Keeping contact information for COVID-19 and other purposes

NSW public offices collect personal contact information for a number of purposes, such as:

marketing and information purposes
safety and security purposes
service provision purposes.

Please note that personal contact information may be considered confidential and its disclosure should be governed by the purposes of its collection. For more information, check the resources available in https://www.ipc.nsw.gov.au/privacy/privacy-resources-public-sector-agencies/fact-sheets-guidelines-and-other-resources

Section 12(a) of the Public Health (COVID-19 Restrictions on Gathering and Movement) Order (No 3) 2020 contains recordkeeping requirements that NSW public offices must comply. Specifically:

keep a record of name and contact information for all staff, volunteers, visitors and contractors for a period of at least 4 weeks or 28 days.
on request, provide the record to the Chief Health Officer.

Please note that the retention period as set out in the public health order is only a minimum retention period.

This guidance provides some scenarios relating to retention periods of contact information collected by NSW public offices. If you discover other scenarios that may be relevant to any NSW government agency that are not listed here, or have any other records-related enquiries, please contact us at govrec@records.nsw.gov.au.

Scenario 1: Contact information is collected for the sole purpose of complying with the Public Health Order (No 3) and not for any other purpose

In this scenario, NSW public offices should follow the minimum retention period as set out in s12(a) of the Public Health Order No 3 – keep the record for at least a period of 4 weeks.

The disposal of this contact information is permitted under the following disposal classes:

General retention and disposal authority: administrative records (GA28) – COMMUNITY RELATIONS – VISITS

2.23.3	Summary records regarding visitor attendance etc, e.g. visitors books.	Retain until administrative or reference use ceases, then destroy

General retention and disposal authority: local government records (GA39) – COMMUNITY RELATIONS – Visits and tours

2.16.1	Summary records of visitor attendance, e.g. visitors' books.	Retain until administrative or reference use ceases, then destroy

For records relating to staff's attendance to the premise, go to Scenario 3.

Scenario 2: Contact information is collected for attendance at events or in your premises or for purposes other than contact tracing

In this scenario, NSW public offices may already have systems in place which collect contact information. However, NSW public offices should ensure that they are able to produce contact information of persons in attendance to the Chief Health Officer or delegate for contact tracing when needed.

NSW public offices should identify the retention period of this contact information pre-COVID-19 and assess whether the retention period is longer or shorter.

Pre-COVID-19:

if the contact data is usually retained shorter than the minimum retention period as set out in s12(a) of the Public Health Order No 3 – keep the record for at least a period of 4 weeks.
if the contact data is usually retained longer than the minimum retention period as set out in s12(a) of the Public Health Order No 3 – retain this record as per the relevant disposal classes. The following disposal classes apply:
General authority: administrative records (GA28) – COMMUNITY RELATIONS – CUSTOMER SERVICE

2.6.4	Contact details of clients, eg. E-mails lists, address lists	Retain until administrative or reference use ceases, then destroy

General authority: administrative records (GA28) – COMMUNITY RELATIONS – VISITS

2.23.3	Summary records regarding visitor attendance etc, e.g. visitors books.	Retain until administrative or reference use ceases, then destroy
2.23.4	Records relating to visits made by the organisation's employees to other organisations (e.g. community, business) or professional associations with the view of promoting the image or services of the organisation. Records include invitations.	Retain minimum of 2 years after action completed, then destroy

General authority: local government records (GA39) – COMMUNITY RELATIONS – Contacts

2.6.1	Contact details, e.g. email lists and address lists, and records relating to their updating and maintenance. Includes changes of contact details for purposes other than rating.	Retain until administrative or reference use ceases, then destroy

General authority: local government records (GA39) – COMMUNITY RELATIONS – VISITS AND TOURS

2.16.1	Summary records of visitor attendance, e.g. visitors' books.	Retain until administrative or reference use ceases, then destroy
2.16.2	Records relating to visits or tours of the organisation by members of the general public, student groups, clients of the organisation, representatives of professional associations, community groups or other organisations. Includes requests that are denied. Records include arrangements and bookings, reports of visits and letters of appreciation.	Retain minimum of 3 years after action completed, then destroy
2.16.3	Records relating to visits made by the organisation's employees to other organisations (e.g. community, business) or professional associations with the view of promoting the image or services of the organisation. Records include invitations.	Retain minimum of 2 years after action completed, then destroy

Scenario 3: Staff, volunteers, visitors and contractor’s contact details and attendance to the premise are already collected via security, access or other systems

In this scenario, NSW public offices don’t have to introduce additional data collection activities as systems are already in place. However, NSW public offices should ensure that they are able to produce a record of names and contact information of persons in attendance to the Chief Health Officer or delegate for contact tracing when needed.

In this scenario, the following disposal classes apply:

General authority: administrative records (GA28) – PROPERTY MANAGEMENT – SECURITY

16.24.5	Records relating to property access controls to secure areas. Records include: access registers (e.g. visitors books, sign in sheets) keys registers security data logs records of issue of security passes to visitors reports on responses to alarm warnings.	Retain minimum of 7 years after action completed, then destroy

General authority: local government records (GA39) – PROPERTY MANAGEMENT – SECURITY

5.10.1	Records relating to property access controls to secure areas. Records include: access registers (e.g. visitors books, sign in sheets) keys registers security data logs records of issue of security passes to visitors reports on responses to alarm warnings.	Retain minimum of 7 years after action completed, then destroy

Shopping cart

GRK footer