Legislative Assembly for the ACT: 2021 Week 09 Hansard (Thursday, 16 September 2021) . . Page.. 2662 ..
MRS JONES: I move amendment No 1 circulated in my name [see schedule 1 at page 2679].
This amendment, as mentioned in my previous speech, would amend the definition of a permitted purpose in proposed section 2C to require that any purpose related to contact tracing be prescribed by regulation.
Whilst the minister has gone into some detail on her view of the purposes of this bill and the difference between the aggregate and the personal data, and whilst we completely agree with the protection of personal data, there is a reasonable discussion to have. People have a concern about it every time they check in. I do not know about you, but every time I check in there is a little bit of me that worries. That is why the bill is important and that is why it would be very good to prescribe by regulation what a permitted purpose is.
We have already had surprises in the community, like the letters that went out to business that had a rather threatening tone. That is why people were arcing up about them—about the data. Everybody was trying to help the situation, but then they were asking what the data was being used for and why the Chief Minister’s directorate had it?
I know that it is not personal data; it is data in the aggregate. Nonetheless, in not supporting this amendment, it is worth the government considering prescribing the uses of the data and making that very clear to the public. The public have a right to know what their data is used for and to not just be asked to trust that everything will be okay.
MS STEPHEN-SMITH (Kurrajong—Minister for Aboriginal and Torres Strait Islander Affairs, Minister for Families and Community Services and Minister for Health) (5.34): As I have indicated, the government will not be supporting Mrs Jones’s amendment. Fundamentally, it is because the example that she provided does not relate to the information that is covered under the act. I will go back to my letter because it is important to understand “permitted purpose” alongside the definition of “contact tracing”, and why there might be another purpose related to contact tracing that would be permitted. Examples provided in the bill are to assess the integrity or security of the check-in information and to provide support services.
The directorate has advised that there is actually a risk, if we have to prescribe by regulation, that something will be missed. If there is a cyber-attack or some other unforeseen circumstance, the IT people will not be able to access that Check In CBR information to find out exactly what is going on, and that will be really critical regarding the safety and security of the system. Fundamentally, that is the reason we are not supporting this amendment.