Data advice for pubs has 'more holes than Swiss cheese'

The Information Commissioner’s Office has finally published its guidance on how pubs and restaurants should handle customers’ personal data just 48 hours before reopening this weekend, although some experts claim the rules are still not clear enough.

From July 4 businesses have been instructed to collect a “temporary record” of all customers and visitors, to be stored for 21 days in order to assist the NHS Track & Trace programme.

However, while some hospitality firms – especially those owned by large chains – already have booking systems in place which collect customer details, many of the smaller, independent establishments have no such capability.

UK Hospitality chief executive Kate Nicholls has previously said there was “a pressing need” to clarify the mechanics of how the data collection might work, while her counterpart at the Night Time Industries Association Michael Kill added: “The challenge remains for those businesses who don’t already use these systems, and the additional cost implications during such a financially difficult period.”

However, in its guidance, the ICO insists “it doesn’t need to be complicated – there’s no need for you to develop special apps or digital solutions”, advising firms to just choose the process that best suits their business.

It has laid out a five-step process to help ensure that data protection is not a barrier to business recovery, including:

Ask for only what’s needed. Firms should only ask people for the specific information that has been set out in government guidance. This may include name, contact details and time of arrival, for example. However, they should not ask people to prove their details with identity verification, unless this is a standard practice for the business, eg ID checks for age verification in pubs.

Be transparent with customers. Companies should be clear, open and honest with people about what they are doing with their personal information by telling them why it is needed and what it is being used for. The guidance states: “You could do this by displaying a notice in your premises, including it on your website or even just telling people. If you already collect customer data for bookings, you should make it clear that their personal data may also be used for contact tracing purposes.”

Carefully store the data. The ICO says firms must look after the personal data they collect. That means keeping it secure on a device if they are collecting the records digitally or, for paper records, keeping the information locked away.

Don’t use it for other purposes. Companies are being warned they cannot use the personal information that they collect for contact tracing for other purposes, such as direct marketing, profiling or data analytics.

Erase it in line with government guidance. Firms should not keep the personal data for longer than the government guidelines specify. The guidance adds: “It’s important that you dispose of the data securely to reduce the risk of someone else accessing the data. Shred paper documents and permanently delete digital files from your recycle bin or back-up cloud storage, for example.”

ICO deputy chief executive Paul Arnold said: “For the public health benefits to be realised from these new measures it is important people feel able to share their personal data with confidence. So people can have this trust and confidence in the way their personal data will be kept safe and used properly as they prepare to return to their favourite pubs, restaurants and local businesses, we want to help businesses to get things right first time as they adapt to new ways of working.

“We’ve published ICO advice – clear, simple steps that businesses can take as they introduce customer and visitor records. And we’ll be supporting government guidance with a series of Q and As on our coronavirus online hub that will give more detail. We also have a team of experts offering advice and support through our small business helpline.

“We appreciate the challenge that many small businesses face in introducing unfamiliar arrangements at speed. Our focus is on supporting and enabling them to handle people’s data responsibly from the outset and, while we will act where we find serious, systemic or negligent behaviour, our aim is to help the thousands of businesses that are doing their best to do the right thing.”

However, not everyone is convinced. On Twitter, data protection consultant Paul Walshe of Privacy Matters said that while the advice was “welcome”, it “doesn’t discuss the legal basis nor the scenario that people may refuse to provide their data to have a pint”.

Some accuse the media of scaremongering, amid claims that pubs and restaurants could soon be falling foul of GDPR and facing massive fines.

However, others insist there are still far too many unanswered questions. One industry source pointed out the ICO guidance is pretty standard advice that any data protection professional worth their salt could have provided.

She added: “Pubs still haven’t got a clue whether they need to collect data on everyone in the party or just the people who are paying. What happens if there are children in the group, do they take their personal data too? And, what is to stop customers giving false names and addresses? Will pubs really care so long as they can get customers in?

“Whether that is for the ICO is another matter. Whatever the case, the Government needs to get a grip. On June 24 it published a document which stated the Government would be working with industry bodies to design a system in line with data protection legislation and set out details ‘shortly’. With 48 hours to go, there is no sign of a new system and there appear to be more holes in the current guidance than Swiss cheese.”