Stopping the Spread? Enhancing Legal Frameworks for the Protection of Personal Information in the Context of COVID-19 Contact Tracing

Sarah Moulds  
Senior Lecturer in Law, Justice and Society Unit, University of South Australia
Nadia Corsini
Senior Research Fellow, Rosemary Bryant AO Research Centre, University of South Australia
Jeremy Ryder
Online Tutor, University of South Australia
Nectaria Calan
Bachelor of Laws Student and Research Assistant, University of South Australia


Personal privacy versus public safety is a rights trade-off that has been brought into sharp focus by the COVID-19 pandemic, with flow-on implications for the success of contract tracing regimes implemented across Australia.  These contact tracing regimes depend upon the supply of accurate information by individuals, which in turn depends upon the trust that is placed in health authorities and other government officials to handle personal information with care.  A range of different laws govern the collection and use of personal information by health authorities at the federal level and in each Australian state or territory. Understanding these rules might help us to work out ways to ensure that everyone in our community feels like they can tell the truth when it matters most.  Using a case study from South Australia, this article reviews existing legislative, regulatory and policy frameworks that currently apply to the collection and use of personal information in health care and highlights the tension between creating incentives to share personal information and policing compliance with COVID-19 laws and ensuring robust legal protection for sensitive personal information.  Relevant lessons from the South Australian experience are then extrapolated for consideration by other Australian jurisdictions, with a view to identifying what safeguards and protections could be included in current legal frameworks governing the use, sharing and disclosure of personal information in health care settings to help resolve the current tension between protecting individual privacy and promoting public health.


1. ABC News, 2020a. “Parafield coronavirus cluster now officially ‘closed’ 28 days after last case en-tered isolation.” ABC News online, 23 December Accessed 25/6/21.
2. ABC News, 2020b. “South Australia's coronavirus cluster probe has taken another twist — here's what we know.” ABC News online, 25 November. Ac-cessed 25/6/21.
3. ABC News, 2020c. “QR codes are being rolled out in venues across South Australia – here’s what you need to know.” ABC News online, 1 Decem-ber. Accessed 25/6/21.
4. Auditor General’s Department, South Australia 2021. COVID-SAfe Check-In Review. Report No 13 of 2021. Available at . Accessed 6 December 2021.
5. Australian Government Attorney General’s De-partment, 2020. COVIDSafe legislation, Australian Government Attorney General’s Department.
Accessed 24/6/21.
6. Australian Government Department of Health, 2020. COVIDSafe app, Australian Government Department of Health. Accessed 24/6/21.
7. Australian Law Reform Commission, 2008. For Your Information: Australian Privacy Law and Practice, Report 108, Tabled August 2008, Syd-ney, Australian Law Reform Commission.
8. Barrett, R. and Brown, P. J. 2008. “Stigma in the time of influenza: social and institutional re-sponses to pandemic emergencies.” The Journal of Infectious Diseases, 197 (Supplement 1): S34-S37.
9. Beale, G. 2020. “Hating on the Woodville Pizza guy won’t fix a problem that was entirely fore-seeable.” The Conversation, November 24. Accessed 25/6/21.
10. Bell, F. 2020. “WA venues to adopt mandatory contact register from December 5 amid corona-virus risk.” ABC News online, 25 November. Accessed 26/6/21.
11. Biddle, N., Edwards, B., Gray, M., Hiscox, M., McEachern, S., and Sollis, K. 2020. Data trust and data privacy in the COVID-19 period, The ANU Centre for Social Research and Methods, 30 July. Accessed 25/6/21.
12. Burdon, M., & Wang, B. 2021. “Implementing COVIDSafe: The Role of Trustworthiness and In-formation Privacy Law” Law, Technology and Humans, 3(1), 35-50.
13. Centres for Disease Control and Prevention, 2021. Contact tracing: using digital tools. Centres for Disease Control and Prevention. Accessed 23/6/21.
14. Culnane C., and Leins K. 2020. “Misconceptions in Privacy Protection and Regulation” Law in Con-text. 36(2):49-0. Available from:
15. Donovan, S. 2020, “Tech troubles limit COVID-Safe app functionality, Senate inquiry hears.” PM - Australian Broadcasting Corporation, 6 May.
16. functionali-ty/12221414. Accessed 25/6/21.
17. Galloway, K. 2020. “The COVID cyborg: Protect-ing data status.” Alternative Law Journal, 45(3): 162-167.
18. Government of South Australia, 2018. Personal Information Data Breaches Guideline, DPCG9.1, Government of South Australia.
19. Government of South Australia, 2020. Infor-mation Privacy Principles (IPPS) Instruction, Premier and Cabinet Circular, PC012, May.
20. Government of South Australia Attorney Gen-eral’s Department, 2019. Making a Privacy Com-plaint, Government of South Australia. Accessed 25/6/21.
21. Harpur, Paul. 2020. “COVID-19 in Australia: Pro-tecting Public Health by Restricting Rights & Risking the Rule of Law” Bill of Health, Harvard Law, 14 May 2020 . Accessed 28 June 2021.
22. Hart, M. B. and Yarwood, T. 2020. “Explainer: What is contact tracing and how does it help limit the coronavirus spread?” The Conversation, 27 March.
23. Housen, T. 2020. “What can you expect if you get a call from a contact tracer?” The Conversation, 26 November. Accessed 25/6/21.
24. Juneau, C-E., Briand, A-S., Pueyo, T., Collazzo, P., and Potvin, L. 2020. “Effective Contact Tracing for COVID-19: A Systematic Review.” MedRxiv, preprint, doi:
25. Keeling, M. J., Hollingsworth T.D., and Read J.M. 2020. “Efficacy of contact tracing for the con-tainment of the 2019 novel coronavirus (COVID-19).” J Epidemiol Community Health, 74:861–866.
26. Leins, K., Culnane, C., and Rubinstein, B.I.P. 2020a. “Tracing, tracing, trust: contemplating mitigating the impact of COVID-19 with techno-logical interventions.” Medical Journal of Austral-ia, 213(1): 6-8.e1.
27. Leins, K., Culnane, C., and Rubinstein, B.I.P. 2020b. “Tracking, tracing, trust: contemplating mitigating the impact of COVID-19 through tech-nological interventions: in reply.” Medical Jour-nal of Australia, 213(1): 94-94.e1 (Letters).
28. Lewandowsky, S., Dennis, S., Perfors, A., Kashima, Y., White, J. P., Garrett, P., Little, D. R., and Yesilada, M. 2021, “Public acceptance of pri-vacy-encroaching policies to address the COVID-19 pandemic in the United Kingdom.” PLoS One, 16 (1): e0245740–e0245740.
29. Lovett, R., Fisher, J., Al-Yaman, F., Dance P., and Hassan, V. 2008. “A review of Australian health privacy regulation regarding the use and disclo-sure of identified data to conduct data linkage.” Australian and New Zealand Journal of Public Health, 32(3): 282 – 285.
30. Manfield, E. 2021. “Police access SafeWA app da-ta for murder investigation, prompting urgent law change.” ABC News online, 15 June.
31. McDonald, T. 2020. “Geelong experts to front contact tracing probe.” Geelong Advertiser 16 November 2021.
32. Moulds S, 2020a. “Personal privacy versus public health in a pandemic.” In Daily, 24 November. Accessed 21/6/21.
33. Moulds S. 2020b. “Scrutinising COVID-19 laws: An early glimpse into the scrutiny work of feder-al parliamentary committees.” Alternative Law Journal 45 (3): pp. 180-187.
34. Moulds, S; Corsini N; Ryder J, 2021. Stopping the Spread: Community Views and Legal Considera-tions to Support Faster, Easier COVID-19 Contact Tracing: Final Report. Adelaide SA, University of South Australia.
35. National Health and Medical Research Council, 2004. The Regulation of Health Information Pri-vacy in Australia: A description and comment. Canberra, Commonwealth of Australia.
36. O'Callaghan, M. E., Buckley, J., Fitzgerald, B., Johnson, K., Laffey, J., McNicholas, B., Nuseibeh, B., O'Keeffe, D., O'Keeffe, I., Razzaq, A., Rekana, K., Richardson, I., Simpkin, A., Abedin, J., Storni, C., Tsvyatkova, D., Walsh, J., Welsh, T., and Glynn, L. 2020. “A national survey of attitudes to COVID-19 digital contact tracing in the Republic of Ire-land.” Irish Journal of Medical Science, 16:1–25. doi: 10.1007/s11845-020-02389-y.
37. Office of the Australian Information Commis-sioner, Australian Government (2020) Privacy In Your State, Accessed 23/6/21.
38. Office of the Australian Information Commis-sioner, 2021. Privacy Complaints Accessed 25/6/21.
39. Olle, E. 2020. “Police reveal 'person of interest' behind SA's COVID pizza shop bungle.” 7, 21 November. Ac-cessed 25/6/21.
40. Pagallo, U., Casanovas, P. and Madelin, R. 2019. “The middle-out approach: assessing models of legal governance in data protection, artificial in-telligence, and the Web of Data,” The Theory and Practice of Legislation, 7(1), pp. 1-25, doi 10.1080/20508840.2019.1664543
41. Paynter, J. 2021. “Victorian government admits contact tracing ‘fell down’ as wrong Woolworths store listed.”, 25 May. Accessed 21/6/21
42. Prati, G., Pietrantoni, L., and Zani, B. 2011. “Com-pliance with recommendations for pandemic in-fluenza H1N1 2009: the role of trust and person-al beliefs.” Health Education Research, 26(5): 761-769.
43. Purtill, J. 2020. “A real sleuthing exercise’: every coronavirus case starts a race to track contacts,” ABC Triple J Hack, 3 March. Accessed 25/6/21.
44. Ramsay, M. 2021. “Privacy infringement fears af-ter police access data from SafeWA contact trac-ing app.” 7 News Online, 15 June. Accessed 21/6/21.
45. Read, C. 2021. “Victorian couple fined as Queens-land declares new COVID hotspot.” Brisbane Times, June 18. Accessed 25/6/21.
46. Remeikis, A. 2020. “Covid safe: Australian gov-ernment launches coronavirus tracing app amid lingering privacy concerns.” The Guardian (Aus-tralian edition), 26 April. Accessed 25/6/21.
47. SA Health, 2019a. Privacy Policy Directive, Policy Directive No D0445, 15 May.
48. SA Health, 2019b. Privacy Policy Framework (is-sued under the Privacy Policy Directive No D0445), 15 May.
49. SA Health, 2020. Meningococcal infection – in-cluding symptoms, treatment and prevention. Accessed 21/6/21.
50. SA Health, 2021a. How does contact tracing work? Accessed 23/6/21.
51. SA Health, 2021b. What is a close contact? COVID-19 frequently asked questions, Accessed 23/6/21.
52. SA Health, 2021c, COVIDSAfe Check-In FAQs for the Community, 7 June. Accessed 25/6/21.
53. SA Health, 2021. COVIDSAfe Check-In. Ac-cessed 25/6/21.
54. Smieszek, T., Castell, S., Barrat, A., Cattuto, C., White, P. J., and Krause, G. 2016. “Contact diaries versus wearable proximity sensors in measuring contact patterns at a conference: method com-parison and participants' attitudes.” BMC Infec-tious Diseases, 16 (1): 341–341.
55. Smith, Matthew. 2020, “The crippling truths of one cruel little lie” The Advertiser 11 November 2020, p.30.
56. The Law Society of South Australia, 2020. COVID-SAfe Check-In, Submission to the Premier of South Australia, 14 December.
57. Senate Select Committee on COVID-19, 2020. First Interim Report, Parliament of Australia, Canberra.
58. Watts, D. 2020. “COVIDSafe, Australia’s Digital Contact Tracing App: The Legal Issues” Un-published Paper, (May 2, 2020). Available at SSRN: or
59. White, B., McDonald, F., and Willmott, L. 2018. Health Law in Australia, Sydney, Thomson Reu-ters (Professional) Australia Pty Limited.
60. World Health Organisation, 2020a. WHO Direc-tor-General's opening remarks at the media brief-ing on COVID-19 - 11 March 2020. Accessed 26/6/21.
61. World Health Organisation, 2020b. Overview of public health and social measures in the context of COVID-19: Interim Guidance, World Health Or-ganisation, 18 May. Accessed 26/6/21.
62. World Health Organisation, 2020c. Joint State-ment on Data Protection and Privacy in the COVID-19 Response, 19 November. Accessed 26/6/21.
63. Yang, F., Heemsbergen, L., and Fordyce, R. 2021. “Comparative analysis of China’s Health Code, Australia’s COVIDSafe and New Zealand’s COVID Tracer Surveillance Apps: a new corona of public health governmentality?” Media International Australia, 178(1): 182-197.

Charter of Human Rights and Responsibilities Act 2006 (Vic).
COVID-19 Emergency Response Act 2020 (SA).
Emergency Management Act 2004 (SA).
Emergency Management (Information Security) Amendment Bill 2021 (SA).
Health Care Act 2008 (SA).
Health Records Act 2001 (Vic).
Health Records and Information Privacy Act 2002 No 71 (NSW).
Health Records (Privacy and Access) Act 1997 (ACT).
Human Rights Act 2004 (ACT).
Human Rights Act 2019 (Qld).
Information Act 2002 (NT).
Information Privacy Act 2014 (ACT).
Information Privacy Act 2009 (Qld).
Mental Health Act 2009 (SA)
Personal Information and Protection Act 2004 (Tas).
Privacy Act 1988 (Cth).
Privacy Amendment (Public Health Contact Infor-mation) Act 2020 (Cth).
Protection of Information (Entry Registration Infor-mation Relating to COVID-19 and Other Infectious Diseases) Bill 2021 (WA).
Public Health Act 2011 (SA).
Public Sector (Data Sharing Act) 2016 (SA).
South Australian Public Health Act 2011 (SA).
State Records Act 1997 (SA).

Emergency Management (Public Activities No 15) (COVID-19) Direction 2020 (SA).
Emergency Management (Public Activities No 23) (COVID-19) Direction 2021 (SA).
Emergency Management (Public Activities No 24) (COVID-19) Direction 2021 (SA).
Public Sector (Data Sharing) Regulations 2017 (SA).
South Australian Public Health (Notifiable and Con-trolled Notifiable Conditions) Regulations 2012 (SA).

International Covenant for Civil and Political Rights, opened for signature 16 December 1966, 999 UNTS 171 (entered into force 23 March 1976).
How to Cite
Moulds S, Corsini N, Ryder J, Calan N. Stopping the Spread? Enhancing Legal Frameworks for the Protection of Personal Information in the Context of COVID-19 Contact Tracing. LiC [Internet]. 2022Jan.24 [cited 2022May24];37(3). Available from:

Send mail to Author

Send Cancel