Hepatitis C is a global public health threat, affecting 56 million people worldwide. The World Health Organization has committed to eliminating hepatitis C by 2030. Although new treatments have revolutionised the treatment and care of people with hepatitis C, treatment uptake has slowed in recent years, drawing attention to the need for innovative approaches to reach elimination targets. One approach involves using existing notifiable disease data to contact people previously diagnosed with hepatitis C. Within these disease surveillance systems, however, competing tensions exist, including protecting individual rights to privacy and autonomy, and broader public health goals. We explore these issues using hepatitis C and Australia's legislative and regulatory frameworks as a case study. We examine emerging uses of notification data to contact people not yet treated, and describe some of the ethical dilemmas associated with the use and non-use of this data and the protections that exist to preserve individual rights and public health. We reveal weaknesses in rights protections and processes under Australian public health and human rights legislation and argue for consultation with and involvement of affected communities in policy and intervention design before notification data is used to increase hepatitis C treatment coverage.