‘What they should look out for when collecting data’As part of the new rules pubs and restaurants will be required to collect names and contact details of their customers as part of the track and trace approach.
Data protection does not stop pub and restaurant owners to collect this information from their customers as long as the principles of the law (transparency, fairness and proportionality) are applied.
What does this mean in simple terms?
- Let them know that you are collecting the data and for what purpose
- Only collect the data that is needed – if phone number and email address are sufficient you don’t need to collect their home address as well – for example
- Some information only needs to be held momentarily and there is no need to create a permanent record.
- Be clear, open and honest with customers and staff about their data
- Make sure you tell people how and why you wish to use their personal information, including what the implications for them will be. You should also let them know who you will share their information with and for how long you intend to keep it.
- Keep people’s information secure whether is in electronic or paper format
- You will need to update your retention policy to set out when and how the personal information needs to be deleted. Make sure you have a robust process to ensure deletion is carried out in a timely manner.
- Customers must be able to exercise their information rights – such as the right of access or rectification.
- You need to update your data inventory and identify a lawful basis for processing the data
An approach that is fair in the handling of people’s data which provides transparency in its purpose and is compliant to the data protection regulation will help to gain the trust of customers, staff and community as a whole during these exceptional times.