The six agencies are the Australian Security Intelligence Organisation, the Australian Secret Intelligence Service, the Australian Signals Directorate. the Australian Geospatial-Intelligence Organisation, the Defence Intelligence Organisation and the Office of National Intelligence.

The COVIDSafe app was released for download on 27 April. About $70 million of taxpayers' money was spent on the app – and only 17 cases were detected through its use, which works out to approximately $4.12 million for each detection.

The IGIS did not say exactly what data had been collected by the spooks. The app uses Bluetooth, but requires the user to upload some personal details — name, age, postal code, and phone number — so that authorities can contact anyone who may have come in contact with an infected person.

The report said: "The Office of the Inspector-General of Intelligence and Security has worked with agencies within its jurisdiction to ensure they are aware of their obligations under the Privacy Act in respect of COVID app data.

"IGIS has been briefed on technical capabilities and has reviewed policies and procedures implemented by relevant intelligence agencies in the event that collection of COVID app data occurs.

"The acting Inspector-General is satisfied that the relevant agencies have policies and procedures in place and are taking reasonable steps to avoid intentional collection or use of COVID app data.

"Incidental collection in the course of the lawful collection of other data has occurred (and is permitted by the Privacy Act); however there is no evidence that any agency within IGIS jurisdiction has decrypted, accessed or used any COVID app data.

"IGIS advises that it plans inspection activities in coming months to verify data deletion and provide further assurance that no COVID app data has been accessed, used or disclosed."