Guidance for collecting customer information for contact tracing

The Information Commissioner’s Office (ICO) has published data protection guidance for organisations mandated to collect customer and visitor information.

From 18 September, the UK Government made it mandatory for all businesses in the hospitality sector, leisure and tourism sector in England to collect customer information for the test and trace programme.

The Scottish and Welsh governments have also mandated certain organisations to ask for customer and visitor information.

This does not need to be complicated.

The ICO is advising organisations across the UK to follow five simple steps so they handle people’s information responsibly. Organisations must:

1. Only ask people for the specific information that has been set out in government guidance;
2. Be clear, open and honest with people about what is being done with their personal information;
3. Keep people’s data secure. Organisations should not use open log books, and should ensure their customers’ personal information is kept private;
4. Not use the personal information collected for contact tracing for other purposes, such as direct marketing, profiling or data analytics;
5. Erase or dispose of the personal information collected after 21 days.
   Organisations do not have to ask people for their information if individuals are using a contact tracing app to check into venues.

Organisations should not make the use of contact tracing apps mandatory, and should give people options to give their details for contact tracing purposes.