Contact Tracing Software Sells People’s Information

Contact Tracing Software Sells People’s Information
Short Title	Contact Tracing Software In Australia Probing Users for Data More Than Needed and Sells People’s Information to Third Parties
Location	Australia
Date	July 2020
Solove Harm	Secondary Use, Interrogation, Increased Accessibility, Aggregation, Surveillance
Information	Identifying, Contact, Behavioral, Computer Device
Threat Actors	MyGuestList, Businesses that use MyGuestList for contact tracing
Individuals
Affected	Customers of businesses who use MyGuestList for contact tracing
High Risk Groups
Tangible Harms

Australian contact tracing software asks people to fill in more personal information than needed. Its privacy policy also says the company is selling this data to third parties.

Description

Many businesses all over the world are obliged to help with contact tracing, to fight the pandemic of COVID19.

In Australia some software that businesses use for that purposes were found to violate people’s privacy.

For example, when a person scans the QR codes at the entrance (of a restaurant or another place that is obliged to do contact tracing) and goes to a website that asks for all of their personal details because of contact tracing, their data is being shared with third parties and companies. ^{Secondary Use Increased Accessibility Interrogation}

For example, company called MyGuestList, that manages the data collection for COVID-19 at several locations in Australia collects some information obvious for contact tracing, such as: name, phone number, email and mail address.^{Surveillance Aggregation}

But the service also collects: behavior and usage data, including how the individuals use their website and services, browsing patterns and information on how long they might spend on their webpages, what they look at and for on their website, their click stream, advertisements clicked or viewed, websites and content areas, date and time of these activities, or the web search used to locate and navigate to a website. This is an example of Interrogation.

They also share the information with third parties, such as suppliers, customers and partners, including digital marketers, ad agencies, web publishers, demand side platforms, data management platforms, supply-side platforms and social media networks, as well as potential or actual third party purchaser of their business or assets. ^{Secondary Use}

Sources

https://www.reddit.com/r/privacy/comments/i13hbb/australian qr codes used for covid19 contact/