As Covid-19 restrictions ease around Australia and businesses open up, contact tracing will remain a crucial tool to control the spread of Covid-19. Territories and states are asking businesses to collect their customer’s personal contact information to facilitate contact tracing. Each territory and state has its own directives regarding information a business must collect from visitors to their workplace, and there may be repercussions for businesses that don’t comply
Personal Information Required by State
Australian Capital Territory
The ACT public health directions state that businesses and workplaces must collect their customers’ personal information for contact tracing. Businesses applying the one person per two square metre rule indoors must use the Check-in CBR app to collect customer contact details. If you’re using other electronic collection methods, your systems must be privacy compliant. You can store the collected information for 28 days.
Record-keeping requirements in the ACT include:
First name
Phone number
Date and time of entry
New South Wales
Under public health orders, New South Wales requires some businesses and organisations to collect customer’s details and retain them for 28 days. Businesses are strongly encouraged to use electronic record-keeping methods using QR codes. If you’re using manual record-keeping, be sure to enter your records into an electronic format like a spreadsheet within 12 hours.
The contact details include the customers’:
Full name
Phone number
Email address when possible
Date and time of entry (and time of exit when possible)
Northern Territory
Chief Health Officer directions provide that businesses must collect contact information from customers who visit their premises for more than 15 minutes for contact tracing purposes ideally by using the Territory Check-in app. You can also do this the old-fashioned way using pen and paper or use QR codes. The collected contact information is only accessible to public health officials and can be stored for 28 days. Businesses must collect the following personal information:
Full name
Phone number
Physical address
Email address
Date and time of entrance to the premises
Queensland
The Queensland Government requires certain businesses to collect and store all customers’ contact information for not less than 30 days and delete it after 56 days unless told otherwise. The information required includes the customers’:
Full name
Phone number
Time in and time out
Email address – if unavailable, get the residential address instead
Date of entry
Note that all hospitality venues are now required to keep all patron contact details electronically.
South Australia
The SA Government requires South Australian businesses to collect contact details from customers to aid in contact tracing. High traffic businesses and retail stores must implement a Covid Safe plan and utilise the state government’s QR code check-in system.
Customers can check-in by scanning the businesses’ QR code using their mobile phones. The App makes contact tracing and record-keeping safe and easy. The encrypted data is stored for 28 days and is only released to SA public health officials for contact tracing purposes.
Personal information required includes:
Customer’s name
Phone number
Email address
Date and time of entry
Tasmania
Recording customers’ contact details to support contact tracing is mandatory for the majority of Tasmanian businesses. These details are kept for 28 days and will help Public Health officials rapidly identify possible contacts if a customer later tests positive for Covid-19. The Tasmanian government has a Check-In Tas App that enables customers to self-check-in at a venue by scanning the venue’s QR code. You can also use paper-based data collection but ensure that you protect your customers’ privacy. Businesses must collect:
Customer’s name
Phone number
Date and time of entry
Victoria
For contact tracing purposes and per public health orders, Victoria requires businesses and workplaces to collect their customers’ personal information. The record-keeping requirement applies to customers who attend the premises for more than 15 minutes. Business that use electronic record keeping may have more customers on the premises than those who use a manual means of collecting contact details.
Businesses are highly encouraged to use QR codes to collect contact information since it’s contactless, reducing the spread of Covid-19. If you’re using non-electronic methods to collect contact details, wipe the pens used with a hand sanitiser. You can store the collected data electronically or in hard copy for 28 days. Businesses must collect the customers’:
First name
Phone number
Date and time of entry
Western Australia
As part of the WA Government’s to stop the spread of Covid-19, most Western Australia businesses must collect customers’ contact details. Businesses on this page must maintain contact registers for WA public health contact tracing, should it be needed. The WA government has a SafeWA app, a free app that businesses can use to collect customers’ personal information using QR codes. However, you can use a paper-based system or a different electronic system but be sure to comply with privacy obligations and only store the information for 28 days.
Contact details required include:
Name
Phone number
Location
Date and time of visit
Storing Contact Details
Customer contact information is to be used only for the purposes of contact tracing and all businesses are required to store that contact information securely and not use it for any other purpose, eg marketing. The standard approach to storing your customers’ personal information also applies to the information you collect for Covid-19 contact tracing.
You can use your state or territory’s electronic system or a secure third party app to store customer details. For customers without smartphones, having an alternative record-keeping system is vital, but make sure it complies with your State or Territory requirements. Generally an un-monitored A4 notebook propped on the counter that provides easy access to other customer contact details is not acceptable Ensure any physical copies of customer information is locked away in a filing cabinet with controlled key access.
Compliance with the Privacy Act 1988
Collecting the personal information of visiting customers for contract tracing purposes is permitted under the Privacy Act 1988 but you have privacy obligations as to how to handle that information, which, broadly, may include collecting only relevant information as provided by the relevant direction or order, notifying individuals before you collect their information, securely storing that information and destroying if you are no longer required to keep it. Keep in mind that there also is a small business exemption to the Privacy Act.
Employsure are workplace relations experts, but we aren’t experts in privacy legislation. If you’d like to know more about the Privacy Act, Employsure recommends you seek expert advice and guidance.
Conclusion
With rising infection rates internationally, having appropriate systems to keep the country safe and stop the coronavirus spread is vital. Contact tracing enables public health officials to quickly identify and assist anyone that may have been exposed to Covid-19. Businesses can contribute towards this effort by collecting customers’ personal information to make contact tracing easier. Together we can stop the spread.
Need Workplace Health And Safety Advice?
Call Employsure now for free, initial advice about any workplace health and safety or COVID question you have.
Frequently Asked Questions
Why do I Need to Collect Customer Information?
To stop the spread of COVID-19, you must collect customer information for contract tracing purposes as required by your State or Territory governments.
How do you Collect Customer Information?
Ideally you should collect information electronically:
- Set up a digital form (possibly provided by the local authority or your business association)
- Also set up non-digital contact tracing record form sheet as a back-up option
- Place matching QR code at entrances to your workplace
- Task staff member with responsibility for ensuring visitors and customers enter their information on check-in
What Happens if I do not Collect Customer Information?
If you don’t collect customer information, then you may run the risk of contravening public health directives.
What Happens if a Customer Refuses to Provide Information?
In this case, you may be able to refuse that customer service.
What Information is a Business Required to Collect?
The information each business is required to collect varies between local authorities, but broadly speaking all local authorities prefer customer contact details to be collected ie customer name and phone number or email address.
What If a Customer Does Not Have the Covidsafe App?
There is no consequence if a customer does not have the Covidsafe App. You should collect their information as you would do with any other customer either by electronic means or manually depending on the State or Territory requirements
BrightHR helping you manage your people and business
Contact us to find out how BrightHR people management software can help you manage and store your essential employee records and documents.
The information contained in this publication is for general guidance only. The application and impact of laws can vary widely based on the specific facts involved. Given the changing nature of laws, rules and regulations, and the inherent hazards of electronic communication, there may be delays, omissions or inaccuracies in information contained in this publication. Accordingly, the information is provided with the understanding that the authors and publishers are not herein engaged in rendering legal, accounting, tax, or other professional advice and services. As such, it should not be used as a substitute for consultation with professional accounting, tax, legal or other competent advisers. Before making any decision or taking any action, you should consult an appropriately qualified professional. While we have made every attempt to ensure that the information contained in this publication has been obtained from reliable sources, Employsure is not responsible for any errors or omissions, or for the results obtained from the use of this information. All information on this site is provided “as is”, with no guarantee of completeness, accuracy, timeliness or of the results obtained from the use of this information, and without warranty of any kind, express or implied, including, but not limited to warranties of performance, merchantability and fitness for a particular purpose. In no event will Employsure, affiliated entities, agents or employees thereof be liable to you or anyone else for any decision made or action taken in reliance on the information in this publication or for any consequential, special or similar damages, even if advised of the possibility of such damages.