More than 1 million Australians have downloaded the new coronavirus contact tracing app less than a day after its release, according to health minister Greg Hunt.
On Monday, Hunt told Today the number hit 1.13 m by 6am.
Health agreed to:
- publish the app sourcecode to allow for independent analysis,
- regularly review the operation and privacy controls of the app,
- only collect the age range of a user through the app,
- ensure the app seeks consent from users at two points – before they agree to their registration information being uploaded to the national COVIDSafe data store, and before they agree to upload the “digital handshake” (the date, time, distance and duration of the contact) information on their device to the data store,
- develop and publish a range of communication materials so the general public are provided with a broad a range of information about the app and the national data store,
- allow users to provide a pseudonym,
- work with the Digital Transformation Agency to immediately review the contract with Amazon Web Services to ensure relevant provisions are included, assess adherence with the Protective Security Policy Framework and audit access management arrangements,
- put access restrictions to digital handshakes in place , noting that personnel in state and territory health authorities can only access digital handshakes which meet the risk parameters,
- put in place protocols to ensure consent from a parent, guardian or responsible adult is obtained before a child’s contact history is uploaded. For children under 16, a health professional will speak with the responsible adult where the child may have been in contact with a positive COVID-19 case.
Hunt has issued a new determination under the Biosecurity Act, the department noted, to ensure information provided through the app would only be accessible by authorised state and territory health officials, with any other access or use to be a criminal offence.
The attorney-general Christian Porter would also introduce legislation in the next Parliamentary sitting week in May to “establish a strict legal framework for information handling in the app”, Health said.
The moves would require all data in the national COVIDSafe data store to be deleted after the pandemic has concluded, and would override any obligation under an Australian law to retain data for a longer period, such as record-keeping obligations under the Archives Act 1983.
On Sunday government services minister Stuart Robert said app users should have it running in the background when they are coming into contact with others, but don’t need to have their phone unlocked for the app to work.
“All information collected by the app is securely encrypted and stored in the app on the user’s phone. No one, not even the user, can access it,” he said.
“Unless and until a person is diagnosed with COVID-19, no contact information collected in the app is disclosed or able to be accessed. Then, once the person agrees and uploads the data, only the relevant state or territory public health officials will have access to information. The only information they are allowed to access is that of close contacts — when a person has come within approximately 1.5 metres of another app user for 15 minutes or more — in their jurisdiction.”
The app would only keep contact information for 21 days, according to the government. The app and the information on it would be deleted permanently once the pandemic has concluded.