FREEDOM OF INFORMATION
PRACTICAL PRIVACY IN LIBRARIES
Even during a public health emergency, libraries are still bound by the requirements to protect the privacy and confidentiality of library users. In New Zealand, certain businesses and event organisers, including libraries, legally must have a way for customers and visitors to record that they have entered their premises or attended a gathering or event. The Office of the Privacy Commissioner has published guidance on mandatory record keeping for contact tracing.
Listed below are some practical considerations on contact tracing in libraries and taking care of private information.
COLLECTION OF CUSTOMERS INFORMATION
A general principle of the Privacy Act is that an agency should only collect as much information as you need and no more. For contact tracing, libraries only need to record the person’s name, contact number, and the date and time they entered your library. Libraries do not need to collect any further information.
KEEPING THE INFORMATION SAFE AND SECURE
Once libraries have collected customer information, the information needs to be kept safe. This means it should be stored safely and securely. For instance, if it is a physical record, it could be stored where other valuables are kept such as a locked cabinet or safe. Under the order, personal information must be kept for 60 days. After 60 days, information that has been collected solely for the purpose of supporting contact tracing should be safely disposed of. Shred it or find another way to destroy it. Don’t just throw it in the bin.
THE COVID TRACER APP
The most practical way to record a person’s information is for customers to use the COVID tracer app using their own digital device. Libraries should display the COVID Tracer App posters leading up to and near entry and exit points and at multiple places within the building. Also ensure there are tracer app posters at different heights, so that people in wheelchairs can access them.
Posters are available on the COVID-19 website https://covid19.govt.nz/posters/
PAPER RECORD TRACING SHEETS
While there is no one right method of collecting, it is recommended that libraries do not use an open sheet or register left in a public-facing position, where personal information is visible to others. This is a leading cause of Covid-related privacy breaches. The important thing is to ensure alternative (non QR code) ways of collecting personal information for contact tracing are protected and private.
The Office of the Privacy Commissioner lists these alternative ways to record contact tracing information:
1. 2. 3.
Set up a ballot box with individual paper slips or cards for people to fill in the name, date, phone number and time.
Have an employee manually record visitor details – this ensures that staff maintain control over the records and do not leave contact information visible to others.
Consider an electronic system, like a tablet sign-in app, work timesheet or an existing booking system.
PRIVACY STATEMENT
It is recommended that a simple privacy statement is displayed alongside your alternative record keeping system to let people know why the information is needed and how long you need it for. If you have set up a contact recording system for the sole purpose of complying with the Government’s mandatory requirement, this statement would be appropriate.
What if someone refuses to scan in? If someone refuses to, or is unable to scan in, library staff are not expected to force someone to provide their details, or to refuse them entry. Libraries could create scripts to assist staff with difficult customer interactions.
What if we don’t keep records? If you do not follow the Government record keeping requirements, you could be fined an infringement fee of $300 or a court-imposed fine of up to $1,000. Failing to display a QR code will continue to be an infringement offence carrying an infringement fee of $300 or court imposed fine of up to $1,000.
Organisations such as CLIP in the United Kingdom have created criteria for contact tracing activity:
■
■
■
■
■
■
■
no deterrent to library use
no impact on people from marginalised, ‘at-risk’ or vulnerable groups
no impact on safeguarding of children and young people
no detriment to the user’s right to privacy
no ‘cross-contamination’ with other library systems or user information
sufficient capacity and capability legal clarity over the status of volunteers.
This information was correct at November 27, 2021. Guidance and legislation are being updated by the Government constantly. Check the MOH site and Covid.org sites for recent updates.*