SA Health holding QR code check-in data indefinitely, report finds, as risk of breach revealed
By Isabel Dayman
Posted 11h ago11 hours ago, updated 10h ago10 hours ago
Checking in is done in South Australia through the mySA GOV app.(ABC News)
The South Australian Premier's department has been deleting QR check-in data after 28 days, but SA Health has been holding onto the information it receives for contact tracing indefinitely, according to a report by the state's auditor-general. Key points:
South Australians have been using QR codes to check in to businesses and other venues since December 2020
The Department of the Premier and Cabinet has been deleting data after 28 days
SA Health has been keeping it
The state government requested the auditor-general conduct a review into the management of COVID-Safe QR check-in data after the system was brought in last December.
South Australians have checked in more than 400 million times since then, with more than 2 million individual check-ins recorded on the system's busiest days.
The auditor-general found the data was consistently deleted by the Department for the Premier and Cabinet (DPC) after 28 days, as required under legal directions.
"Our testing found that people's contact details are effectively destroyed from the production database, which is the database accessible on a day-to-day basis," the report said.
"This is an automated process that checks for records older than 28 days." But the report found the data was being retained in the department's back-up IT systems.
