for the purposes of a provision of Part VIIIA specified in a determination under section 94Z—the agency specified in that determination (but not to the extent of any limitation in that determination); or

otherwise—the Health Department.

encourage public acceptance and uptake of COVIDSafe; and

enable faster and more effective contact tracing.

the person collects, uses or discloses data; and

the data is COVID app data; and

the collection, use or disclosure is not permitted under this section.

the person is employed by, or in the service of, a State or Territory health authority, and the collection, use or disclosure is for the purpose of, and only to the extent required for the purpose of, undertaking contact tracing; or

the person is:

an officer or employee of the data store administrator; or

a contracted service provider for a government contract with the data store administrator;

enabling contact tracing by persons employed by, or in the service of, State or Territory health authorities; or

ensuring the proper functioning, integrity or security of COVIDSafe or of the National COVIDSafe Data Store; or

in the case of a collection or disclosure of COVID app data—the collection or disclosure is for the purpose of, and only to the extent required for the purpose of:

transferring encrypted data between communication devices through COVIDSafe; or

transferring encrypted data, through COVIDSafe, from a communication device to the National COVIDSafe Data Store; or

the collection, use or disclosure is for the purpose of, and only to the extent required for the purpose of, the Commissioner performing the functions or exercising the powers of the Commissioner under or in relation to this Part; or

the collection, use or disclosure is for the purpose of, and only to the extent required for the purpose of:

investigating whether this Part has been contravened; or

prosecuting a person for an offence against this Part; or

in the case of a use of COVID app data by the data store administrator—the use is for the purpose of, and only to the extent required for the purpose of, producing de-identified statistical information about the total number of registrations through COVIDSafe; or

in the case of a use of COVID app data that the data store administrator is required by section 94L to delete—the use consists of access by the data store administrator for the purpose of, and only to the extent required for the purpose of, confirming that the correct data is being deleted.

the collection of the COVID app data:

(i) occurs as part of the collection, at the same time, of data that is not COVID app data (non-COVID app data); and

is incidental to the collection of the non-COVID app data; and

the collection of the non-COVID app data is permitted under an Australian law; and

the COVID app data:

is deleted as soon as practicable after the person becomes aware that it had been collected; and

is not otherwise accessed, used or disclosed by the person after it was collected.

has been collected or generated (including before the commencement of this Part) through the operation of COVIDSafe; and

either:

is registration data; or

is stored, or has been stored (including before the commencement of this Part), on a communication device.

information obtained, from a source other than directly from the National COVIDSafe Data Store, in the course of undertaking contact tracing by a person employed by, or in the service of, a State or Territory health authority; or

de-identified statistical information about the total number of registrations through COVIDSafe that is produced by:

an officer or employee of the data store administrator; or

a contracted service provider for a government contract with the data store administrator.

notifying a person that the person has been in contact with a person who has tested positive for the coronavirus known as COVID-19; and

notifying a person who is a parent, guardian or carer of another person that the other person has been in contact with a person who has tested positive for the coronavirus known as COVID-19; and

providing information and advice to a person who:

has tested positive for the coronavirus known as COVID-19; or

is a parent, guardian or carer of another person who has tested positive for the coronavirus known as COVID-19; or

has been in contact with a person who has tested positive for the coronavirus known as COVID-19; or

is a parent, guardian or carer of another person who has been in contact with a person who has tested positive for the coronavirus known as COVID-19.

the person uploads, or causes to be uploaded, data from a communication device to the National COVIDSafe Data Store; and

the data is COVID app data; and

consent to the upload has not been given by:

the COVIDSafe user in relation to that device; or

if the COVIDSafe user is unable to give consent—a parent, guardian or carer of the COVIDSafe user; or

if the COVIDSafe user has requested a parent, guardian or carer of the COVIDSafe user to act on the COVIDSafe user’s behalf—that parent, guardian or carer.

the person retains data on a database outside Australia; and

the data is COVID app data that has been uploaded from a communication device to the National COVIDSafe Data Store.

the person discloses data to another person who is outside Australia; and

the data is COVID app data that has been uploaded from a communication device to the National COVIDSafe Data Store; and

the person is not a person who:

is employed by, or in the service of, a State or Territory health authority; and

discloses the data for the purpose of, and only to the extent required for the purpose of, undertaking contact tracing.

the person decrypts encrypted data; and

the data is COVID app data that is stored on a communication device.

download COVIDSafe to a communication device; or

have COVIDSafe in operation on a communication device; or

consent to uploading COVID app data from a communication device to the National COVIDSafe Data Store.

refuses to enter into, or continue, a contract or arrangement with another person (including a contract of employment); or

(b) takes adverse action (within the meaning of the Fair Work Act 2009) against another person; or

refuses to allow another person to enter:

premises that are otherwise accessible to the public; or

premises that the other person has a right to enter; or

refuses to allow another person to participate in an activity; or

refuses to receive goods or services from another person, or insists on providing less monetary consideration for the goods or services; or

refuses to provide goods or services to another person, or insists on receiving more monetary consideration for the goods or services;

has not downloaded COVIDSafe to a communication device; or

does not have COVIDSafe in operation on a communication device; or

has not consented to uploading COVID app data from a communication device to the National COVIDSafe Data Store.

(a) subsection (2) is a workplace law for the purposes of the Fair Work Act 2009; and

the benefit that the other person derives because of an obligation of the person under subsection (2) is a workplace right within the meaning of Part 3-1 of that Act.

for more than 21 days; or

in any case in which it is not possible to comply with paragraph (a) within 21 days—for longer than the shortest practicable period.

must take all reasonable steps to delete the data from the National COVIDSafe Data Store as soon as practicable; and

if it is not practicable to delete the data immediately—must not use or disclose the data for any purpose.

the COVIDSafe user is unable to make a request under subsection (1); or

the COVIDSafe user has requested that parent, guardian or carer to act on the COVIDSafe user’s behalf.

prevent the data store administrator from accessing data for the purpose of, and only to the extent required for the purpose of, confirming that the correct data is being deleted; or

require the data store administrator to delete from the National COVIDSafe Data Store data relating to the person that:

was uploaded from another communication device in relation to which another person is a COVIDSafe user; and

was collected through the other device interacting with the device mentioned in subsection (1).

delete the data; and

notify the data store administrator that the person received the data.

COVIDSafe has been deleted from the device in relation to which the person was the COVIDSafe user; and

after COVIDSafe was last deleted from that device—COVIDSafe has not been downloaded to that device.

collect any COVID app data; or

make COVIDSafe available to be downloaded.

inform the Health Minister and the Commissioner that all COVID app data has been deleted from the National COVIDSafe Data Store; and

take all reasonable steps to inform all COVIDSafe users (other than former COVIDSafe users) in relation to communication devices that:

all COVID app data has been deleted from the National COVIDSafe Data Store; and

COVID app data can no longer be collected; and

they should delete COVIDSafe from their communication devices.

the data store administrator; or

an officer or employee of the data store administrator; or

a contracted service provider for a government contract with the data store administrator;

the breach is taken to be an eligible data breach by the data store administrator; and

an individual to whom the data relates is taken to be at risk from the eligible data breach.

a State or Territory health authority; or

person employed by, or in the service of, the State or Territory health authority;

the breach is taken to be an eligible data breach by the State or Territory health authority; and

an individual to whom the data relates is taken to be at risk from the eligible data breach.

subsection 26WE(3) and sections 26WF, 26WH and 26WJ did not apply in relation to the breach; and

Subdivision B of Division 3 of that Part:

required the data store administrator, or State or Territory health authority, to notify the Commissioner that there were reasonable grounds to believe that there had been an eligible data breach; and

only required compliance with sections 26WK and 26WL in relation to the breach if the Commissioner required the administrator or authority so to comply; and

sections 26WN, 26WP, 26WQ, 26WS and 26WT did not apply in relation to the breach.

the Commissioner is satisfied that the breach may be likely to result in serious harm to any of the individuals to whom the information relates; and

subsection (5) does not apply.

the public interest;

any relevant advice given to the Commissioner by:

an enforcement body; or

the Australian Signals Directorate;

such other matters (if any) as the Commissioner considers relevant.

the Commissioner is conducting under that subsection an assessment of a matter of a kind mentioned in subsection (1) of this section; and

the Commissioner has reason to believe that an entity or a State or Territory authority being assessed has information or a document relevant to the assessment;

an offence against Division 2 of this Part; or

(b) an offence against Crimes Act 1914, or section 11.1, 11.2, 11.4 or 11.5 of the Criminal Code, being an offence that relates to an offence against that Division;section 6 of the

inform the Commissioner of Police or the Director of Public Prosecutions of that opinion; and

in the case of an investigation under subsection 40(1), give a copy of the complaint to the Commissioner of Police or the Director of Public Prosecutions, as the case may be; and

subject to subsection (5) of this section, discontinue the investigation except to the extent that it concerns matters unconnected with the offence that the Commissioner believes may have been committed.

has been informed of the Commissioner’s opinion under paragraph (2)(a); and

decides that the matter will not be, or will no longer be, the subject of proceedings for an offence;

has been informed of the Commissioner’s opinion under paragraph (2)(a); and

is satisfied that an investigation relating to the matter, or proceedings for an offence relating to the matter, will not be jeopardised, or otherwise affected, by continuation of the Commissioner’s investigation;

a complaint has been made under section 36 about an act or practice that may involve a breach of a requirement of this Part; and

before the Commissioner commences, or after the Commissioner has commenced, to investigate the matter, the Commissioner forms the opinion that:

the complainant has made, or could have made, a complaint relating to that matter to a State or Territory privacy authority; and

that matter could be more conveniently or effectively dealt with by that State or Territory authority;

transfer the complaint to that State or Territory authority; and

give notice in writing to the complainant stating that the complaint has been so transferred; and

give to that State or Territory authority any information or documents that relate to the complaint and are in the possession, or under the control, of the Commissioner.

for the purpose of the Commissioner exercising powers, or performing functions or duties under this Act in relation to the requirements of this Part; or

for the purpose of the State or Territory privacy authority exercising its powers, or performing its functions or duties.

the information or documents were acquired by the Commissioner in the course of exercising powers, or performing functions or duties, under this Act; and

the Commissioner is satisfied on reasonable grounds that the State or Territory privacy authority has satisfactory arrangements in place for protecting the information or documents.

have the effect of applying Australian Privacy Principle 9 in relation to a government related identifier that has been assigned by that State or Territory or by a State or Territory authority of that State or Territory; or

have the effect of applying this Act in relation to data or information that is not COVID app data.

is no longer required to prevent or control; or

is no longer likely to be effective in preventing or controlling;

(a) an enforcement body mentioned in paragraph (a) to (ea) of the definition of enforcement body in subsection 6(1);

an intelligence agency;

the Australian Geospatial-Intelligence Organisation;

the Defence Intelligence Organisation.

the end of the 6 month period starting on the commencement of this Part; and

the end of each subsequent 6 month period (if any) starting on or before the day determined under subsection 94Y(1);

the end of the 6 month period starting on the commencement of this Part; and

the end of each subsequent 6 month period (if any) starting on or before the day determined under subsection 94Y(1);

a State or Territory health authority; or

any other person or body (other than the Commonwealth or an authority of the Commonwealth).

commences after this Part commences; and

expressly permits or requires the conduct or omission despite the provisions of this Part.

(a) definition of communication device;

(b) definition of contact tracing;

(c) definition of COVID app data;

(d) definition of COVIDSafe;

(e) definition of COVIDSafe user;

(f) definition of data store administrator;

(g) definition of former COVIDSafe user;

(h) definition of Health Department;

(i) definition of Health Minister;

(j) definition of in contact;

(k) definition of National COVIDSafe Data Store;

(l) definition of registration data;

(m) definition of State or Territory health authority;

(n) definition of State or Territory privacy authority.

(a) the powers of the Commissioner under or in relation to Privacy Act 1988 as amended by this Act continue to apply in relation to matters that arose under or in relation to that Part before that commencement; andPart VIIIA of the

any obligations of the Health Minister or the Commissioner under that Part relating to a report continue to apply;