Covid-19 Location Tracking: Collection and Management of Information for Covid-19 Contact Tracing

To support Public Health with contact tracing in the event of an outbreak of COVID-19, the University is required to collect certain information of persons entering UNB buildings and attending gatherings and events 

The information provided below:

  • Is intended to support units and employees in understanding their responsibilities related to the collection and management of data in a way that protects the personal information and privacy of UNB community members, and
  • Follows guidance provided by New Brunswick Public Health and the Ombud NB's Office (Access to Information & Privacy Division)

Purpose for collecting information

The University is collecting information such as name, phone number and date/time of entry/exit to buildings, venues and events for the purposes of supporting Public Health with contact tracing in the event of an outbreak of COVID-19. The information collected will not be used for any other purpose. The University is permitted to collect the information under the Mandatory Order (COVID-19) issued by the Minister of Public Safety under the Emergency Measures Act. 

Method of Collection

Different methods for collecting information will occur depending on the individual’s affiliation with the University and the type of visit to campus. 

  • Employees (FR) - Dates and time of entry to buildings will be collected by completing an online form via scanning a QR code which is posted at the entry to the building. Some employees may keep journals of entry to buildings on campus. 
  • Employees (SJ) - Date and time of entry to building is collected by card access to buildings. Some employees may keep journals of entry to buildings on campus. 
  • Students – Attendance will be taken at class and students can reserve bookable spaces; these records will assist with contact tracing. 
  • Gatherings and events – The event host or organizer is required keep a log of names and phone numbers of those in attendance; this can be done either electronically or by paper. 

Limiting Collection

The amount of information collected is limited only to first and last name and phone number of one person per group/party. An email address is only to be collected if no phone number is available.  

Security and safeguarding

All information collected for the purposes of assisting with COVID-19 contact tracing must be kept secure with appropriate safeguards in place.  

Paper forms must never be left unattended and are to be protected to ensure they are not viewed by the public or any person who does not have the authority to view the information. At the end of each working day, paper collection forms must be stored securely in a locked cabinet or drawer. 

Information collected electronically through the online form / QR code is stored in a secure database managed by ITS.

Retention and Destruction of Information

In accordance with Public Health guidance contact tracing data is to be retained for 21 days after collectionAll contact tracing information is to be deleted on day 22. 

  • Any data held electronically in the central database collected via the QR code / online form is deleted by ITS at day 22 after collection. 
  • If keeping paper records, best practice is to use one collection form per day to assist with filing and destroying paper forms in such a way that forms can easily be destroyed on a 21-day rolling cycle.  
  • Units that have collected contact tracing information via a paper form are to securely destroy forms by placing them in a secure shred bin or in a cross-cut shredder. If a unit is not subscribed to UNB’s shredding service they can contact the Records Management & Privacy Office at rtippa@unb.ca to register for secure shredding.  
  • destruction log must be used to track the destruction of the information. Destruction logs are to be retained for 12 months and then securely destroyed.

Access to the data

Access to any information collected for COVID-19 contact tracing is on a need-to-know basis (i.e. limited to those employees who require access to the information to fulfill the purpose of collection). 

Units or event organizers collecting information via a paper collection form should designate an employee (plus a back-up) who will have access to the paper form. This individual will be responsible for securely collecting, storing, and destructing the information. 

Access to data collected electronically via the electronic form / QR code is limited only to the Chair, UNB Health Response Team and the Manager of Environmental Health and Safety, along with an ITS employee(s) who assists with technical requirements and maintenance. 

Restricted use and disclosure

Upon request from a N.B Medical Officer of Health or a Public Health Inspector, the University will provide names and phone numbers to Public Health for the day or days for which they are requesting information. The information will not be disclosed to any other parties unless required by court order, law enforcement purposes, warrant or subpoena.  

UNB has designated the following employees responsible for releasing the information to Public Health: Chair, UNB Health Response Team and the Manager of Environmental Health and Safety; no other employees shall release the information to Public Health.  

Roles and Responsibilities

Unit heads are responsible for:

  • Designating an individual(s) within the unit who is responsible for data management practices (collection, storage, retention and destruction) related to the collection of contact information for COVID-19 contact tracing. 
  • Implementing this guidance and ensuring best practices are adhered to. 

Employees designated with data management duties related to COVID-19 contact tracing and collection of information are responsible for: 

  • Ensuring best practices outlined in this guidance are implemented. 
  • Ensuring adequate security measures are in place to safeguard any information. 
  • Ensuring retention and destruction practices are implemented, ensuring information is not held longer than necessary, and is securely destroyed within the specified timeframe. 

The Records Management & Privacy Office is responsible for:

  • Providing guidance on privacy and records retention practices. 
  • Updating this guidance with the latest guidance from Public Health and the Ombud NB Office (Access to Information & Privacy Division). 

Information Technology Services is responsible for:

  • Developing, updating, and maintaining the electronic collection form and ensuring secure storage of the electronic data. 
  • Securely destroying the electronic data in accordance with University retention schedules. 
  • Maintaining a destruction log for each electronic data set securely deleted. 

The Chair, UNB Health Response Team and Manager of Environmental Health and Safety are responsible for: 

  • Disclosing contact information to Public Health.

Forms

Questions

Contact the Records Management & Privacy Office with any questions about privacy or records management related to the collection of information for COVID-19 contact tracing.