While it would be hard to dispute that it is a good thing to be able to efficiently trace any contacts who may have been in touch with a COVID-infected person, the way this information is collected and held carries certain risks. Use of QR codes has greatly reduced these risks, but if an individual is unable to use the QR code where this is mandated, then most jurisdictions require that the individual’s name, phone number, and time of entry are recorded on paper. This paper record (or it may then be transferred to an electronic database) must usually be kept by the venue for a period of 28 days, depending on the jurisdiction.
There have been numerous reports of personal information obtained through these COVID sign-in paper records being misused, such as information being used for unsolicited marketing purposes, or even phoning people for dates. Disclosing the personal information of students in these circumstances is of particular concern as a child safety risk, providing valuable information to potential child sexual abusers. So how should a school manage the public health benefits of providing the information as well as managing the child protection risks?
While requirements in relation to COVID sign-ins vary across different states and territories, a school’s duty of care means that it should be facilitating accurate sign-ins for students when attending venues for school-related events so that, if there is a COVID-19 outbreak, the students can be quickly traced and appropriate testing carried out. The same rational applies even if the COVID sign-in is voluntary. At the same time, the same duty of care requires that a school protects the personal information of its students where there is a foreseeable risk that paper records can be more easily used for more nefarious purposes.
We provide a very brief overview of the specific requirements in each state and territory in relation to COVID sign-ins at the end of this article.
What are Venues Doing in Practice?
Approaching the issue from a different perspective, we contacted a number of venues that frequently handle student groups and asked them how they managed or were planning to manage COVID sign-ins for students. It was at this point that we discovered that there may be different provisions relating to COVID sign-ins that appear not to have been ‘broadcast’.
For example, Taronga Zoo in Sydney does not require schools to provide students’ details but requires attending teachers to check-in on arrival using the Service NSW App and to check-in students as dependents. The school here bears the responsibility of keeping a valid record of attending students that can be provided to NSW Health if requested. Similarly, the Sydney Opera House requires schools to keep an electronic record of attending students and their details (such as names, and parent/guardian’s contact details) for 28 days. Two accompanying adults (usually teachers) must provide the venue with the date and time of arrival and departure to the venue on the day, as well as their contact details; any accompanying adults must use the Service NSW app.
Other venues in NSW, such as the Australian Museum in Sydney, have received exemptions from the NSW Government that allows schools to not have to sign in students via the Service NSW App. With this exemption, the Museum is able to request the group leaders (usually two teachers) to sign in on arrival, and for the school to keep an electronic copy of the student list for the excursion. Alternatively, the Sydney Jewish Museum requires schools to provide a paper list of all attending students and teachers in advance for records; the number of attending individuals is verified on the day at the venue.
Perth Zoo has developed a COVID safety plan and it involves the use of Frequently Asked Questions (FAQs). Other venues such as the WA Boola Bardip Museum and the Perth Convention Centre have also developed excellent COVID safety plans regarding how they maintain safety for their customers while they are attending their venues.
What Should Schools Do?
It appears that state and territory governments are strongly encouraging signing in via their local apps, so that local health authorities have direct access to any necessary contact information.
One obvious but not terribly realistic method is to require each student to have a fully functioning phone on any excursion and that be used to submit a QR code COVID sign-in. This suggestion will be met with scoffing laughs, when teachers consider the variables of forgotten phones, insufficiently charged phones, lost phones, and user error, and a great deal of time wasted while the task is performed. Where large groups of students or unattended groups of students are attending venues, it may be difficult for schools to verify that students are individually signing in via the app.
While no such guidance has been given by any local government, as all states and territories allow for alternative sign-in methods such as pen and paper or internal electronic records, it may be easier for schools to provide venues and businesses with a list of attending students and their contact details. This information should also record the time and date of attendance. Consideration should be given to advising parents/guardians on the excursion consent form that the school will be taking this action.
However, as we have discovered, a school should first contact the venue during the excursion planning process to obtain specific instructions or guidance and then make a decision about whether those processes satisfy the school’s duty of care. Where a paper-based sign-in is considered to be the most appropriate option, the school should request that the venue does not display the school information in a common visible folder at the venue entrance. Where the venue does not require students to personally sign-in and only the supervising teachers and accompanying adults, the school should ensure that an accurate list of students, teachers, and accompanying adults is retained with contact phone numbers so that if contact tracing is necessary, then this can be done as efficiently as possible.
On a final note, before a school books to attend any venue, they should enquire about, and receive a copy of, the venue’s COVID Safety Plan and ensure that they are satisfied that the Plan allows them to maintain a satisfactory level of duty of care for their students. Some venues have placed these Plans where they can be easily accessed on their public webpages. If a venue’s Plan fails to satisfy a school that it will protect their students, then schools would be encouraged to either ask the venue to improve their Plan or seek an alternative venue.
Specific Requirements in Each State and Territory
Most states and territories provide their own government ‘app’ that they require people to use when signing in to venues using QR codes. Set out below is some more specific information in relation to each state and territory.
Australian Capital Territory
Under the current ACT Public Health Directions, any non-essential businesses and undertakings should collect the first name and phone numbers of any patrons, along with the time and date of attendance. Most businesses will provide a QR code for sign-in via the Check-in CBR app. Any check-in information submitted via this app will be stored with ACT Health for contact tracing for 28 days.
If collecting contact details not via the app, businesses are required to store this information privately for 28 days.
New South Wales
Under the current NSW public health orders, most businesses are strongly recommended to use the Service NSW app to facilitate sign-ins for attendees. While some businesses are required to collect details electronically, these businesses can still provide an alternative sign-in method (e.g. pen and paper) and then transfer these details to their own electronic record-keeping system. Those businesses are required to store this information for 28 days.
Under the current Chief Health Officer Directions, businesses, organisations, community groups and venues are required to collect contact information from attendees. Businesses should provide QR codes for sign-in but also provide alternative methods, such as pen and paper, for those unable to use QR codes. Any information collected should only be stored for 28 days.
If, for whatever reason, students are attending venues for a school-related event but without supervision, businesses and organisations must still collect their contact information, as unaccompanied minors, under section 54 of the Public and Environmental Health Act 2011 (NT).
Under the current Restrictions on Businesses, Activities and Undertakings Direction, businesses listed under Schedule 1A must collect the contact details of attendees. If students are attending a hospitality business, contact details must be stored electronically; these details should be stored securely for a minimum of 30 days and destroyed after 56 days. If a business is unable to collect details electronically, they may provide an alternative method, such as pen and paper, to be transferred to internal electronic record-keeping systems at a later point.
In South Australia, most businesses and general retail industry premises will provide a QR Code for sign-in via the mySA Government app. However, they may also provide pen and paper for sign-ins for those who cannot use the QR code. This information should be stored for 28 days and then disposed of securely.
Under the current Contact Tracing Directions, all businesses, venues and events must collect contact details for any attendees. They may choose to do this using a QR Code for the Check in Tas app, or by providing paper-based methods that comply with the necessary requirements. Any information must be accessible at request by health authorities and kept for 28 days.
Under the current regulations in Victoria, businesses are strongly encouraged to provide QR Codes from the Victorian Government’s QR Code Service for sign-ins. However, businesses may also provide other manual or electronic means of signing in as long as these records are kept for 28 days. Businesses that are applying the two square metre rule must use electronic records, and those using the four square metre rule can use manual means of collecting contact details.
At the moment, it is a legal requirement for certain businesses to request all patrons who enter their premises (including staff, volunteers and contractors) to provide their contact details.
According to the government website, if children under 16 years attend a business unaccompanied by an adult, they are not required to provide their contact details. Adult patrons are encouraged to register accompanied minors under 16 years of age.