Contact tracing registers and privacy rights

June 17, 2020 - 10:28am

If you have visited a business, café or restaurant recently, you probably noticed you were asked to provide your name, address and mobile phone number for contact tracing purposes.

This is part of the Queensland Government’s approach to easing restrictions for COVID-19.

Queensland’s Chief Health Officer has issued a directive to businesses wishing to re-open or offer their services to an increased number of customers. These businesses are required to collect contact information for all customers, workers and contractors for a period of at least 56 days.

The purpose of collecting this information is to assist authorities in tracing infections of COVID-19 if they occur.

Businesses and protecting personal information

To ensure transparency, businesses should make sure customers are aware of the reason for the register, and what will happen to their personal information.

Businesses should try and protect customer’s personal information as much as possible, so their entries in the register cannot be seen by other customers. For example, businesses could use a secure visitors register, separate pages in a notebook or enter customer details on a computer or device that faces away from customers.

It is also important to store the information safely after closing time, such as in a locked cabinet, and ensure records are destroyed when there is no longer a need to keep the information by shredding them or engaging a responsible records disposal unit.

Businesses that are using their booking register as their contact tracing register also need to be aware of their privacy obligations. This is not an opportunity for businesses to build up their mailing list, or allow staff to contact customers for personal reasons.

Some businesses may use a ‘check in’ app, which allows the customer to keep a record and provides that information to the business. If you have privacy concerns about using a ‘check in’ app, you should ask the business for more information, including whether the provider of the app has a privacy policy and how your personal information will be managed.

The register should only be used for the public health reasons specified in the direction. If a business wants to get to know its customers and offer them deals and information, it should not be done using information collected through the contact tracing register.

Businesses also do not have to verify a customer’s identity when keeping a contact tracing register. Showing proof of identity in the form of a driver’s licence or passport is not a requirement for entering contact information in a guest or customer register.

Privacy and the law

Queensland’s Information Privacy Act 2009 applies only to Ministers, Queensland government departments, local government and public authorities. They do not apply to individuals, businesses, community groups or non-Queensland government agencies.

Some businesses may be required to comply with the Commonwealth Privacy Act 1988. Contact the Office of the Australian Information Commissioner (OAIC) for more information about privacy obligations and rights in these circumstances. The OAIC has developed tips for good privacy practice to assist businesses in storing and collecting personal information.

For more information, check out the Queensland Government’s Fact sheet for the collection and storage of customer information during COVID-19.

You can view the full Roadmap to Easing Restrictions or, for general information about the Queensland Government’s response to COVID-19, call 134 COVID (13 42 68 43).