The Australian government, through Minister for Government Services Stuart Robert, made statements that provided assurances about US access to COVIDSafe data.
According to a ZDNet report from May 2020, a spokesperson for Minister Robert stated: "Uploaded contact information will be stored in Australia in a highly secure information storage system and protected by additional laws to restrict access to health professionals only" [1].
The government also claimed that under law, "it is a criminal offence to transfer data to any country other than Australia, with a penalty of imprisonment for five years and/or 300 penalty units -- AU$63,000" [1].
During Parliamentary Joint Committee on Intelligence and Security (PJCIS) hearings, representatives from the International Civil Liberties and Technology Coalition testified that "the Australian government cannot guarantee United States authorities will not have access to data held by the COVIDSafe coronavirus contact tracing app" [2].
Lucie Krahulcova from the International Civil Liberties and Technology Coalition stated: "One of the things the government has sought to do is to ensure individuals that their data won't be shared by Amazon with US entities and that data won't leave … it's not something that Australia can guarantee" [1].
She further explained: "Amazon is still an entity, it's a US-based entity, and when we get into a place where governments put provisions like this into legislation, there's simply no way unless there's a very expensive diplomatic undertaking and extreme carve-outs are sought, there's just no way to guarantee that" [1].
Australia's response to enable access to US data was through the Telecommunications Legislation Amendment (International Production Orders) Bill 2020 (IPO Bill), which was designed to create a framework for Australian agencies to gain access to stored telecommunications data from US providers [1].
The Bill was explicitly a precondition "for Australia to obtain a proposed bilateral agreement with the United States in order to implement the US CLOUD Act" [1].
The Assistance and Access Act 2018 (also known as Australia's encryption backdoor law) was passed by the Australian government in 2018, which gave the government authority to compel technology companies to assist in accessing encrypted communications [3].
The relationship between the two laws is more accurately described as: both represent similar governmental approaches to compelling access to encrypted/protected data, but the causality claimed in the assertion (that CLOUD Act "inspired" the Australian law) does not align with the chronology.
The civil liberties experts' objection was not that US government could definitely access the data, but rather that domestic legislation alone cannot prevent a US company from complying with US legal demands [1].
The original source provided (ZDNet article from May 2020) is a credible technology journalism outlet with a history of accuracy on policy and cybersecurity issues.
The civil liberties groups' position (that guarantees cannot be given) is one interpretation; the government's position (that domestic law would prevent transfer) is another [1].
The Assistance and Access Act 2018 was passed under Coalition government and was not a Labor initiative, though Labor governments have also supported law enforcement access capabilities in other contexts.
The government was attempting to balance public health (rapid deployment of contact tracing) with privacy protections.
彼 Kare ら Ra は topic-markerWa 以下 nounIka を object-markerWo 実施 nounJisshi し verbShi た auxiliary-verbTa : :
They implemented:
1. **Domestic legal restrictions** on data access and transfer [1]
2. **Criminal penalties** for unauthorized data transfer [1]
3. **Specific legislative framework** limiting use to health authorities [1]
These steps demonstrate genuine effort to restrict access, even if civil liberties experts questioned whether domestic law alone could provide absolute guarantees against US legal demands.
The experts' objection reflects legitimate concerns about jurisdictional conflicts: Australian legislation cannot override US legal processes that may compel US companies to disclose data [1].
The government's guarantee was implicitly: "Our domestic law prevents transfer." The civil liberties position was: "Domestic law cannot guarantee anything against US legal demands." These are different claims.
COVIDSafe was ultimately decommissioned in August 2022 after proving largely ineffective (identifying only 2 cases despite costing $21 million) [5], so the data access concerns became moot.
The laws are similar in principle (compelling access to communications data), but the causal relationship claimed in the assertion is reversed or non-existent.
The government's assurances reflected domestic legal restrictions they believed would be effective, even if experts correctly identified limitations in their enforceability.
The laws are similar in principle (compelling access to communications data), but the causal relationship claimed in the assertion is reversed or non-existent.
The government's assurances reflected domestic legal restrictions they believed would be effective, even if experts correctly identified limitations in their enforceability.