As Queensland (and the rest of Australia) look to take steps in lifting Covid-19 restrictions, contact tracing is a requirement that many businesses will need to grapple with.
What is contact tracing and its purpose?
Contact tracing is a process commonly used to trace the spread of an infectious disease throughout a community. It serves two primary purposes: firstly, to identify who an infected person has been infected by, and secondly, to identify who an infected person has been in contact with.
Why is this relevant to my business?
In March, to flatten the growth of Covid-19 in the Australian community, public health directions were issued requiring many classes of businesses to close.
In Queensland, under the Non-essential Business, Activity and Undertaking Closure Direction, many retail businesses such as Cafes, Restaurants, Gyms and Places of Worship have been required to take extraordinary steps to restrict patrons from coming into contact with each other.
On 14 May 2020, as part of an effort to revive the economy, the Non-Essential Business, Activity and Undertaking Closure Direction (No. 10) (“the Direction”) was published allowing many businesses to open. These businesses however are still subject to specific restrictions and obligations under the Direction. The application of these restrictions may differ for different classes of businesses. However, a common requirement vastly seen is the requirement to contact trace.
What are business’ obligations regarding contact tracing?
Many businesses including cafes, restaurants and other providers of beauty and personal care services are required to comply with the ‘COVID SAFE checklist’ under the Direction. The COVID SAFE checklist requires that “contact information must be kept for customers, workers and any contractors for a period of at least 28 days”. The contact information must include the name, address and mobile phone number.
Businesses are further required to ensure that the contact information are only used for the purposes of tracing COVID-19 infections and are captured and stored confidentially and securely.
Use for any other purposes such as advertising or marketing are therefore prohibited without the customer, worker or contractor’s informed consent.
Does storing contact information trigger any obligations under the Privacy Act?
Separate to the Direction, collecting contact information may trigger the provisions of the Privacy Act 1988 (Cth) (“the Privacy Act”). Your business may already be subject to the Privacy Act, if your business:
- Has more than $3 million in turnover; or
- Is a health service provider;
- Trades in personal information;
- Is an operator of a residential tenancy database.
Personal information, under the Privacy Act, includes information such as a person’s name, address and mobile phone number. As such, the storage of personal information for the purpose of contact tracing will trigger the application of the Privacy Act.
If the Privacy Act applies, there are 13 Australian Privacy Principles that you will need to be aware of that outline how you should collect, use and disclosure personal and sensitive information. See, for example: https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-quick-reference/
A person to whom the direction applies commits an offence if the person fails, without reasonable excuse, to comply with the direction. The maximum penalty, currently, is $13,345.00.
If have any further queries regarding contact tracing and its implementation, contact us
Call our office on (07) 3252 0011 and speak with one of our client engagement officers to book an appointment today.
Authors: James Tan & Ervin Hii (student placement)