Pubs and restaurants need to collect much more data after Track and Trace update

As has been the case in almost every aspect of our response to COVID-19, as the science has evolved and our experience has developed, so government requirements and guidance have changed. This has led to certain businesses in Scotland being obliged to collect contact information about visitors to their premises.

Since 14 August, it has been a legal requirement for hospitality businesses – essentially pubs, restaurants, cafes and hotels that sell for food or drink – to “gather, record and retain minimal contact information from non-takeaway customers, visitors and staff”.

Relevant businesses are required to collect contact information for every household that visits their premises. Businesses must have a system in place to collect “visitor information”, including: the name and telephone number of one member of each household visiting the premises, the date of their visit and arrival time, and a note of the number of any members of that person’s household visiting the premises at the same time.

The guidance also recommends taking a note of the departure time, if possible.

Businesses offering on-site and takeaway services need only take contact information for on-site services. They must also be able to demonstrate they are recording “visitor information in a filing system suitable for recording, storing and retrieving such information” and that it is retained for 21 days from the date of the visit, no longer.

The Scottish Government has provided a style privacy notice that can be displayed on the premises and/or website giving details as to why information will be collected and how it will be used.

It also provides advice to visitors on their rights in relation to that data and how to complain to the Information Commissioner’s Office (ICO), if appropriate. It may be necessary for the business to register with the ICO as a data controller if it has not already done so.

Businesses should keep track and trace information separate from marketing lists and only use it for contact tracing purposes. They will need to make sure their privacy notices explain both uses of the data and how they are kept separate.

The guidance also recommends the data should be collected by a designated individual on the premises to avoid customers seeing the contact information of others and, on a practical level, to avoid many people handling the paperwork or sharing a pen.

Visitor information held by a premises may be requested by a public health officer and must be provided when requested as soon as reasonably practicable (within 24 hours at most). If there is a need to use the visitor information, then NHS Scotland officials from NHS Test and Protect will make contact.

Certain information also needs to be kept about staff – names and contact information and details of who was working when. In bigger premises, details should be kept of the area in which staff were working, such as the tables they served.

An individual cannot be required to provide their contact information. However, the guidance explains: “If the individual still does not want to share their details then premises should refuse to offer the service requested. Employers should make clear to their employees the approach that they wish them to take in these circumstances.”

Failure to comply with the new regulations carries criminal consequences; the company, officers and staff operating the premises could be open to potential criminal proceedings. Licensed premises could also have their licence reviewed (and revoked) by the Licensing Board at a review hearing in due course.

Joanna Boag-Thomson is a Partner in Shepherd and Wedderburn’s media and technology team.

Source link

Leave a comment