diary of the locations visited by the user. The phone camera scans and selects any Ministry of Health COVID-19 QR code posters displayed by businesses and organisations visited. The QR codes contain the name of the business or organisation, its business number, the address and the global location number of the premises. The digital diary is designed to support, rather than replace, existing contacting tracing processes.
New Zealand’s Privacy Commissioner John Edwards said, ‘The Ministry’s app is a privacy-friendly solution for contact tracing which New Zealanders should feel secure in downloading and using. [18]
Is the COVIDSafe App Making a Difference?
At the launch of the COVIDSafe app, Health Minister Greg Hunt explained that the contact tracing app was one of three keys for Australia’s recovery from the pandemic. The other two were to expand testing capacity to people who are asymptomatic and increase rapid response capability, such as what occurred for the outbreak in a regional Tasmanian hospital, to contain outbreaks.
The Singapore experience shows that while the virus can be suppressed, there can be cluster outbreaks, such as those that have occurred in Singapore’s migrant worker dormitories. Cluster outbreaks in New South Wales in aged care homes, a regional hospital in Tasmania, and a meat abattoir in Victoria similarly highlight the significant challenges that are continually being reported and could last for up to two years. However, the Australian suppression strategy – with social distancing, allowing cafes and restaurants to do take-away, and allowing retail shops and hairdressers to remain open – has enabled Australia to still achieve suppression and possibly elimination all before the COVIDSafe app was available.
By the first week of June 2020, more than a month after the app’s launch, it was reported that there had only been one known case where a COVID-19 patient had downloaded the app and consented to the Victorian Health Department using the data. The data identified a person who hadn’t been identified in the initial interviewing process.
Deputy Chief Medical Officer, Dr Nick Coatsworth, explained, ‘[t]hat reflects how well Australia is doing. There are so few cases that it will naturally mean that the app will not be as well utilised by public health authorities simply because the cases are low’.[19] While the app has so far not yielded any significant benefits, it is part of the overall response strategy of test, trace and self-isolate, and will be important in the event of a significant cluster outbreak or a second wave of the pandemic.
Conclusion
Australia and New Zealand developed their contact tracing apps as part of an overall strategy of testing, contact tracing, early self- isolation, and mandatory quarantining of international travellers. The use of contact tracing technology supports the manual tracking undertaken by people who were in contact with those individuals who test positive for COVID-19.
The actions of the Australian and New Zealand governments to restrict movement in a timely way has resulted in containment of the pandemic to date. Given the initial success of this suppression strategy in Australia and the elimination of COVID-19 in New Zealand, the contact tracing technology has not to date played a significant role. However, as a means of supporting and speeding up manual contact tracing in any cluster outbreaks or second waves of the pandemic, the apps are important tools for tracing potentially infected individuals to minimise further spread of COVID-19.
While both apps are voluntary, the COVIDSafe app has only been downloaded by 25 percent of Australians and is still well short of the target of 40 percent of the population. Once users have downloaded the app and where the user consents, the data can be accessed quickly and easily to track individuals who were in contact with the user for more than 15 minutes. The New Zealand app, on the other hand, minimises data collection, but requires ongoing commitment by users to scan codes of all premises they visit. The different approaches to the apps, where not all contacts are traced, highlight the usage of this type of technology as a support tool to manual contact tracing and is appropriate given the privacy and cybersecurity concerns and the low levels of COVID-19 infection rates.
It is clear that contact tracing is key to containing the expected continuing outbreaks and will assist in returning to a post COVID-19 ‘new normal’ world. There is no doubt that technology will provide a faster and more efficient way of finding and containing fast spreading COVID-19 cluster outbreaks than asking people to either remember or keep a record of all their movements. The role of contact tracing technology, particularly given that the pandemic is being predicted to be with us in one form or another for up to two years, will be crucial in managing the pandemic.
The key is for governments to ensure that privacy and cyber risks are mitigated and minimised. It would be a significantly good outcome for citizens where the use of technology for contact tracing ensures that cluster outbreaks are contained and there is a return to everyday living without further widespread waves of the pandemic and lockdowns.
While we as citizens have demonstrated we can live with restrictions on our movements and requirements to social distance without technology surveillance, we need government to demonstrate it can be trusted with our personal information.
Author
Susan Bennett (LLM(Hons), MBA, FGIA, CIPP/E) is the Founder and Executive Director, Information Governance ANZ and Principal, Sibenco Legal & Advisory
References
[1] Meixner, Sophie, ‘How many people have downloaded the COVIDSafe app and how central has it been to Australia’s coronavirus response?’, ABC, 2 June 2020 , <https://www.abc.net.au/news/2020-06-02/coronavirus-covid19-covidsafe-app-how-many-downloads-greg-hunt/12295130>.
[2] Privacy Amendment (Public Health Contact Information) Act 2020.
[3] Department of Health, COVIDSafe Application Privacy Impact Assessment, <https://www.health.gov.au/resources/publications/covidsafe-application-privacy-impact-assessment>.
[4] Biosecurity (Human Biosecurity Emergency) (Human Coronavirus with Pandemic Potential) (Emergency Requirements—Public Health Contact Information) Determination 2020, <https://www.legislation.gov.au/Details/F2020L00480>.
[5] Greenleaf, Graham and Kemp, Katharine, Australia’s COVIDSafe Experiment, Phase III: Legislation for Trust in Contact Tracing (May 15, 2020). (2020) University of New South Wales Law Research Series. Available at SSRN: https://ssrn.com/abstract=3601730.
[6] Koslowski, Max, ‘Coronavirus app data will stay here despite US security laws, Health Minister says’, 28 April 2020, Sydney Morning Herald, <https://www.smh.com.au/politics/federal/coronavirus-app-data-will-stay-here-despite-us-security-laws-health-minister-says-20200428-p54o05.html>.
[7] Department of Health, COVIDSafe help, Why did the Australian Government choose Amazon Web Services? <https://www.health.gov.au/resources/apps-and-tools/covidsafe-app/covidsafe-help>.
[8] Australian Government, Australian Cyber Security Centre, ‘Threat update: COVID-19 malicious cyber activity’, as of 7 June 2020, <https://www.cyber.gov.au/threats/threat-update-covid-19-malicious-cyber-activity-20-apr-2020>.
[9] Teague, Vanessa, posted on Twitter 11 May 2020, <https://twitter.com/VTeagueAus/status/1259644018939408384>.
[10] Basford, Sarah, ‘CovidSafe still has bugs, according to experts’, Gizmodo, 25 May 2020 <gizmodo.com.au/2020/05/covidsafe-bugs-ios-android-tracking-privacy/>.
[11] Digital Transformation Agency, ‘The new release of COVIDSafe is live’, 14 May 2020, https://www.dta.gov.au/news/next-release-covidsafe-live
[12] COVID-19 Response (Urgent Management Measures) Legislation Act 2020, <https://www.parliament.nz/en/pb/bills-and-laws/bills-proposed-laws/document/BILL_96378/covid-19-response-urgent-management-measures-legislation>.
[13] NSW Department of Health, NSW COVID-19 case statistics, <https://www.health.nsw.gov.au/Infectious/covid-19/Pages/stats-nsw.aspx>, See also Department of Health, Coronavirus (COVID-19) current situation and case numbers, <https://www.health.gov.au/news/health-alerts/novel-coronavirus-2019-ncov-health-alert/coronavirus-covid-19-current-situation-and-case-numbers#total-cases-recoveries-deaths-and-new-cases-in-the-last-24-hours>.
[14] Johns Hopkins University & Medicine, Coronavirus Resource Center, Mortality Analysis, 7 June 2020, <https://coronavirus.jhu.edu/data/mortality>.
[15] Covid-19 media update, 19 April 2020, Ministry of Health, <https://www.health.govt.nz/news-media/news-items/covid-19-media-update-19-april>.
[16] Ibid.
[17] NZ COVID Tracer app, Ministry of Health, <https://www.health.govt.nz/our-work/diseases-and-conditions/covid-19-novel-coronavirus/covid-19-novel-coronavirus-resources-and-tools/nz-covid-tracer-app>.
[18] New Zealand Privacy Commission, ‘Privacy Commissioner backs NZ COVID Traces app’, 20 May 2020, <https://www.privacy.org.nz/news-and-publications/statements-media-releases/privacy-commissioner-backs-nz-covid-tracer-app/?mc_cid=cd56848da2&mc_eid=a12a97dd18>.
[19] Meixner, Sophie, ‘How many people have downloaded the COVIDSafe app and how central has it been to Australia’s coronavirus response?’, ABC, 2 June 2020 , <https://www.abc.net.au/news/2020-06-02/coronavirus-covid19-covidsafe-app-how-many-downloads-greg-hunt/12295130>.
Follow on LinkedIn
Follow on Twitter