The short answer is, legally, yes. And yes, this is despite the terms of the check-in stating that your information will only be used for COVID contact tracing.

This issue recently became a reality when Queensland police accessed check-in data of a person accused of stealing a police-issued firearm.

While any personal information you give to a business or government agency can generally only be disclosed to third parties with your consent (which includes between government agencies), there is an overriding exception in the various privacy laws which allows disclosure of your info to law enforcement bodies if it relates to enforcement related activities. An enforcement body generally includes the police forces, and any other agency responsible for administering laws which may impose a penalty.

However, this exception only gets the enforcement body halfway there. While it would not be a breach of privacy laws for the organisation to hand over your information to the body without your consent, the exception only allows the organisation to disclose but doesn't require it (of course, subject to any warrants or orders issued by a court) and the entity making the disclosure has to hold a reasonable belief that the disclosure is necessary for the enforcement related activities.

New South Wales, South Australia and the Northern Territory have, so far, ruled out the disclosure of the check-in data to law enforcement bodies. However, the Queensland cops are not alone in accessing COVID check-in records in their fight against crime the Western Australian Police also accessed the records twice earlier in the year. WA has now brought in legislation preventing the practice.

State Governments have already attracted a lot of criticism for managing a public health crisis with heavy-handed (and inconsistent) policing. The access of check-in data by law enforcement bodies for reasons other than COVID-contract tracing could validly perpetuate even more scepticism and distrust in our government institutions and discourage people from engaging in public health data practices that are integral to the management of COVID in the community.