Questions asked by the Hon Meg Webb on 11 August 2020 and answered by the Minister for Police, Fire and Emergency Management, the Hon Mark Shelton MP

Regarding the state border management application, Good2Go Pass (G2G PASS) please detail:

Question 1. Was consultation undertaken with and/or advice sought from independent digital, privacy and cybersecurity experts in the development and implementation of the G2G PASS in Tasmania?

ANSWER: The Department of Primary Industries, Parks, Water  and  Environment (DPIPWE) completed a risk assessment of the service to be provided prior to the implementation of the system. Tasmania has adopted the system following its development and successful implementation in Western Australia.

Question 2. What measures have been taken to ensure the protection of Tasmanians’ personal data and the prevention of any secondary use of that data in the operation of the G2G PASS?

ANSWER: Protection measures  include  using accepted  industry security  practices and data encryption levels.

Question 3. What protections are in place to ensure Tasmanians’ personal data will not be accessed by secondary users or on-sold to third parties?

ANSWER: A confidentiality agreement is in  place as part of the  service contract and  the  system has measures in place for DPIPWE to monitor and verify that the conditions of the service agreement are being adhered to. The data cannot be on-sold or provided to third parties.

Question 4. What protections are in place to ensure any Tasmanians’ data collated by the G2G PASS app is not used for any purpose other than its primary function of managing applications for exemptions to COVID-19 pandemic quarantine or isolation restrictions, including for any potential unrelated criminal offence investigations?

ANSWER: Data collected through the app is only used for border entry and quarantine compliance. The data may inform part of a prosecution regarding an offence under the Emergency Management Act 2006.

Question 5. Regarding the retention of any Tasmanians’ personal data collated by the G2G PASS app, specifically:

a) how long will data be stored;

b) how long can stored data be used by Tasmanian authorities;

c) are measures in place stipulating the automatic deletion of any collated data either on rejection of an application, once travel has been completed, or on request of an individual? 

ANSWER:  All records will be stored and disposed of in accordance with the Disposal Schedule for COVID-19 Disease Emergency Records (DA2532). This information is publicly available at: https://www.informationstrategy.tas. gov.au/Publications. The records will be retained for a minimum of two years as the information falls under the administrative arrangements (Reference 1.3) then destroyed, unless required for compliance or prosecution.