The chief health officer Dr Hugh Heggie has suggested people stick a quick response or QR code in their homes, as part of the government’s COVID-19 contact tracing safety plan.
Last Monday the Gunner Government announced obligatory contact tracing measures requiring customers, staff members, and contractors to “check-in” at venues by providing their name, contact number, date, and time of entry into the business, if they were going to be there more than 15 minutes.
The businesses identified in the chief health officer’s direction include restaurants, cafes, pubs and clubs, strip clubs, and “any place that sells admission to or provides services involving participation in sexual activity.”
Some businesses are already collecting these details, and the CHO encouraged businesses to start collecting contact details before the start date on November 30, and to use a electronic method such as a QR Code, providing a secure, contactless, and hygienic way of collecting details.
“Businesses can find a QR code guest registration service by searching online or asking their IT services provider for advice. Sign up with a service and download the unique QR code,” the NT’s COVID-19 contact tracing system states.
QR codes in homes
During Monday morning’s announcement of the government’s mandatory COVID-19 quarantine for South Australians coming to the NT and quarantine restrictions to be lifted for Melbourne this month, Dr Heggie suggested QR codes could also be placed in or on houses to allow visitors to scan codes so they can be traced if there is a coronavirus outbreak.
“The technology that we are developing in terms of the attendance records if there isn’t one, gyms and other places will have swipe cards, others will continue to use paper,” he told the press conference.
“And there’s the QR app that we’re going to be implementing in a few weeks’ time and distributing.
“That’s something that even a household could actually have a sticker code on your premises that would enable people who come to your party, your barbecue, to tap on and tap off that would greatly assist in contact tracing.”
At the beginning of October the deputy health officer Dr Charles Pain said Territorians should start carrying face masks, and donning them in areas where social distancing is difficult such as supermarkets, or large events to “prevent a second wave” of COVID-19 in the NT.
“As we’re going down the downward slope of the epidemic it may seem a bit odd that we’re issuing advice about masks… what we want people to do is we want them to have a mask. That’s the first thing. And the second thing is if they can’t distance, so they can’t keep their physical distance one and a half metres, for example, in a supermarket where it’s busy and so on, have your mask and just put it on,” he said.
Dr Heggie has been the most high profile wearers of a face mask, seen wearing one in mid-October when appearing before an inquiry into the substance abuse-related deaths of three young people in separate Arnhem Land communities..
QR codes and data privacy
A QR code is a type of matrix barcode that is read by a smartphone camera or QR reader app. Once scanned, the QR code takes the user to either an online form (or an app installed on the user’s phone) which records the date and time of the user’s visit to the premises and, in most cases, the user is asked to provide their contact details and answer a questionnaire.
The collected information is then used to identify a visitor or staff member who may have a connection to a COVID hot spot and, on request, disclosed to health authorities for contact tracing purposes.
According to Sydney-based law firm Clayton Utz, it is important to remember that any information or opinion relating to the health of customers, visitors, and staff is sensitive information under the Privacy Act and attracts additional privacy obligations and protections, compared to other personal information.
An example of a quick response or QR code.
“It is not correct to assume that because the business is required to collect contact details as part of a COVID Safe Plan (or otherwise under a government direction or order) that this is sufficient to comply with the business’ obligations under the Privacy Act, and that the questionnaire may be used to collect personal information for other purposes, such as direct marketing,” Eleanor Dickens and Sophie Bradshaw wrote.
Technology company MobileIron also claim QR codes pose significant risks to both end users and enterprises, saying companies need to urgently rethink their security strategies to focus on mobile devices.
“Hackers are launching attacks across mobile threat vectors, including emails, text and SMS messages, instant messages, social media and other modes of communication,” said MobileIron global vice president of solutions Alex Mosher.
“I expect we’ll soon see an onslaught of attacks via QR codes. A hacker could easily embed a malicious URL containing custom malware into a QR code, which could then exfiltrate data from a mobile device when scanned. Or, the hacker could embed a malicious URL into a QR code that directs to a phishing site and encourages users to divulge their credentials, which the hacker could then steal and use to infiltrate a company,” Mr Mosher said.
The Office of the Australian Information Commissioner (OAIC) has published guidance for businesses collecting personal information for contact-tracing purposes earlier this year.
When will they come up with a secure forum of contact tracing. The city council has smart cities that can track movement of people through the city. It can be used to count how many people move in and out of zones in the city. This can be done without releasing personal information and would provide numbers of people and their movements if a case was detected.