{"id":"protection-of-information-entry-registration-information-relating-to-covid19-and-other-infectious-diseases-act-2021","name":"Protection of Information (Entry Registration Information Relating to COVID-19 and Other Infectious Diseases) Act 2021","slug":"protection-of-information-entry-registration-information-relating-to-covid-19-and-other-infectious-d","collection":"act","jurisdiction":"wa","status":"in_force","isInForce":true,"actNumber":null,"makingDate":null,"administeringDepartment":null,"currentVersion":{"id":106294,"registerId":"wa-protection-of-information-entry-registration-information-relating-to-covid19-and-other-infectious-diseases-act-2021-current","compilationNumber":null,"startDate":"2026-04-03","status":"InForce","reasons":null,"registeredAt":null},"sections":[{"sectionNumber":"1","sectionType":"section","heading":"Protection of Information (Entry Registration Information Relating to COVID-19 and Other Infectious Diseases) Act 2021","content":"![Crest]()Western Australia\n\nProtection of Information (Entry Registration Information Relating to COVID-19 and Other Infectious Diseases) Act 2021\n\nWestern Australia\n\nProtection of Information (Entry Registration Information Relating to COVID-19 and Other Infectious Diseases) Act 2021\n\nContents\n\n1. Short title 2\n\n2. Commencement 2\n\n3. Terms used 2\n\n4. Act binds Crown 5\n\n5. Relationship of this Act to other written laws 5\n\n6. Protection of entry registration information 6\n\n7. Storage of entry registration records 7\n\n8. Destruction of entry registration records 7\n\n9. Liability of officers for offence by body corporate 9\n\n10. Publication of approvals 9\n\n11. Transitional provisions 10\n\n12. Regulations 10\n\nNotes\n\nCompilation table 11\n\nDefined terms\n\n  \n\nWestern Australia\n\nProtection of Information (Entry Registration Information Relating to COVID‑19 and Other Infectious Diseases) Act 2021\n\nAn Act to protect the confidentiality of certain information obtained for the purposes of contact tracing relating to COVID-19 and other infectious diseases.\n\n##### 1. Short title\n\nThis is the *Protection of Information (Entry Registration Information Relating to COVID‑19 and Other Infectious Diseases) Act 2021*.\n\n##### 2. Commencement\n\nThis Act comes into operation as follows —\n\n(a) sections 1 and 2 — on the day on which this Act receives the Royal Assent;\n\n(b) the rest of the Act — on the day after that day.\n\n##### 3. Terms used\n\nIn this Act —\n\nauthorised officer has the meaning given in the *Public Health Act 2016* section 4(1);\n\nCEO means the chief executive officer of the department of the Public Service principally assisting in the administration of this Act;\n\nChief Health Officer has the meaning given in the *Public Health Act 2016* section 4(1);\n\ncommencement day means the day on which section 6 comes into operation;\n\ncontact tracing, in relation to an infectious disease emergency, means the process of identifying, notifying, communicating with, managing and directing —\n\n(a) individuals who —\n\n(i) may be, or may have been, a source of infection; or\n\n(ii) may have been in contact, directly or indirectly, with, or in the proximity of, an individual who may be, or may have been, a source of infection;\n\nor\n\n(b) the parents, guardians or carers of, or other persons who have responsibility for the care of, such individuals;\n\nDepartment’s website means a website maintained by or on behalf of the department of the Public Service principally assisting in the administration of this Act;\n\nentry registration information —\n\n(a) means relevant information about the presence of persons at a place, obtained, on the occasion of their entry to the place, for the purposes of contact tracing in relation to an infectious disease emergency by the use of the mobile application known as “SafeWA”, or some other contact tracing register or system, whether or not obtained under the *Emergency Management Act 2005* or the *Public Health Act 2016*; but\n\n(b) does not include —\n\n(i) such information obtained in the ordinary course of carrying on a business or undertaking if the information would have been obtained in any case for purposes other than contact tracing; or\n\n(ii) statistical or summary information;\n\nentry registration record means any record of entry registration information, including a record in the form of data, text, images or sound;\n\nHealth Department means the department of the Public Service principally assisting in the administration of the *Public Health Act 2016*;\n\ninfectious disease emergency means —\n\n(a) an emergency situation or a state of emergency declared under the *Emergency Management Act 2005* in respect of an emergency relating to a plague or epidemic (as referred to in paragraph (d) of the definition of ***hazard*** in section 3 of that Act); or\n\n(b) a public health state of emergency declared under the *Public Health Act 2016* in respect of a public health emergency relating to an infectious disease; or\n\n(c) a serious public health risk, in respect of an infectious disease, in relation to which an authorised officer is authorised under the *Public Health Act 2016* section 152(1) to exercise serious public health incident powers; or\n\n(d) if a COVID‑19 declaration is made under the *Emergency Management Act 2005* Part 6A (as that Part is in force before the coming into operation of the *Emergency Management Amendment (Temporary COVID‑19 Provisions) Act 2022* section 30) — the occurrence of COVID‑19 in the area to which the declaration applies while the declaration is in force;\n\ninitial storage period, for an entry registration record, has the meaning given in section 8(1);\n\nprescribed means prescribed by regulations made under this Act;\n\nrecords contractor means a person engaged under a contract for services to provide services relating to the storage, maintenance, processing or destruction of entry registration records;\n\nrelevant information means any of the following —\n\n(a) a person’s name and contact details;\n\n(b) details of a person’s presence at a place, including —\n\n(i) the time and date at which the person entered the place; and\n\n(ii) details of any persons accompanying the person;\n\n(c) any other information approved by the Minister for the purposes of this definition;\n\nresponsible person, for an entry registration record, means —\n\n(a) for a record in the possession or control of an agency as defined in the *Public Sector Management Act 1994* section 3(1) — the chief executive officer, as defined in that section, of that agency; or\n\n(b) for a record in the possession or control of a records contractor — the records contractor; or\n\n(c) for any other record — the person in possession or control of the record;\n\nserious public health incident powers has the meaning given in the *Public Health Act 2016* section 4(1);\n\nstatistical or summary information means statistical or summary information that could not reasonably be expected to lead to the identification of an individual;\n\nuse, in relation to information, includes the following —\n\n(a) to possess the information;\n\n(b) to copy the information;\n\n(c) to control the use of the information;\n\n(d) to seize the information;\n\n(e) to require the production of the information.\n\n[Section 3 amended: No. 33 of 2022 s. 17.]\n\n##### 4. Act binds Crown\n\nThis Act binds the Crown in right of Western Australia and, so far as the legislative power of the Parliament permits, the Crown in all its other capacities.\n\n##### 5. Relationship of this Act to other written laws\n\n(1) This Act has effect despite the *Freedom of Information Act 1992* and the *State Records Act 2000*.\n\n(2) To the extent that there is an inconsistency between a provision of this Act and a provision of the *Criminal Investigation Act 2006*, the *Emergency Management Act 2005*, the *Public Health Act 2016* or any other written law, the provision of this Act prevails.\n\n##### 6. Protection of entry registration information\n\n(1) Entry registration information cannot be used or disclosed for any purpose other than —\n\n(a) contact tracing; or\n\n(b) purposes related to contact tracing, including (without limitation) —\n\n(i) purposes necessary for the support and efficacy of contact tracing; and\n\n(ii) purposes necessary for the integrity and security of entry registration information;\n\nor\n\n(c) a purpose in subsection (4) or (5).\n\n(2) Without limiting subsection (1), entry registration information is not admissible in evidence in any criminal or civil proceedings other than proceedings in relation to an offence referred to in subsection (4).\n\n(3) A person who uses or discloses entry registration information contrary to subsection (1) commits a crime.\n\nPenalty for this subsection:\n\n(a) for an individual, imprisonment for 3 years;\n\n(b) for a body corporate, a fine of $250 000.\n\nSummary conviction penalty for this subsection:\n\n(a) for an individual, imprisonment for 12 months and a fine of $20 000;\n\n(b) for a body corporate, a fine of $100 000.\n\n(4) Entry registration information may be used or disclosed for the purpose of investigating or prosecuting an offence relating to —\n\n(a) compliance with an obligation under the *Emergency Management Act 2005* or the *Public Health Act 2016* to provide or record information for the purpose of contact tracing; or\n\n(b) compliance with an obligation under this Act; or\n\n(c) compliance with an obligation relating to the recording, use or disclosure of entry registration information under *The Criminal Code*, the *Emergency Management Act 2005* or the *Public Health Act 2016*; or\n\n(d) the giving of false or misleading information in compliance or purported compliance with an obligation referred to in paragraph (a).\n\n(5) A public service officer in the Health Department or a records contractor may, with the approval of the Chief Health Officer, use entry registration information for the purpose of deriving statistical or summary information.\n\n(6) The *Freedom of Information Act 1992* Parts 2 and 4 do not apply to statistical or summary information derived under subsection (5).\n\n##### 7. Storage of entry registration records\n\nThe responsible person for an entry registration record must, so far as reasonably practicable, ensure that the record is stored in a secure manner until it is destroyed.\n\nPenalty: imprisonment for 12 months and a fine of $20 000.\n\n##### 8. Destruction of entry registration records\n\n(1) In this section —\n\ninitial storage period, for an entry registration record, means the period of 28 days (or, if a different period is prescribed for the infectious disease emergency, that period) beginning on the day after the day on which the information contained in the record was obtained.\n\n(2) The responsible person for an entry registration record must ensure that it is destroyed, in accordance with subsection (8), as soon as practicable after the expiry of the initial storage period for the record.\n\nPenalty for this subsection: imprisonment for 12 months and a fine of $20 000.\n\n(3) If a responsible person for an entry registration record is required under the *Emergency Management Act 2005* or the *Public Health Act 2016* to retain the record for purposes relating to contact tracing for a specified period (the extended period) that extends beyond the initial storage period, the person —\n\n(a) must retain the record for the extended period; and\n\n(b) must destroy the record, in accordance with subsection (8), as soon as practicable after the end of the extended period.\n\nPenalty for this subsection: imprisonment for 12 months and a fine of $20 000.\n\n(4) Subsection (3) has effect despite subsections (2), (6) and (7).\n\n(5) Subsections (6) and (7) do not apply to a person who is a responsible person solely because of being the occupier or person apparently in charge of a place referred to in paragraph (a) of the definition of ***entry registration information*** in section 3.\n\n(6) A responsible person for an entry registration record is not required to destroy the record if, at the expiry of the initial storage period for the record, the record —\n\n(a) is required for contact tracing; or\n\n(b) is required in the investigation of an offence referred to in section 6(4); or\n\n(c) is, or is required as, evidence in proceedings for or in relation to an offence referred to in section 6(4).\n\n(7) A responsible person for an entry registration record that is not destroyed in accordance with subsection (2) because of the application of subsection (6)(a) must ensure that the record is destroyed, in accordance with subsection (8), as soon as practicable after it ceases to be required for contact tracing.\n\nPenalty for this subsection: imprisonment for 12 months and a fine of $20 000.\n\n(8) An entry registration record must be destroyed either —\n\n(a) in the manner approved by the CEO; or\n\n(b) if no approval under paragraph (a) applies to the record — by taking all reasonable steps to ensure that the entry registration information contained in the record cannot be retrieved.\n\n##### 9. Liability of officers for offence by body corporate\n\n\t\t*The Criminal Code* section 39 (which provides for the criminal liability of officers of a body corporate) applies to an offence under a provision of this Act listed in the Table.\n\nTable\n\n| s. 6(3) | s. 7 |\n| --- | --- |\n| s. 8(2), (3) and (7) |  |\n\n\n[Section 9 inserted: No. 9 of 2023 s. 124.]\n\n##### 10. Publication of approvals\n\n(1) If the Minister approves information under paragraph (c) of the definition of ***relevant information*** in section 3, the Minister must ensure that the instrument by which the approval is given is published on the Department’s website.\n\n(2) If the CEO approves a manner of destruction of entry registration records under section 8(8)(a), the CEO must ensure that the instrument by which the approval is given is published on the Department’s website.\n\n(3) A failure to comply with subsection (1) or (2) does not affect the validity of an approval.\n\n##### 11. Transitional provisions\n\n(1) This Act applies, on and after commencement day, to entry registration information obtained at any time on or after 5 December 2020.\n\n(2) However, section 6(1) to (3) do not apply to entry registration information disclosed before commencement day in compliance with an order to produce under the *Criminal Investigation Act 2006* Part 6, to the extent necessary for the information to be used, disclosed or admitted in evidence for the purposes for which the order was obtained or for related purposes.\n\n(3) If the initial storage period for an entry registration record begins before commencement day, section 8 applies in relation to the record as if the initial storage period for the record begins on commencement day.\n\n##### 12. Regulations\n\nThe Governor may make regulations prescribing all matters that are required or permitted by this Act to be prescribed, or are necessary or convenient to be prescribed for giving effect to the purposes of this Act.\n\n![]()\n\nNotes\n\nThis is a compilation of the *Protection of Information (Entry Registration Information Relating to COVID-19 and Other Infectious Diseases) Act 2021* and includes amendments made by other written laws. For provisions that have come into operation see the compilation table.\n\nCompilation table\n\n| **Short title** | **Number and year** | **Assent** | **Commencement** |\n| --- | --- | --- | --- |\n| *Protection of Information (Entry Registration Information Relating to COVID-19 and Other Infectious Diseases) Act 2021* | 3 of 2020 | 21 Jun 2021 | s. 1 and 2: 21 Jun 2021 (see s. 2(a));<br>Act other than s. 1 and 2: 22 Jun 2021 (see s. 2(b)) |\n| *Emergency Management Amendment (Temporary COVID‑19 Provisions) Act 2022* Pt. 2 Div. 2 Subdiv. 4 | 33 of 2022 | 21 Oct 2022 | 3 Nov 2022 (see s. 2(b) and SL 2022/175 cl. 2) |\n| *Directors’ Liability Reform Act 2023* Pt. 3 Div. 50 | 9 of 2023 | 4 Apr 2023 | 5 Apr 2023 (see s. 2(j)) |\n\n\nDefined terms\n\n*[This is a list of terms defined and the provisions where they are defined. The list is not part of the law.]*\n\n**Defined term Provision(s)**\n\nauthorised officer 3\n\nCEO 3\n\nChief Health Officer 3\n\ncommencement day 3\n\ncontact tracing 3\n\nDepartment’s website 3\n\nentry registration information 3\n\nentry registration record 3\n\nextended period 8(3)\n\nHealth Department 3\n\ninfectious disease emergency 3\n\ninitial storage period 3, 8(1)\n\nprescribed 3\n\nrecords contractor 3\n\nrelevant information 3\n\nresponsible person 3\n\nserious public health incident powers 3\n\nstatistical or summary information 3\n\nuse 3\n","sortOrder":0}],"analysis":{"summary":{"complexity_score":3,"scope_assessment":{"changed":true,"description":"The title references both 'COVID-19 and Other Infectious Diseases', suggesting the Act's scope was broadened — either from inception or through amendment — beyond the immediate COVID-19 pandemic context to cover future infectious disease events. This indicates a deliberate policy expansion from a narrow emergency measure to a more durable legislative framework. However, this inference is based solely on the Act's title, as the full text was unavailable for analysis."},"complexity_factors":["Insufficient legislative text available to assess true complexity","Based on title only: likely involves interaction between privacy law, public health law, and data protection frameworks","May include exceptions and carve-outs for authorised disclosures that could add nuance","Jurisdictional interaction with Commonwealth privacy legislation possible","Scope may have evolved from COVID-19 specific to broader infectious disease coverage, suggesting potential amendment complexity"],"plain_english_summary":"The Act protects personal information collected via COVID‑19 check‑in systems (e.g., QR registrations) by restricting who may access or use that data. It primarily affects people who used venue check‑ins and aims to prevent their location/contact records—collected for public‑health tracing—from being repurposed by police or other agencies for unrelated investigations."},"issue_detection":{"absurdities":[],"contradictions":[]},"kimi_summary":{"content_quality":"ok","complexity_score":4,"scope_assessment":{"changed":false,"description":"The legislation remains tightly focused on its original purpose: protecting contact tracing information collected during infectious disease emergencies. While amendments have refined definitions (particularly around COVID-19 declarations and corporate officer liability), these are technical adjustments rather than scope expansion. The Act has not grown beyond its core mission of safeguarding entry registration data."},"complexity_factors":["17 defined terms in section 3, several of which incorporate definitions from other Acts (Public Health Act 2016, Emergency Management Act 2005)","Nested exceptions to the main prohibition: general ban on use/disclosure → exception for contact tracing → sub-exceptions for related purposes → further exceptions for specific offences in s.6(4)","Complex destruction timeline with multiple conditional branches: standard 28-day period vs prescribed period, extended retention for active tracing vs investigation vs evidence, and carve-out for occupiers in s.8(5)","Overrides relationship with other statutes (s.5) requiring readers to understand interactions with Freedom of Information Act 1992, State Records Act 2000, Criminal Investigation Act 2006, Emergency Management Act 2005, and Public Health Act 2016","Transitional provisions (s.11) creating retrospective application to December 2020 with specific carve-outs for pre-commencement disclosures","Amendment history showing evolution (SafeWA references, COVID-19 declaration definitions, and officer liability provisions added post-enactment)"],"plain_english_summary":"This Western Australian law protects the privacy of people who checked in to venues using the SafeWA app or similar COVID-19 contact tracing systems.\n\n**What it does:**\n- **Locks down your check-in data**: Information collected for contact tracing (like your name, phone number, and when you visited a café or shop) can only be used for contact tracing purposes. It cannot be used for marketing, sold to businesses, or accessed by police for general investigations.\n- **Bans using the data in court**: Check-in information generally cannot be used as evidence in criminal or civil court cases, with one narrow exception (if someone lies about checking in or breaks the rules around collecting this data).\n- **Forces deletion of records**: Businesses and government agencies must destroy check-in records after 28 days (or a longer period if prescribed), unless the data is still needed for an active contact tracing investigation or a prosecution about false check-in information.\n- **Makes misuse a crime**: Using or disclosing this information illegally can result in up to 3 years in prison for individuals, or a $250,000 fine for companies.\n\n**Who it affects:**\n- Anyone who used the SafeWA app or similar check-in systems in WA\n- Businesses that collected check-in information\n- Government agencies storing this data\n- Police and courts (limiting their access)\n\n**Why it matters:**\nDuring the pandemic, people were required to hand over personal information to help stop disease spread. This law ensures that information stays strictly confined to public health purposes and doesn't become a tool for law enforcement, commercial exploitation, or permanent government surveillance. It overrides other laws like Freedom of Information and State Records laws to ensure this privacy protection is absolute."},"flash_summary_failed":{"failed":true,"reason":"Unauthenticated. Configure AI_GATEWAY_API_KEY or use a provider module. Learn more: https://ai-sdk.dev/unauthenticated-ai-gateway","source":"analysis-cron"},"flash_summary":{"complexity_score":6,"scope_assessment":{"changed":true,"description":"The Act’s scope has been altered by later amendments identified in the compilation table and bracket notes. Section 3 was amended (noted as amended by No. 33 of 2022 s. 17) which affects defined terms underpinning the Act’s coverage, and section 9 (liability of officers under The Criminal Code for listed offences) was inserted by No. 9 of 2023 s. 124. Those changes extend and clarify definitional coverage and impose officer liability for offences under ss.6(3), 7 and 8(2),(3),(7), thereby changing enforcement reach and compliance obligations. The Act likewise applies to entry registration information obtained from 5 December 2020 by its transitional provision (s.11(1))."},"complexity_factors":["Extensive defined terminology and cross‑references to other Acts (Public Health Act 2016, Emergency Management Act 2005, Criminal Investigation Act 2006, Freedom of Information Act 1992, State Records Act 2000) (see s.3, s.5).","Criminal offence regime with higher penalties for bodies corporate and summary/indictable alternatives (use/disclosure offence in s.6(3); penalties in s.6(3) and s.7, s.8).","Specific, conditional retention and destruction rules with an ‘initial storage period’ and exceptions where other laws or operational needs create extended retention (s.8(1)–(8)).","Multiple decision points held by different officials: Chief Health Officer may approve statistical use (s.6(5)); CEO may approve destruction methods (s.8(8)(a)); Minister may approve additional ‘relevant information’ items (s.3 definition and s.10).","Obligations allocated to a range of actors — agencies, records contractors and private occupiers — with differing duties and penalties depending on which class of responsible person holds the record (definition of responsible person, s.3; duties in ss.7–8).","Restriction on admissibility of entry registration information in evidence except for specified offences (s.6(2)–(4)) adds legal‑evidentiary nuance for investigations and prosecutions.","Publication and transparency obligations for approvals but non‑invalidity clause (s.10) — procedural layer with compliance risk if publication omitted.","Transitional and retrospective application elements (applies to information obtained from 5 Dec 2020; transitional rules in s.11) increasing temporal scope and implementation complexity."],"plain_english_summary":"This Act confines entry‑registration data collected for contact tracing (including SafeWA and similar systems) to contact‑tracing purposes, requires secure storage, sets a default retention period (28 days unless a longer period is prescribed or required by other public‑health or emergency laws), mandates approved destruction methods, and creates criminal penalties for misuse.\n\nIt affects businesses, records contractors, public agencies and individuals who hold entry lists — they bear compliance costs and criminal risk; the Chief Health Officer and the CEO have approval powers that shape permitted uses and approved destruction methods."}},"importantCases":[],"_links":{"self":"/api/acts/protection-of-information-entry-registration-information-relating-to-covid-19-and-other-infectious-d","history":"/api/acts/protection-of-information-entry-registration-information-relating-to-covid-19-and-other-infectious-d/history","analysis":"/api/acts/protection-of-information-entry-registration-information-relating-to-covid-19-and-other-infectious-d/analysis","conflicts":"/api/acts/protection-of-information-entry-registration-information-relating-to-covid-19-and-other-infectious-d/conflicts","importantCases":"/api/acts/protection-of-information-entry-registration-information-relating-to-covid-19-and-other-infectious-d/important-cases","documents":"/api/acts/protection-of-information-entry-registration-information-relating-to-covid-19-and-other-infectious-d/documents"}}