News Feed

The Prime Minister yesterday announced further relaxation of lockdown restrictions, in particular for businesses in the hospitality and leisure sectors.  The measures, due to come into effect from Saturday 4 July, will permit businesses such as pubs, restaurants, hairdressers and cinemas to re-open their doors to customers (provided they follow the Government’s COVID Secure guidelines). 

Whilst detailed guidance is yet to be published for these sectors, it appears that the Government has set out a number of key conditions for these businesses re-opening, including:

• Operating safely and within the Government's COVID Secure guidelines (and for more detail on this topic,  see our article on Risk Assessments here);
• Mandatory table service for those restaurants, bars and pubs opening indoor areas; and
• Collection of customers’ contact details by restaurants, bars, pubs and other businesses for the purposes of tracing individuals, should another customer test positive for Coronavirus.

Arguably, one of the most onerous tasks on businesses in the hospitality sector is the final requirement:  keeping a record of customers and their contact details.  Whilst this may not be such a challenge for larger restaurants or bars, who already have established systems in place to enable detailed record-keeping, it is more work for smaller businesses that have not previously needed to keep a record of their customers.

In addition to the obvious practical issues that arise (for example, pubs who multiple entrances, staff to monitor and keep those records etc.), there are also certain privacy considerations that must be taken into account when collecting and using customers’ personal data.

• Amongst other things, current UK data protection law requires that businesses collecting personal data (which includes names, addresses, telephone numbers and e-mail addresses) from individuals must:
• Inform these individuals of: the purpose(s) for data collection; the legal basis for processing the data; any other parties to whom the data will be disclosed; data retention periods; and their rights under data protection law.
• Allow individuals access to their personal data (normally by responding to a “data subject access request” from the individual).
• Ensure that the personal data being kept is accurate or corrected without delay where there are any inaccuracies.
• Not retain personal data for any longer than necessary.

Whilst the above is not an exhaustive list of all data protection requirements, these are likely to be of most relevance to businesses in the hospitality sector opening from 4 July onwards.

In the absence of any definitive guidance, it is also yet unknown as to exactly what customer data businesses will be required to collect and keep. 

At present, all we know is that businesses should only store the data temporarily for 21 days so that they can let other customers know if someone else in the vicinity at the same time has tested positive for Coronavirus.

One practical solution to deal with at least a few of the above data protection requirements would be to publish a privacy notice (for example, at the entrance of the premises) to set out how and why customers’ data will be used.  Although this may be a further administrative task for businesses (whose focus is understandably elsewhere), it would assist with data protection compliance and provide a level of transparency around the collection of personal data.  For customers more sensitive to their privacy and data protection rights, it may also be another way to build customer trust and confidence within the business.

Of course, we appreciate that data protection compliance is unlikely to be at the top of business’ priority list at the moment, but if you would like to discuss the points raised in this article further, please contact the Data Protection Team at Leathes Prior on 01603 610911 or by email who would be happy to assist.

Note: The content of this article is for general information only and does not constitute legal advice. Specific legal advice should be taken in any specific circumstance.