ALIA guidance on record keeping for contact tracing during COVID-19

During the current COVID-19 pandemic, the Australian Government lists the latest information, news and advice from government agencies across Australia. The Australian Government is encouraging the public to download the COVIDSafe tracing app that aims to speed up contacting people exposed to the coronavirus (COVID-19). 

The Australian Library and Information Association (ALIA) is also providing updated information and advice

Whilst not all states and territories require libraries to record visitors for contact tracing purposes, ALIA is aware that some authorities are setting this as a requirement for reopening. This has been the case so far for Western Australia (see appendix below). 

Recognising that record keeping for contact tracing is an important measure for tracking and containing the spread of COVID-19, ALIA also stresses the importance of implementing procedures that protect the privacy of library workers and patrons. Nobody should be forced to provide personal information if they do not wish to do so. 

Principles of privacy need to be upheld in order to protect the personal data of those people visiting and working in the library.  

ALIA recommends that, where libraries are required to collect personal data from patrons: 

  • Libraries seek consent from library patrons before collecting personal data for contact tracing purposes. 

  • Libraries only collect personal data required for contact tracing (e.g. name and contact phone number or email address). 

  • Libraries are transparent in the way they document, store, and use this data, including details of who they may pass the information onto, under which circumstances, and how long they will keep the information for. 

  • Libraries put procedures in place to destroy records immediately following the retention period of 28 days. 

ALIA also expresses concern that library patrons who refuse to provide personal contact information may be refused access to library resources. To these ends, ALIA recommends that libraries consider what additional measures can be put in place to ensure that patrons can still access the library’s services and collections, such as: 

  • Accommodating quick visits of under 15 minutes that do not require the recording of personal data. 

  • Providing contactless services, such as ‘click and collect’, that do not require the patron to enter the library. 

  • Providing support to use electronic collections as a substitute for physical collections. 

While ALIA recognises the expectation that public services will take reasonable measures to control the virus and address the current public health emergency, it is important that these measures are not allowed to infringe on essential rights or freedoms, including the right to privacy or the freedom of access to information. 

21 May 2020 


Appendix: Examples of checklists that include a requirement to collect personal data from library visitors 

Western Australia libraries 

In Western Australia, a local government that operates a public library that was required to close under Directions made under the Emergency Management Act is required to complete a COVID Safety Plan and display a COVID Safety Certificate before reopening. The Safety Plan includes the condition of maintaining ‘records of patrons for the purposes of contact tracing where appropriate’. The records must be kept for 28 days after the State of Emergency has been lifted.