Retention and Disposal of Contact Registers for COVID-19

Media release
From 5 December 2020, it will be mandatory for particular businesses and venues to collect contact details of customers and patrons for COVID-19 contract tracing, if required.
Covid-19

These collected details are commonly referred to as contact registers.

Contact registers are not covered in the General Disposal Authorities for State or Local Government Records, therefore an Ad Hoc Disposal Authority has been developed especially for these registers for use by both State and local government organisations.  The Ad Hoc Disposal Authority was approved by the State Records Commission on 2 December 2020, and provides the following authorisation:

‘Contact register data and records can be permanently deleted 28 days after collection of information’, unless the Commissioner of Police, or delegate, requests the contact information is retained for a longer period for contact tracing.

Please note: Previous advice that contact registers must be ‘retained until 28 days after the day on which the revocation of the State of Emergency has effect’, has been revoked.

Privacy
As contact registers contain private information, such as names and details of individuals, organisations ‘must take reasonable steps to protect personal information it holds from misuse, interference and loss, and from unauthorised access, modification or disclosure’. (Australian Privacy Principles).  Procedures must therefore be put in place for each agency collecting this data, to ensure the registers are secure.   

Disposal
When disposing of the registers, ensure they are destroyed completely so that no information is retrievable.  For further information, please see the SRO’s Guideline Records Retention and Disposal Instructions - Recommended Methods of Destruction

For further information please see:  COVID-19 coronavirus: Contact registers 

Page reviewed 9 December 2020