COVID, confidentiality and the CLCs

As we creep furtively out of lockdown towards whatever the new normal is going to be, not all restrictions will be relaxed at once (and some may never be lifted).

Given the second waves now plaguing Victoria and New South Wales, this caution is a good thing.

That said, there are implications for lawyers and law firms – and community legal centres (CLCs), which have perhaps not been at the forefront of people’s minds during this process. Like law firms, CLCs provide essential services; unlike law firms, they usually do so from someone else’s premises.

Given that one of the COVID restrictions which will likely be with us beyond the end of the year is contract tracing, this may create issues around confidentiality.

Restrictions on Businesses, Activities and Undertakings Direction (No.5), effective from 24 July 2020, covers off on the issue of contract tracing via the provisions of item nine of that directive:

“A person who owns, controls or operates a restricted business, activity or undertaking must keep contact information about all guests and staff for contact tracing purposes for a period of 56 days, unless otherwise specified. This information must include: name, phone number, email address, and the date and time period of patronage. If requested, this information must be provided to public health officers. The information should be securely stored, not used for any other purpose and deleted after 56 days.”


Restricted businesses, activities or undertakings include, “Community facilities (such as community centres and halls, recreation centres, youth centres, community clubs, RSLs, PCYCs)”. While the work of CLCs is not specifically mentioned, and the provision of legal services remains an essential service, the majority of CLCs work from community centres and similar places.

It is likely that such places will be expected to collect information about visitors (including clients of CLCs) and keep that information for the purposes of contract tracing. That obligation will probably be passed on to the CLC, but the provision of this information is in conflict with the duty of confidentiality to which CLCs and their volunteers are subject.

This duty is embodied in Rule 9 of theAustralian Solicitors Conduct Rules 2012, which also lists a number of permitted exceptions to the duty. In order to pass on the information as per the directive, CLCs and their solicitors will need to turn their minds to those permitted exceptions. Specifically, they will need to consider whether the health directive constitutes a legal permission or compulsion to breach client confidentiality, or if breaching confidentiality is necessary to prevent imminent physical harm.

If the directive can be described as a permission or a compulsion (or justified on prevention of imminent harm), clients will have no say in whether or not the information is provided, but a grey area remains in that the directive is to provide this information to public health officers, if requested (not to landlords). In any event, given that some clients can be put at risk of extreme physical violence simply by attending a CLC, there will be a justifiable reluctance to share it.

In the circumstances, CLCs will need to turn their minds to this issue urgently, and resolve a way forward; establishing what obligations the directive places upon them is a good first step. Issues to be considered in this regard include:

1. Does the CLC own or lease the premises?

The directive obliges the “owner, controller or operator” to collect the information. A CLC which owns or leases its premises likely has the obligation to collect the information itself, and need not pass the information on to anyone other than public health officers (should they request it).


2. Does the CLC operate by licence/unofficial tenancy/handshake deal?

Informal arrangements underpin many CLCs, often in relation to premises which are ultimately owned by a council or other public entity. In those circumstances the obligation to collect and hand over the information will probably rest with the council/owner of the premises.

CLCs in these circumstances should investigate an arrangement with their landlords which allows the CLC to collect and control the information, with an obligation that they hand over the information to public health officers if required.

If that is not possible, getting written confirmation from the landlords as to how the information is to be secured, monitored and destroyed at the end of the period is advisable.

3. Consent is a must

Regardless of how the information is ultimately collected and stored (and by whom) consent of the CLC clients is essential. Prior to any information being collected, the client must be advised of the need to collect the information, and be given the opportunity to refrain from entering the premises in question and not be recorded.

Share this article

Leave a Reply

Your email address will not be published. Required fields are marked *

Search by keyword