emergency management (information security) amendment bill 2021

(c) any other electronic platform approved by the State Co-ordinator for the purpose of capturing relevant contact details of a person entering a place, including (where applicable) the use of a dedicated code provided by or on behalf of the State Government;

contact tracing means the process of identifying persons who have been in contact with a person who has tested positive for COVID-19, and includes—

(a) notifying a person that the person has been in contact with a person who has tested positive for COVID-19; or

(b) notifying a person who is a parent, guardian or carer of another person that the other person has been in contact with a person who has tested positive for COVID-19; or

(i) has tested positive for COVID-19; or

(ii) is a parent, guardian or carer of another person who has tested positive for COVID-19; or

(iii) has been in contact with a person who has tested positive for COVID-19; or

(iv) is a parent, guardian or carer of another person who has been in contact with a person who has tested positive for COVID-19;

COVID-19 contact tracing data means—

(a) the relevant contact details of a person captured or provided in the course of using an approved contact tracing system; or

(b) the relevant contact details of a person contained in a written contract tracing record; or

relevant contact details, in relation to a person, means the person's name and telephone number;

written contact tracing record means a written record (however described) of the relevant contact details of a person entering a particular place.

31C—Application of Part

This Part applies to, and in relation to, COVID-19 contact tracing data obtained pursuant to, or in the course of complying with, a direction under section 25 relating to the COVID-19 pandemic (including, to avoid doubt, a direction under that section as modified from time to time by or under the COVID-19 Emergency Response Act 2020

31D—Unauthorised collection, use or disclosure of COVID-19 contact tracing data

(1) A person who collects, uses or discloses COVID-19 contact tracing data without being authorised to do so under this section is guilty of an offence.

Maximum penalty: Imprisonment for 5 years.

(2) The collection, use or disclosure of COVID-19 contact tracing data by a person is only authorised if—

(a) the person is employed by, or is lawfully acting on behalf of, the State or Commonwealth government and the collection, use or disclosure is for the purpose of, and only to the extent required for the purpose of, undertaking contact tracing; or

(b) the collection or disclosure is for the purpose of, and only to the extent required for the purpose of, administering or maintaining an approved contact tracing system; or

(c) the collection, use or disclosure is for the purpose of, and only to the extent required for the purpose of, the State Co-ordinator performing functions or exercising powers under this Act in relation to the COVID-19 pandemic; or

(d) the collection, use or disclosure is for the purpose of, and only to the extent required for the purpose of—

(i) investigating whether this Act has been contravened; or

(ii) prosecuting a person for an offence against this Act; or

(e) the collection, use or disclosure is otherwise authorised or required under a law of the State or the Commonwealth, or a direction under this Act; or

(f) the collection, use or disclosure occurs in any other circumstances prescribed by the regulations.

(3) In proceedings for an offence against this section, it is a defence for the defendant to prove that the defendant did not know, and could not reasonably have been expected to know, that data to which the offence relates was COVID-19 contact tracing data.

(4) Nothing in this section authorises the collection, use or disclosure of COVID-19 contact tracing data after the expiry of all relevant declarations relating to the COVID-19 pandemic under Part 4 Division 3 of this Act or section 87 of the South Australian Public Health Act 2011

31E—COVID-19 contact tracing data to be destroyed within prescribed period

(1) Subject to this section, the prescribed person in respect of COVID-19 contact tracing data must take reasonable steps to ensure that the COVID-19 contact tracing data, and any written contact tracing record in the possession of the prescribed person, is deleted or destroyed within the prescribed period.

Maximum penalty: $10 000.

(2) In proceedings for an offence against this section, it is a defence for the defendant to prove that the defendant did not know, and could not reasonably have been expected to know, that data to which the offence relates was COVID-19 contact tracing data.

(3) For the purposes of this section, a prescribed person will be taken to receive COVID-19 contact tracing data—

(a) in the case of COVID-19 contact tracing data captured or provided in the course of using an approved contact tracing system—at the point at which a person uploads their relevant contact details using the system; or

(b) in the case of COVID-19 contact tracing data contained in a written contract tracing record relating to a single day—at the point at which a person entering the relevant place completes the written contact tracing record; or

(c) in the case of COVID-19 contact tracing data contained in a written contract tracing record relating to more than 1 day—at the point at which the last person entering the relevant place and completing the written contact tracing record does so,

and a reference to a person being in possession of COVID-19 contact tracing data is to be construed accordingly.

(4) For the purposes of this section, a reference to COVID-19 contact tracing data captured or provided in the course of using an approved contact tracing system, or contained in a written contract tracing record, will be taken to include a reference to any part of the data and any copy of the data.

(5) In this section—

prescribed person, in respect of COVID-19 contact tracing data, means—

(a) in the case of COVID-19 contact tracing data captured or provided in the course of using an approved contact tracing system, or contained in a written contract tracing record that has been provided to an administrative unit of the Public Service—the Chief Executive of the Department of the Premier and Cabinet; or

(b) in the case of COVID-19 contact tracing data contained in a written contract tracing record that has been provided to SA Police, or any other COVID-19 contact tracing data provided to SA Police—the Commissioner of Police; or

(c) in the case of COVID-19 contact tracing data contained in a written contract tracing record in respect of a particular place that is in the possession of the responsible person for the place—the responsible person,

and, if COVID-19 contact tracing data is in the possession of more than 1 body or person referred to in a preceding paragraph at the commencement of the prescribed period in respect of the data, each such person will be taken to be a prescribed person in respect of the data;

prescribed period, in respect of particular COVID-19 contact tracing data, means the period of 7 days commencing 28 days after the day on which data is received;

responsible person for a place means—

(a) in the case of a place that is required to have a COVID Safe Plan—the person who is, pursuant to a direction made under this Act, responsible for completing the COVID Safe Plan; or

(b) in the case of any other place at which written contact tracing records are collected or kept—the person with care, control and management of the place.

4—Amendment of section 32A—COVID-19—Crown immunity

Section 32A—after its present contents (now to be designated as subsection (1)) insert:

(2) However, subsection (1) does not apply to, or in relation to, the operation of Part 5A.

[Index] [Search] [Download] [Help]