Source: New Zealand Privacy Commissioner – Blog
We continue to be notified of instances of people gaining access to other people’s personal information from paper-based contact tracing registers and using it in ways that breach the person’s privacy.
While the NZ COVID Tracer app is the recommended way to record contact tracing information, some people may not wish to use the app or may not have a mobile phone that supports it.
It is therefore important that a business or organisation provides other methods of collecting and storing contact tracing records – but which also protect the privacy of those whose details are being collected.
Failure to keep records safe and secure could lead to a loss of trust in your business or service, put you at risk of breaching someone’s privacy, or detrimentally impact contact tracers’ ability to quickly and efficiently identify contacts of someone exposed to Covid-19.
What are some ways businesses and organisations can protect contact tracing information from misuse or browsing? We produced guidance last year and you can find it here and here.
But given that Covid-19 will be a problem for us for some time to come, we thought it would be a good idea to revisit this topic.
Some practical ways of collecting and storing
Here are some alternative ways you can record contact tracing information. In all cases, you should tell people what you will do with the information you are collecting. An easy way to do this is put up a sign near the entrance.
- Use a work phone to receive texts from customers
This can be a simple ‘burner phone’ – simply publicise the cell phone number around the entrance to your service or business and let customers text you their name. It’s simple and the texts are not visible to others. It ensures that the contact phone numbers are accurate, and the messages will be automatically time and date stamped. Make sure the phone is stored securely and can only be accessed by the right people.
- Have a secure ballot box
Instead of having an open sheet where everyone’s details are visible, you could set up a ballot box with cards for people to fill in. Make sure the cards prompt guests to fill in the date, time, name and contact details. Empty the ballot box regularly and keep the cards stored securely and organised by day so that your records are readily retrievable if requested by a contact tracer. Store the cards securely in a locked cabinet and destroy them when they are no longer needed.
- Have a staff member collect details directly from visitors
Another technique is to have a staff member note down details from visitors as they enter. This ensures that staff maintain control over the records and do not leave contact information visible to others. Make sure that the staff member is trained and knows to only collect the minimum information necessary. You could also get visitors to write the information down themselves, so others nearby don’t overhear their information.
- Use separate sheets in a book for each visitor
Have guests sign in on a separate sheet for each person. This means that previous visitors’ records aren’t immediately visible to others. This will still require a staff member to ensure guests aren’t browsing the book to look at other people’s details, but it is a less resource intensive than having a staff member collect the details directly from each individual.
Key things to remember for when collecting contact tracing records:
- Transparency
Be transparent about the reason for the register. You can either draft a simple privacy statement, expand an existing privacy statement, or add a statement like this to your form: This information is being collected to assist in the management of the Covid-19 pandemic. It will be given to public health officials in the event that it is required for contact tracing. We will not use it for any other purpose and will destroy it after 60 days. It will be kept here at [name of the establishment]. You have a right to access and correct any information we hold about you.
- Use
Only use the register for the purposes of contact tracing. It should be stored securely in an organised way so that information is readily retrievable if information from a specific day is asked for by contact tracers. Do not use the information for other purposes.
- Security
Keep the information secure. As a rule, customers should not be able to view the details of others who have signed into the business or service. Leaving a paper form out with everyone’s details is risky because the information could be misused or lost.
- Only collect what’s needed
A general rule of the Privacy Act is to collect only as much information as you need and no more. Contact details, name and the date and time of the visit are all that are reasonably necessary. You do not need to verify a person’s identity, collect their NHI, date of birth or other information for contact tracing.
Find out more on our Covid-19 contact tracing resources page.
Image credit: Unite Against COVID-19
