SA QR code check-in database under review, as large expansion plans dropped

The database that stores millions of COVID QR code check-ins is being reviewed, as it’s revealed authorities discussed a huge expansion of the system.

The state’s chief auditor is reviewing the coronavirus contact tracing database as leaked documents reveal authorities considered a mass expansion of the electronic COVID-19 tracking system.

Premier Steven Marshall requested in December last year, via his department, for Auditor General Andrew Richardson to scrutinise QR codes’ “management, protection and disposal”.

The request, which has never been publicly disclosed, came as the Transition Committee debated widening the government’s COVID-safe check-in system, confidential meeting minutes show.

Jim McDowell, then-boss of the Department of Premier and Cabinet, which manages the data on behalf of selected SA Health contact tracers, wrote to Mr Richardson on December 10, requesting he examine how users’ personal details and visited locations were stored.

Officials said no obvious problems triggered the request.

A man scans a QR code as he checks in to a store in December last year, after SA introduced the system. Picture: Kelly Barnes/Getty

“While I am confident the department has sufficiently strong policies and safeguards in place, this project collects personal data,” Mr McDowell wrote.

“It would therefore be in the public interest to verify these arrangements and provide further assurance.”

In a rare statement, Mr Richardson’s spokeswoman said the review was ongoing.

“We seek to take extreme care to audit independently and maintain the integrity of related procedural fairness processes,” she said.

A government spokesman said it was “gladly co-operating”.

The Transition Committee’s minutes, obtained by The Advertiser, show officials considered expanding QR code readers in late January to include public transport, taxis and rideshare vehicles such as Uber cars.

Authorities also discussed tracking users with “methods to monitor compliance using metadata”.

Advice was sought from a separate technical advisory group comprising health, transport and DPC data officials as well as police.

“The group considers continuous improvement and technological sustainability of the system, and provides advice to (SA) Health as the owners of the system,” the government spokesman said.

In response to inquiries, deputy chief public health officer Emily Kirkpatrick said “expanding the system to a wider range of areas was considered, however, at this point in time we are satisfied with the current level of coverage”.

She did not explain why the expansion was not launched.

On September 18 last year, the documents show Department for Trade and Investment chief executive Leonie Muldoon was to investigate for national Cabinet which local businesses had established their own “contact tracing solutions”.

The minutes also details extensive discussions about introducing QR codes late last year at the height of the state’s worst outbreak, the Parafield Cluster.

Dr Kirkpatrick said in a statement: “One of the most important tools to assist our contact tracers if there’s a case of COVID-19 in the community is our COVID-Safe Check-In QR readers.

“Checking in at venues is very important because if a COVID-19 case is identified, our contact tracing team can quickly identify and contact people who have visited an exposure site, which is a process that can otherwise manually take days.

“Throughout the pandemic we have always looked at different ways of making South Australians safer.

“Our public health team continue to monitor compliance at events … to ensure people comply and we encourage everyone to continue the COVID Safe Check-In wherever the QR code is present.”

Identification checks became mandatory in December last year to help authorities track at-risk patrons in a further outbreak.

More than 131.2 million check-ins have been recorded at 57,000 retail stores, supermarkets, government buildings, licensed venues, public events, schools, airports and private gatherings. At least 105.1 million records have been deleted after a mandated 28-day purge.

A police spokeswoman said the codes will no longer be legally enforced when the Major Emergency Declaration ceases or the State Coordinator, Police Commissioner Grant Stevens, “revokes the requirement”.

“The State Coordinator takes advice from SA Health on changes to restrictions and requirements contained in Directions issued pursuant to the Emergency Management Act,” she said.