When Trust Fails Purpose: Legislative Lessons from Police Access to the SafeWA COVID-19 Contact Tracing Data

Abstract

In response to the ongoing COVID-19 pandemic, Western Australia (WA) introduced in November 2020 a mandatory contact tracing registration system and rolled out an online mobile application (the SafeWA app) which allowed users to easily check-in to venues at which they were required to register their attendance. The WA public was assured that their check-in data, including data logged through the SafeWA app, would only be used for contact tracing purposes. Despite this, it later came to light that WA Police had sought and gained access to data collected by the SafeWA app in connection with criminal investigations. Following that revelation, and to address its potential to undermine public confidence in the SafeWA app (and the contact tracing system in general), the WA Government introduced the Protection of Information (Entry Registration Information Relating to COVID-19 and Other Infectious Diseases) Act 2021 (WA). That Act, which came into force in June 2021, provides that entry registration information can be used only for contact tracing and some other specified purposes and cannot be used for general criminal investigations or law enforcement. This article examines the legislative basis of WA’s mandatory contact tracing registration system and highlights some of the implications for law-making, parliamentary oversight and the rule of law which result from the use of subsidiary legislation to effect significant controls over the public.