Protection of Information (Entry Registration Information Relating to COVID-19 and Other Infectious Diseases) Act 2021

 

Protection of Information (Entry Registration Information Relating to COVID-19 and Other Infectious Diseases) Act 2021

Contents

1.Short title2

2.Commencement2

3.Terms used2

4.Act binds Crown5

5.Relationship of this Act to other written laws5

6.Protection of entry registration information5

7.Storage of entry registration records7

8.Destruction of entry registration records7

9.Liability of officers of body corporate for offence by body corporate9

10.Publication of approvals9

11.Transitional provisions10

12.Regulations10

Notes

Compilation table11

Defined terms

 

Protection of Information (Entry Registration Information Relating to COVID‑19 and Other Infectious Diseases) Act 2021

An Act to protect the confidentiality of certain information obtained for the purposes of contact tracing relating to COVID-19 and other infectious diseases.

 

1.Short title

This is the Protection of Information (Entry Registration Information Relating to COVID‑19 and Other Infectious Diseases) Act 2021.

2.Commencement

This Act comes into operation as follows —

(a)sections 1 and 2 — on the day on which this Act receives the Royal Assent;

(b)the rest of the Act — on the day after that day.

3.Terms used

In this Act —

authorised officer has the meaning given in the Public Health Act 2016 section 4(1);

CEO means the chief executive officer of the department of the Public Service principally assisting in the administration of this Act;

Chief Health Officer has the meaning given in the Public Health Act 2016 section 4(1);

commencement day means the day on which section 6 comes into operation;

contact tracing, in relation to an infectious disease emergency, means the process of identifying, notifying, communicating with, managing and directing —

(a)individuals who —

(i)may be, or may have been, a source of infection; or

(ii)may have been in contact, directly or indirectly, with, or in the proximity of, an individual who may be, or may have been, a source of infection;

or

(b)the parents, guardians or carers of, or other persons who have responsibility for the care of, such individuals;

Department’s website means a website maintained by or on behalf of the department of the Public Service principally assisting in the administration of this Act;

entry registration information —

(a)means relevant information about the presence of persons at a place, obtained, on the occasion of their entry to the place, for the purposes of contact tracing in relation to an infectious disease emergency by the use of the mobile application known as “SafeWA”, or some other contact tracing register or system, whether or not obtained under the Emergency Management Act 2005 or the Public Health Act 2016; but

(b)does not include —

(i)such information obtained in the ordinary course of carrying on a business or undertaking if the information would have been obtained in any case for purposes other than contact tracing; or

(ii)statistical or summary information;

entry registration record means any record of entry registration information, including a record in the form of data, text, images or sound;

Health Department means the department of the Public Service principally assisting in the administration of the Public Health Act 2016;

infectious disease emergency means —

(a)an emergency situation or a state of emergency declared under the Emergency Management Act 2005 in respect of an emergency relating to a plague or epidemic (as referred to in paragraph (d) of the definition of hazard in section 3 of that Act); or

(b)a public health state of emergency declared under the Public Health Act 2016 in respect of a public health emergency relating to an infectious disease; or

(c)a serious public health risk, in respect of an infectious disease, in relation to which an authorised officer is authorised under the Public Health Act 2016 section 152(1) to exercise serious public health incident powers;

initial storage period, for an entry registration record, has the meaning given in section 8(1);

prescribed means prescribed by regulations made under this Act;

records contractor means a person engaged under a contract for services to provide services relating to the storage, maintenance, processing or destruction of entry registration records;

relevant information means any of the following —

(a)a person’s name and contact details;

(b)details of a person’s presence at a place, including —

(i)the time and date at which the person entered the place; and

(ii)details of any persons accompanying the person;

(c)any other information approved by the Minister for the purposes of this definition;

responsible person, for an entry registration record, means —

(a)for a record in the possession or control of an agency as defined in the Public Sector Management Act 1994 section 3(1) — the chief executive officer, as defined in that section, of that agency; or

(b)for a record in the possession or control of a records contractor — the records contractor; or

(c)for any other record — the person in possession or control of the record;

serious public health incident powers has the meaning given in the Public Health Act 2016 section 4(1);

statistical or summary information means statistical or summary information that could not reasonably be expected to lead to the identification of an individual;

use, in relation to information, includes the following —

(a)to possess the information;

(b)to copy the information;

(c)to control the use of the information;

(d)to seize the information;

(e)to require the production of the information.

4.Act binds Crown

This Act binds the Crown in right of Western Australia and, so far as the legislative power of the Parliament permits, the Crown in all its other capacities.

5.Relationship of this Act to other written laws

(1)This Act has effect despite the Freedom of Information Act 1992 and the State Records Act 2000.

(2)To the extent that there is an inconsistency between a provision of this Act and a provision of the Criminal Investigation Act 2006, the Emergency Management Act 2005, the Public Health Act 2016 or any other written law, the provision of this Act prevails.

6.Protection of entry registration information

(1)Entry registration information cannot be used or disclosed for any purpose other than —

(a)contact tracing; or

(b)purposes related to contact tracing, including (without limitation) —

(i)purposes necessary for the support and efficacy of contact tracing; and

(ii)purposes necessary for the integrity and security of entry registration information;

or

(c)a purpose in subsection (4) or (5).

(2)Without limiting subsection (1), entry registration information is not admissible in evidence in any criminal or civil proceedings other than proceedings in relation to an offence referred to in subsection (4).

(3)A person who uses or discloses entry registration information contrary to subsection (1) commits a crime.

Penalty for this subsection:

(a)for an individual, imprisonment for 3 years;

(b)for a body corporate, a fine of $250 000.

Summary conviction penalty for this subsection:

(a)for an individual, imprisonment for 12 months and a fine of $20 000;

(b)for a body corporate, a fine of $100 000.

(4)Entry registration information may be used or disclosed for the purpose of investigating or prosecuting an offence relating to —

(a)compliance with an obligation under the Emergency Management Act 2005 or the Public Health Act 2016 to provide or record information for the purpose of contact tracing; or

(b)compliance with an obligation under this Act; or

(c)compliance with an obligation relating to the recording, use or disclosure of entry registration information under The Criminal Code, the Emergency Management Act 2005 or the Public Health Act 2016; or

(d)the giving of false or misleading information in compliance or purported compliance with an obligation referred to in paragraph (a).

(5)A public service officer in the Health Department or a records contractor may, with the approval of the Chief Health Officer, use entry registration information for the purpose of deriving statistical or summary information.

(6)The Freedom of Information Act 1992 Parts 2 and 4 do not apply to statistical or summary information derived under subsection (5).

7.Storage of entry registration records

The responsible person for an entry registration record must, so far as reasonably practicable, ensure that the record is stored in a secure manner until it is destroyed.

Penalty: imprisonment for 12 months and a fine of $20 000.

8.Destruction of entry registration records

(1)In this section —

initial storage period, for an entry registration record, means the period of 28 days (or, if a different period is prescribed for the infectious disease emergency, that period) beginning on the day after the day on which the information contained in the record was obtained.

(2)The responsible person for an entry registration record must ensure that it is destroyed, in accordance with subsection (8), as soon as practicable after the expiry of the initial storage period for the record.

Penalty for this subsection: imprisonment for 12 months and a fine of $20 000.

(3)If a responsible person for an entry registration record is required under the Emergency Management Act 2005 or the Public Health Act 2016 to retain the record for purposes relating to contact tracing for a specified period (the extended period) that extends beyond the initial storage period, the person —

(a)must retain the record for the extended period; and

(b)must destroy the record, in accordance with subsection (8), as soon as practicable after the end of the extended period.

Penalty for this subsection: imprisonment for 12 months and a fine of $20 000.

(4)Subsection (3) has effect despite subsections (2), (6) and (7).

(5)Subsections (6) and (7) do not apply to a person who is a responsible person solely because of being the occupier or person apparently in charge of a place referred to in paragraph (a) of the definition of entry registration information in section 3.

(6)A responsible person for an entry registration record is not required to destroy the record if, at the expiry of the initial storage period for the record, the record —

(a)is required for contact tracing; or

(b)is required in the investigation of an offence referred to in section 6(4); or

(c)is, or is required as, evidence in proceedings for or in relation to an offence referred to in section 6(4).

(7)A responsible person for an entry registration record that is not destroyed in accordance with subsection (2) because of the application of subsection (6)(a) must ensure that the record is destroyed, in accordance with subsection (8), as soon as practicable after it ceases to be required for contact tracing.

Penalty for this subsection: imprisonment for 12 months and a fine of $20 000.

(8)An entry registration record must be destroyed either —

(a)in the manner approved by the CEO; or

(b)if no approval under paragraph (a) applies to the record — by taking all reasonable steps to ensure that the entry registration information contained in the record cannot be retrieved.

9.Liability of officers of body corporate for offence by body corporate

(1)In this section —

officer, in relation to a body corporate, has the meaning given in the Corporations Act 2001 (Commonwealth) section 9.

(2)If a body corporate is guilty of an offence against section 6, 7 or 8, an officer of the body corporate is also guilty of the offence if the officer failed to take all reasonable steps to prevent the commission of the offence by the body corporate.

(3)In determining whether things done or omitted to be done by the officer constitute reasonable steps, a court must have regard to —

(a)what the officer knew, or ought to have known, about the commission of the offence by the body corporate; and

(b)whether the officer was in a position to influence the conduct of the body corporate in relation to the commission of the offence; and

(c)any other relevant matter.

10.Publication of approvals

(1)If the Minister approves information under paragraph (c) of the definition of relevant information in section 3, the Minister must ensure that the instrument by which the approval is given is published on the Department’s website.

(2)If the CEO approves a manner of destruction of entry registration records under section 8(8)(a), the CEO must ensure that the instrument by which the approval is given is published on the Department’s website.

(3)A failure to comply with subsection (1) or (2) does not affect the validity of an approval.

11.Transitional provisions

(1)This Act applies, on and after commencement day, to entry registration information obtained at any time on or after 5 December 2020.

(2)However, section 6(1) to (3) do not apply to entry registration information disclosed before commencement day in compliance with an order to produce under the Criminal Investigation Act 2006 Part 6, to the extent necessary for the information to be used, disclosed or admitted in evidence for the purposes for which the order was obtained or for related purposes.

(3)If the initial storage period for an entry registration record begins before commencement day, section 8 applies in relation to the record as if the initial storage period for the record begins on commencement day.

12.Regulations

The Governor may make regulations prescribing all matters that are required or permitted by this Act to be prescribed, or are necessary or convenient to be prescribed for giving effect to the purposes of this Act.

 

Notes

This is a compilation of the Protection of Information (Entry Registration Information Relating to COVID-19 and Other Infectious Diseases) Act 2021. For provisions that have come into operation see the compilation table.

Compilation table

Short title

Number and year

Assent

Commencement

Protection of Information (Entry Registration Information Relating to COVID-19 and Other Infectious Diseases) Act 2021

3 of 2020

21 Jun 2021

s. 1 and 2: 21 Jun 2021 (see s. 2(a));

Act other than s. 1 and 2: 22 Jun 2021 (see s. 2(b))

 

 

Defined terms

 

[This is a list of terms defined and the provisions where they are defined. The list is not part of the law.]

Defined termProvision(s)

authorised officer3

CEO3

Chief Health Officer3

commencement day3

contact tracing3

Department’s website3

entry registration information3

entry registration record3

extended period8(3)

Health Department3

infectious disease emergency3

initial storage period3, 8(1)

officer9(1)

prescribed3

records contractor3

relevant information3

responsible person3

serious public health incident powers3

statistical or summary information3

use3