COVIDSafe, the government’s contact tracing app, is among us, blessed with the hope that it will spread virally at a speed that COVID-19 has so far failed to achieve. Its arrival raises two questions: will it work (if widely enough adopted); and are our fears of its side effects misplaced?

The first question is one for experts. On the second, I have some troubling news.

COVIDSafe was made law on Anzac Day, not by an act of parliament (remember those?) but by this exotic beast: the Biosecurity (Human Biosecurity Emergency)(Human Coronavirus with Pandemic Potential)(Emergency Requirements — Public Health Contact Information) Determination 2020. It was signed by Health Minister Greg Hunt.

The determination was purportedly made using the extraordinary powers given to the minister by the Biosecurity Act during a human biosecurity emergency. Under section 477 of the act, the minister can “determine any requirement that he or she is satisfied is necessary” to prevent or control the spread of a pandemic disease.

It is an extreme power; the act gives examples to illustrate but not limit what the minister can do. He can order evacuations, restrict movement or impose forced quarantines on people and things.  

It is commonplace for an act of parliament to delegate rule-making power to the executive arm of government. However, powers of this extravagance are rare. The obvious intention is to recognise that a pandemic is existential, and may require extreme responses. 

Democratic processes may be just too slow.  This is underlined by the fact that determinations made under the Biosecurity Act cannot be overturned by parliament, as ministerial determinations usually are.

Fair enough, but two things flow from this undemocratic expedient. First, it must be used sparingly, and the word “necessary” takes on more than usual importance. It’s not there for ministerial whim or governmental convenience. It’s there solely for what must be done to save lives.

Secondly, the courts will (or should) look at anything done in purported exercise of this power with a weather eye. This is not a law to be interpreted casually.

There is a problem with this determination, such that it may not be valid at all. The issue is to do with the word “requirement”, which limits what the minister can do.

COVIDSafe is being rolled out as a voluntary app; nobody is obliged to use it, and, in fact, the determination includes explicit prohibitions on anyone being coerced into it or punished for not doing so. Its implementation contains no element of “requirement” on anyone.

The determination is full of requirements, but all of them relate to what people (mainly the government itself) can’t do with the app or the data it generates.

There are prohibitions on the data being used for any purpose other than contact tracing by health authorities, or stored overseas, or being kept after the emergency has ended. These are designed to answer the concerns that have been raised about the security of the data and its vulnerability to being co-opted by police and other agencies for other purposes.

The problem is that these requirements have nothing whatsoever to do with COVID-19, bearing in mind that the minister’s power is clearly limited to imposing requirements that he is satisfied are necessary to prevent or control its spread.

Whether the COVIDSafe data from your mobile phone is kept secure, not hacked, not shipped to China, and not accessed by the Federal Police, ASIO or Border Force for completely unrelated purposes, will have no impact whatsoever on the spread of COVID-19.

The measures that the minister’s determination imposes are, instead, exclusively created for, and will only have relevance to, the privacy of individuals who download the COVIDSafe app. Privacy invasion is not a human health emergency.

The government would argue that the negative requirements in its determination are sufficiently connected to controlling COVID-19 because they’re necessary to ensure that the app rollout is a success, which won’t happen without the protections those requirements create. I don’t think that will, or rather should, fly. It’s too removed from the purpose of the law that gives the minister this extraordinary power.

If the determination is invalid (because it falls outside the minister’s power altogether), then the protections don’t work and users of the app are at the mercy of existing laws allowing various agencies to hack their data. For example: hunting journalist’s contacts to identify sources; checking up on asylum seekers in community detention to see if they’re breaking curfew or working illegally; surveilling people on limited work visas; tracing the contacts of potential terrorism suspects. Data, we know, is gold, and we also know that our policing and intelligence agencies have a solid record of not being able to resist its allure.

Even if the determination is valid, it’s not at all clear that it will be effective to override the many laws that conflict with its proscriptions. It does not include language that purports to invalidate any other law (e.g. the data retention law), because it can’t. Only parliament can say which of its laws take precedence over another.

Which raises the question: why is this being done by a ministerial determination at all? The obvious thing is for parliament to debate the implementation of COVIDSafe, properly consider the privacy risks it presents along with the question of whether it will even work, and then make whatever laws are necessary to give it valid life. There’s time to do that; it’s not like parliament has anything else on its plate.

COVIDSafe began its journey with a deep deficit of public trust in the government that had decided we need it. For this thing to succeed, the government first needed to rebuild the trust it squandered.

By shoving the app into the world off the back of a dodgy ministerial determination on a public holiday, with no debate and paper-thin legal substance, the government has followed the path that its DNA seems to mandate: ride over the bastards.

My faith is not restored. I won’t be downloading the app.