Visitors can use the app to track their applications, and if approved, they are sent a unique code known as a QR code, which can help ease their entry at air and seaports. It asks travellers to input identity documents such as a drivers licence, passport, Medicare card or Tasmanian Information card, as well as attach work and health documentation.
Fears over data security in state border management apps during the coronavirus crisis
Lyndsey Jackson, the chair of digital rights group Electronic Frontiers Australia, said it appeared to request more data than other apps, such as the Commonwealth’s CovidSafe contract tracing app.
“This really feels different,” Ms Jackson said.
“This company, looking at the terms on its website, certainly reserves the right to build products based on the data and information that people put into it.
For the latest news on the COVID-19 pandemic follow our live updates.
“They also have some facial recognition capabilities.”
Trevor McKenna, vice-president of the Law Society of Tasmania, said there needed to be explicit laws preventing secondary use of the data.
“There should be legislation that makes very clear what the app’s for, how the data is stored, how long it’s stored for and how long it can be used,” he said.
The Tasmanian Government told the ABC the only information collected by the app related to its performance and it did not collect personal data
“The performance data will not be on-sold to third parties,” a spokeswoman said.
The app was developed by a private company for the WA Police and the law enforcement agency is listed as the developer in app stores.
Ms Jackson said it raised the question of whether the WA Police could access data for criminal cases and whether they needed a court’s approval to do so.
The Law Society agreed it also raised jurisdictional issues.
“If I use the app to travel to Perth, I should have confidence it won’t be disclosed to police if they’re investigating a criminal offence,” Mr McKenna said.
In a statement, a spokesman for the Department of Primary Industries, Parks, Water and Environment (DPIPWE) said the WA and Tasmanian databases were segregated to ensure data collected by each state was inaccessible to the other.
But it said information provided through the app “may form part of a prosecution regarding an offence under the Tasmanian Emergency Management Act”.
Australian data caught up in cloud concerns
There are also additional legal concerns about where data is stored.
Much like the CovidSafe app, the data is being stored by Amazon Web Services.
The US-based company is subject to the American Cloud Act, which means the US Government can potentially access data on cloud storage, even overseas.
Mr McKenna agreed, saying Australia was not captured as a recognised foreign entity by the Cloud Act, which meant there was no dispute resolution mechanism in the law and effectively US common law would apply.
“My understanding is that law is quite unclear,” he said.
Electronic Frontiers Australia said there were also the usual risks of hacking.
“[What] isn’t clear on the site for the app they talk about encryption but that doesn’t mean an administrator can’t get into the database,” Ms Jackson said.
“These private companies can change their terms and condition at any time so once that happens and your information’s in there you really don’t have a lot of recourse.”
A DPIPWE spokesman said the data was hosted in an Australian data centre and there were additional security measures in place to protect the confidentiality of the information.
“The Tasmanian Government considers that appropriate measures are in place to protect the information, which includes using industry-standard security practices, measures and data encryption,” they said.
Are people forced to use the app?
Ms Jackson said there was also a question of informed consent and whether travellers felt they were forced to use the app and had no low-tech alternative.
“You don’t have much choice because you need to get home or you need to get to work,” she said.
She urged the public to ask what happened to their data and if it could be deleted at a later date.
The WA Government referred the ABC to its G2G website, which indicated those travelling to the state who did not want to use the app could speak directly to WA Police.
A DPIPWE spokesman said travellers who arrived in Tasmania without an approved G2G PASS QR code would be given paperwork to complete at the border.
“However in most cases, they will be required to quarantine in government accommodation at their own cost whilst the application is assessed,” she said.
“Travellers who receive their G2G PASS QR code before arriving will be able to quickly pass through their port of arrival in Tasmania.