This document provides State Records Office (SRO) guidance on the retention and disposal of information collected by Western Australian State organisations in response to the COVID-19 pandemic.
What is COVID-19 information?
COVID-19 information is any data, fact, identifier, knowledge, or evidence created, acquired, collected, and recorded as part of managing and reporting during the COVID-19 pandemic State of Emergency in WA.
Why are retention and disposal processes for COVID-19 information essential to do now?
Some COVID-19 information will contain personal information such as names, addresses, phone numbers, health and vaccination status. This kind of information should only be retained for as long as lawfully required.
Other COVID-19 information that has enduring value may have been created and kept by dedicated COVID-19 working groups or units that will have been dissolved or disbanded now that the public health emergency has ended. This information is considered significant and must be identified and retained so these records are managed appropriately as State archives. Refer to Attachment 1 for details on identifying significant records.
Step 1: Identify COVID-19 information
Show moreEnsure your organisation has a comprehensive understanding of information created, acquired, collected, and recorded during the COVID-19 pandemic State of Emergency in Western Australia. Of particular concern is personal information that must be managed to protect privacy.
The main categories of information are described in Step 2 below.
Step 2: Identify information that must be managed to protect privacy (assessed/redacted/destroyed)
Show moreThe table below outlines the main categories of COVID-19-related information, and the applicable retention and disposal authority.
| Category | Retention and Disposal Authority |
|---|---|
Check-in data captured on paper, ledger, or another format. Does not include data collected specifically via the SafeWA app. | Protection of Information (Entry Registration Information Relating to COVID-19 and Other Infectious Diseases) Act 2021 Destroy 28 days after collection. |
| COVID-19 health declarations. | Local Government: 2023-005 General Retention and Disposal Authority for Local Government Information Section 92.1 State Government: 2023-004 General Retention and Disposal Authority for State Government Information Section 74.1 |
COVID-19 vaccination status records – government employees and visitors. Information may be recorded in paper documents, in digital forms or documents or held as data in databases. Information may be in held in a personnel file for employees and/or in other systems e.g., Ascender. | Local Government: 2023-005 General Retention and Disposal Authority for Local Government Information Section 92.1 State Government: 2023-004 General Retention and Disposal Authority for State Government Information |
Statistical or summary information. Aggregated data and information (dataset). | Local Government: 2023-005 General Retention and Disposal Authority for Local Government Information Section 100 as applicable State Government: 2023-004 General Retention and Disposal Authority for State Government Information Section 82 as applicable Retain if significant - see Attachment 1 for guidance on assessing significance. Otherwise destroy according to an approved retention and disposal authority. |
*An Individual Healthcare Identifier (IHI) is a unique 16-digit number the My Health Record system uses it to identify an individual. These may be found on an individual’s vaccination certificate and other health records. For further information about protection and handling of IHIs see: https://www.oaic.gov.au/privacy/guidance-and-advice/privacy-guidance-regarding-individual-healthcare-identifiers-ihis-on-covid-19-digital-vaccination-certificates
Step 4: Destroy records appropriately
Show moreAuthorisation of the disposal of records of information must be appropriately documented – see published advice at Destruction of Temporary Records
Organisations must ensure, as far as possible, that destruction methods render information unrecoverable.
Hard copy records may be destroyed by shredding or pulping. Burning or burying records are not acceptable destruction methods.
Digital records should be destroyed using the destruction functionality in the business information system. Organisations should be aware that if the “delete” function is used to remove information from certain business information systems without further actions by system administrators the information may still be recoverable. It is recommended that records and information managers work with ICT staff to ensure digital records are rendered unrecoverable where required.
Consideration should also be given to information and data stored in backups and email archives i.e. copies of records.
Step 5: Manage information that must be retained
Show moreCertain records are valuable as long-term evidence of decision making and the actions of government. In some cases, these will need to be retained permanently as State archives.
| Category | Retention and Disposal Authority |
|---|---|
Records documenting decisions made to accommodate short-term changes required to manage COVID-19 in the organisation. Decisions could be part of activities such as procurement, cleaning schedules, technology needs for staff to work from home, and planning for office fit-outs and modifications. Information may be recorded in email, purchase orders, etc. | Dispose of in accordance with General Retention and Disposal Authorities: Local Government: 2023-005 General Retention and Disposal Authority for Local Government Information State Government: 2023-004 General Retention and Disposal Authority for State Government Information Other government organisations may also need to refer to Sector Disposal Authorities and/or a retention and disposal authority approved under a record keeping plan. |
Lists and certificates of records destroyed with authorisation. For example: signed and approved disposal authorisation. | Local Government: 2023-005 General Retention and Disposal Authority for Local Government Information Section 96.7 State Government: 2023-004 General Retention and Disposal Authority for State Government Information Section 78.7 |
State archives Records documenting decisions related to strategy, policy and plans required to manage COVID-19 within or across State organisations. Decisions could be part of strategic activities such as organisation-wide policies, committees, taskforces, working groups and other bodies' records. | Local Government: 2023-005 General Retention and Disposal Authority for Local Government Information State Government: 2023-004 General Retention and Disposal Authority for State Government Information Other government organisations may also need to refer to Sector Disposal Authorities and/or a retention and disposal authority approved under a record keeping plan. |
Sources
Show moreThis document summarises guidance on the retention and disposal of records of information collected by WA State organisations in response to the COVID-19 pandemic.
The SRO acknowledges the following sources used in the development of this records management advice:
- Destruction of Temporary Records
- General Retention and Disposal Authority for Local Government Information
- General Retention and Disposal Authority for State Government Information
- Microsoft 365 Compliance Centre for Records Management
- Protection of Information (Entry Registration Information Relating to COVID-19 and Other Infectious Diseases) Act 2021
- Records Retention, Disposal and Destruction
- Sector Disposal Authorities
If you have further enquiries or have identified COVID-19 information not covered in this Advice, contact the SRO at sro@sro.wa.gov.au
Print this page
