Mandatory Record Keeping is Here

An earlier version of this article was published on 23 August 2021. This revised version was published on 7 September 2021 to reflect the mandatory record keeping rules now being in force, and to include information published by the government after 23 August 2021.

New Zealand is famous world wide for its Covid stopping Lockdowns. But our ability to sustain regional and localised lockdowns, and to avoid the full economic impact of shutting down our economy, is only because of our ability to contact trace quickly and effectively. As the huge number of contact events and places of interest in the current outbreak has shown, this ability is of critical importance in the new Delta environment.

This is why, on 23 August 2021, the Government announced its a decision (which had been in discussion for a number of months) to formally require most businesses to keep contact tracing records at all alert levels. These requirements came into force at 11.59 pm on 7 September 2021.

At the time of the 23 August announcement, it had been suggested a similarly wide-reaching requirement on individuals to sign in would be imposed. Because of difficulties around enforcement, it has since been clarified that scanning or signing in will not be mandatory.

Background
Contact tracing has obvious privacy concerns – it requires people to provide personal information and creates an accessible record of the places they have been. Making it mandatory has continued to be controversial throughout the pandemic. Probably as a result of this controversy, the Government has long held off on making it a mandatory requirement unless there is an active outbreak.

Until the new rules came into effect, at alert level 1 businesses and event managers had only been required to display a QR code at or near their main entrance. Only at alert level 2 or above had businesses – and then only a small number of businesses – been required to keep a fuller record of who had visited and to monitor compliance with that requirement.

Outside of businesses, there have also been record keeping requirements for social gatherings – in particular, gatherings at marae, weddings, funerals, tangihanga and religious services. Again, until the new rules came into effect this had only applied at alert level 2 and above.

The New Requirements for Businesses and Event Managers
From 11.59 pm on 7 September 2021 a “contact record rule” applies to certain businesses and services. Ensuring a range of contact tracing options are available is part of the new normal.

Which businesses are affected depends on which alert level a business is operating under. At alert level 4, the rules apply to primary industries, supermarkets, petrol stations, courts and tribunals and the justice sector, and providers of:

• health services (including pharmacies and funerary services);
• food delivery services for bakeries, uncooked food suppliers, and alcohol suppliers;
• cooked food delivery services contracted by health service providers (like Meals on Wheels);
• purveyors of essential non-food consumer products;
• building, construction, and maintenance services;
• postal, courier, freight, logistics, and transport services;
• scientific services;
• school and community-based services;
• key utilities and communications;
• government and security services; and
• pest management services.

At lower alert levels, the above services remain affected by the new rules. Also affected at lower alert levels are businesses not able to operate at level 4, including cafes, restaurants, barbers, rest homes, libraries, museums, swimming pools, massage parlous, beauticians, barbers, hairdressers, exercise facilities, cinemas, theatres, casinos, and concert halls and nightlife venues.

Visitors to aged care and healthcare facilities will also need to be provided with scanning in options, as will those attending social gatherings including those at private houses, marae, weddings, funerals, tangihanga and faith-based services.

The person in charge of providing an affected business or service at a particular workplace to have “systems and processes” in place to allow every person aged 12 or over who enters their workplace to either scan their QR code or record their visit in another way.

This could involve either having them create their own contact record by signing a register at the door or dropping a slip into a box, or having a staff member take down details. The key requirement is that people who are not able to scan QR codes have a convenient way to record their visit, however long they are at the premises.

The requirement is in addition to the existing rule that means workplaces have to display a QR code at or near their main entrance.

For businesses with multiple premises, or event managers that run events at different locations, their manager on the day at each of their sites is responsible for ensuring the requirement is complied with. The coming into force of these additional rules is a good reminder to ensure that members of your management team are familiar with their obligations under the Covid orders.

The government has also made clear that it expects scanning and signing in facilities to be made available to all workers, contractors, customers, and volunteers. Workplaces with multiple entries and exits should ensure QR codes and registers are made available at all of these doors, including employee entrances.

Penalties
Compliance with the new rule is mandatory. An intentional breach of the requirements carries the risk of a conviction resulting in a criminal record and up to six months’ imprisonment or a fine of up to $4000.

While during previous lockdowns the Police have been cautious in using their formal powers, preferring to warn people, during the current outbreak we have seen the Police making greater use of their formal enforcement powers. With the greater threat to the community and economy that Delta represents, and the importance of being able to quickly trace contacts to combatting the spread of the virus, we expect to see the Police quicker to prosecute non-compliance of the rules than earlier in the pandemic.

The Courts are also taking offences against the Covid orders seriously. During the March 2020 lockdown, many people who breached received short sentences in prison: deliberate flouting of the law carries a very real risk of similar treatment. For many people the risk of a criminal conviction will also be a significant deterrent. Businesses that face conviction will of course only risk a fine in most cases, but will also need to weigh up the considerable reputational risk conviction brings.

Privacy
While businesses will now be required to comply with these obligations, it is important that they also take into account their obligations under the Privacy Act 2020 when recording information. Key obligations include:

• Only gathering information that is necessary;
• Only using information for the purpose for which it was gathered; and
• Destroying information when it is no longer needed.

Contact tracing information should be kept separate and, in accordance with the Covid Orders, destroyed after 60 days. It should not be used for other purposes (like client data bases) without specific permission. As the information is highly personal, it must also be stored carefully to avoid anyone accessing it.

The risks of getting things wrong in terms of privacy are serious with compensation for breaches awarded under the Privacy Act 2020 often exceeding $10,000.

A number of businesses, citing privacy concerns, have moved away from having a register book open on the counter towards having complete-and-tear forms that are posted in boxes. We consider this can better help businesses comply with their Privacy Act obligations to protect personal information against wrongful access. It will however be important that the information posted in the boxes is regularly collated so that it is accessible to contact tracers.

Non-Compliant Customers

When the mandatory record keeping rules were first announced, the Government suggested that customers and visitors to venues would also be put under an obligation to make use of scanning in facilities. This caused anxiety for some business and event operators, it not being clear if they would be expected to enforce scanning in, or turn away non-compliant customers.

The government has now clarified that scanning or signing in will not be mandatory. A spokesperson for the Department of Prime Minister and Cabinet has said that “there is no expectation or requirement that businesses or locations should force a customer or visitor to scan in or provide” contact tracing details. Nor are they “required to expected to turn people away who may refuse to make a record of their visit”.

This is a welcome clarification for businesses already likely to be under pressure with recent closures, for whom being made to turn away non-compliant customers would cause further loss. With the media reporting widespread resistance to mandatory contact tracing requirements in some sectors of the community, it is also likely to spare businesses from becoming a flashpoint for anti-Covid restriction agitation.

Where We Can Help
Holland Beckett Law has been advising our clients on what the ever-changing array of public health measures means for them day-to-day. The changes in messaging around mandatory scanning in requirements illustrates how quickly the situation can develop.

With the frequent changes to the rules, it is important to have people on your side who understand the requirements and can help you ensure your business complies with all of the requirements.

We are more than happy to discuss your situation and help you better understand your rights, obligations, and options.