Personal Data Retention: Covid-19

Current Government Statement:

The opening up of the economy following the COVID-19 outbreak is being supported by NHS Test and Trace. You should assist this service by keeping a temporary record of your customers and visitors for 21 days, in a way that is manageable for your business, and assist NHS Test and Trace with requests for that data if needed. This could help contain clusters or outbreaks.

Many businesses that take bookings already have systems for recording their customers and visitor including restaurants, hotels, and hair salons.  If you do not already do this, you should do so to help fight the virus. We will work with industry and relevant bodies to design this system in line with data protection legislation, and set out details shortly.

Basic Advice

Where possible, organisations should have clear and accessible privacy information in place before processing begins. However, it is recognised that in this exceptional period, this may not always be possible.

Organisations should ensure that privacy notices are in place and updated as soon as reasonably practical. More details of what they should include can be found on the ICO web page, where there is also a simplified version that may be helpful to organisations.

The sort of information that you ought to include maybe (but isn’t limited to):

  • An organisation’s name and contact details (email and telephone number)
  • The data held and the reasons why
  • Where this data was obtained
  • The length of time it will be retained for, and
  • How people can request it be erased

Where possible, organisations should make this information as accessible as possible, consider the different circumstances and factors that will impact upon this, and communicate accordingly.

  • Basic Privacy statement as a notice on the entrance to your business may assist with this process and assist with consent.If people do not consent to providing that personal data it is unclear as to what a business should do at this time.
  • Add Data Protection Policy / Privacy statement to your web site

Remember that data gathered for Track and Trace purposes cannot be then used for marketing purposes by your business. YOU must be clear about why you are requesting data, what data you are requesting and how long it will be held for.