Advice to sport and recreation providers on Mandatory Reporting
This advice provides guidance to providers about their responsibilities to retain certain information from people participating in their activities to assist the Ministry of Health if contact tracing is required.
Businesses are required to display a NZ COVID Tracer QR code and have an alternative way people can record their visit.
At Alert Levels 2, 3 and 4, most businesses that are open must have systems and processes in place to ensure, as far as is reasonably practicable, that everyone aged 12 years or older who enters their workplace either:
- scans the NZ COVID Tracer QR code
- makes some other kind of personal contact record (e.g. a diary note), or
- provides their name and phone number to business, alongside the date and time they were present.
This means more than just displaying the QR code and having a sign in sheet. It requires the person in charge of the business or service to have systems and processes in place to ensure that people do check in.
At Alert Level 2, the contact record rule applies to visitors to listed businesses and services where there is likely to be close contact between workers and visitors, or between visitors who do not know each other. It does not apply to retail businesses, including supermarkets, dairies and banks.
It does not apply to the workers in those businesses or services, but we recommend you keep track of when your workers are present and what locations they work at.
This rule applies from 11.59pm on Tuesday 14 September.
Changes to mandatory record keeping and QR code scanning
Under Alert Levels 3 and 2, more businesses and locations are required to have processes in place to enable people to scan in using the COVID-19 tracer app, or manually record their visit.
Displaying QR codes for scanning is a legal requirement under the COVID-19 Public Health Response (Alert Level Requirements) Order (No 10) 2021. This means you need to display a QR code and have one alternate form of record-keeping for people who do not use the COVID Tracer App.
Mandatory record keeping will help ensure that any close-contact businesses and locations which are allowed to be open, and which are at higher-risk of transmission of COVID-19 occurring when there are cases in the community, have good systems in place enable people to record their visit. Good record keeping supports faster communication with those who are identified as contacts of a positive case.
Requirements come into effect 7 days after a change in Alert Level. Requirements applying to businesses able to operate under Alert Level 3 came into effect at 11.59 pm on 7 September 2021.
Requirements applying to businesses able to operate under Alert Level 2 come into effect from 11.59pm on Tuesday 14 September.
How is this different from current settings?
At Alert Level 2, the contact record rule applies to visitors to listed businesses and services where there is likely to be close contact between workers and visitors, or between visitors who do not know each other.
It does not apply to the workers in those businesses or services, but it is recommended you keep track of when your workers are present and what locations they work at.
This expands on the Alert Level 3 record keeping requirements that applied only to those businesses that could operate at that Alert Level.
What does this mean for the sport and recreation sector?
For the sport and recreation sector, this will apply to:
• Indoor facilities where sport and recreation occur e.g. recreation centres, swimming pools
• Indoor exercise facilities e.g. gyms, yoga studios
• Sport and recreation clubrooms
• Commercial and ticketed sport and recreation events
In all other places where people gather, it is encouraged but not mandatory to provide record keeping. For example, changing rooms.
If you are in doubt, it is recommended you provide record keeping.
Resources for businesses and organisations
There are new resources including posters and three new ‘record keeping box’ templates in different sizes, and new record keeping slips and a sticker for custom boxes. They can be found here.
What do you need to do to be compliant with the requirement?
You will be responsible having systems and processes in place to enable, so far as is reasonably practicable, people scan in using the COVID-19 tracer app, or manually record their visit.
What is reasonably practicable will differ between businesses. Workplaces (and public transport services) will continue to be required by law to display QR codes. Alternative systems to make a record will also now be required where record keeping is mandatory. For example, a manual register for those who are not able to scan and/or your business or service’s booking system.
What does it mean for someone to ‘record a visit’?
This can be done by scanning QR codes with the COVID-19 tracer app or making a manual record, either by providing details using the method available when at a business or location which may including writing your details down. You also can keep your manual record of where you have been and when, either in the COVID-19 Tracer App or by keeping a list elsewhere.
Ideally you would keep a digital copy of this list to ensure you have a backup. If your business/location has controlled access or booking systems that meet the record-keeping requirements, that will also be sufficient.
For businesses it means having the processes in place to ensure people can easily scan QR code posters or make a manual record or their visit.
What is the best way to record visits?
Using the COVID-19 tracer app is best. This is particularly valuable for when contact tracing needs to occur as it provides accurate locations and timings for visits and helps speed up contact tracing efforts. Remember from now on, scan in wherever you go out and about. Before you walk through the door, don’t forget to scan in. It’s a simple action that could make a huge difference.
What are the best alternative sign-in systems?
There is no one right method of collecting for those who cannot use the COVID-19 tracer app, but some possible methods include:
- Setting up a ballot box with individual paper slips or cards for people to fill in their name, phone number, date and time of visit.
- Having an employee manually record visitor details – this ensures that staff maintain control over the records and do not leave contact information is not visible to others.
- Consider an electronic system, like a tablet sign-in app, work timesheet or an existing booking system.
- Using a work cell phone to receive texts from customers. Simply publicise the cell phone number around the entrance to your service or business and let customers text you their name.
Do not use a paper-based register if it is left in a public-facing position where personal information is visible to others. This is a leading cause of COVID-related privacy breaches.
What constitutes acceptable record keeping?
Displaying your business or services’ unique QR Code in a visible and accessible position for staff and visitors to scan.
To meet the requirement, you must collect the name of the person, the time they were there and a phone number to contact them. If your existing systems do this then you’re ok, but if not, you need to collect it.
How long do I have to keep the records for?
60 days. When this time elapses, you must securely destroy the physical records (i.e., manual sign-in records) and electronic records if alternative methods were used like a tablet or a 'burner phone' which individuals text into. If you ordinarily use electronic sign-in as part of your business, e.g., you operate a gym, secure deletion is not required for the purposes of this order.
What if a person refuses?
There will be no expectation or requirement for a person responsible for the place or gathering to enforce non-compliance with record keeping requirements. The obligation on businesses is to have systems and processes in place to ensure (as far as reasonably practicable) so that customers or visitors make a record.
Businesses will not be required or expected to turn people away who may refuse to make a record of their visit, particularly if the person becomes aggressive or abusive. This will be at the discretion of the business.
Who is responsible for ensuring people are record keeping?
Mandatory reporting applies to listed businesses and services where there is likely to be close contact between workers and visitors, or between visitors who do not know each other. The business owner or service provider is responsible.
Sport and recreation providers often use indoor space or services ‘owned’ by others. Where this occurs, responsibility for mandatory reporting requires a common-sense and collaborative approach and may vary case-by-case.
Example 1 - A swimming club hosts its club championships at the local Council owned Swimming Pool.
In this case, the Council will be responsible for mandatory reporting for all users of its swimming pool, including the swimming club running its event. It would be helpful for the club to assist the pool operators to ensure all its participants sign-in and follow the rules the Council has put in place.
Example 2 – a table-tennis club is running its weekly table-tennis club day at the local school hall.
In this case, the table-tennis club will be responsible for mandatory reporting for all its participating club members. This will include fulfilling all requirements of acceptable record keeping (as above).
What should I tell users about privacy?
Use a simple privacy statement alongside your alternative record keeping system to let people know why the information is needed and how long you need it for. See the Office of the Privacy Commissioner's advice on Covid tracing at www.privacy.org.nz for an example.
How do I keep the sign-in records secure?
Customers should not be able to view the details of others who have signed into the business or service. Physical records should be stored securely in a place where only those that may need access can access them.
If you accidentally lose physical or electronic sign in records and they cannot be recovered, use the NotifyUs tool on the Officer of the Privacy Commissioner's website: https://privacy.org.nz/responsibilities/privacy-breaches/notify-us/.
What record keeping enforcement will be in place?
If a person responsible for a business or location has failed to meet record keeping requirements, they are committing an infringement offence and will liable to an infringement fee of $300 or court imposed fine not exceeding $1,000.
Failing to display a QR code will continue to be an infringement offence carrying an infringement fee of $300 or court imposed fine not exceeding $1,000.