ICO Issue Guidance for Businesses Gathering Coronavirus Personal Data

Following the announcement that businesses will have to record and maintain personal data of customers, staff and visitors in support of the test and trace scheme, the ICO has released guidance for businesses affected to aid them in their adhering to GDPR data protection requirements.

ICO Deputy Chief Executive Paul Arnold said:

"For the public health benefits to be realised from these new measures it is important people feel able to share their personal data with confidence. So people can have this trust and confidence in the way their personal data will be kept safe and used properly as they prepare to return to their favourite pubs, restaurants and local businesses, we want to help businesses to get things right first time as they adapt to new ways of working.

"We've published ICO advice - clear, simple steps that businesses can take as they introduce customer and visitor records. And we'll be supporting government guidance with a series of Q and As on our coronavirus online hub that will give more detail. We also have a team of experts offering advice and support through our small business helpline.

"We appreciate the challenge that many small businesses face in introducing unfamiliar arrangements at speed. Our focus is on supporting and enabling them to handle people's data responsibly from the outset and, while we will act where we find serious, systemic or negligent behaviour, our aim is to help the thousands of businesses that are doing their best to do the right thing.

"We'll continue to update our guidance on this and other coronavirus-related data protection issues on our dedicated web hub."

While this will play a key role in the Government's Track and Trace scheme, it is not without headache for businesses unfamiliar with mass data gathering and storage.

DMA Director of Policy and Compliance John Mitchison said:

"This gathering and storage of personal data will no-doubt play a key role in the UK's emergence from the coronavirus pandemic.

Nonetheless, these new requirements will see many pubs, restaurants and cafes have to deal with gathering and storage of personal data, which is perhaps something unfamiliar to them.

For this to be effective, the public need to trust that their data will be stored and used correctly. Businesses gathering data should consider the approach they take carefully. Indeed, while it is perfectly possible to complete the data storage process safely, businesses might consider using one of the many solutions that have become available from data companies, that relieve the hospitality industry of legal and practical burdens of these new requirements."

In light of these developments, DMA Member company Promotigo has created Guest Visit, a solution to relieve legal and practical burdens of the hospitality industry - read more here.