The Government has produced guidance to help ensure safety during the pandemic. The most recent update provides guidance on the importance of maintaining records of staff, customers and visitors, particularly as pubs, bars, restaurants and hair dressers in England (amongst others) prepare to open their doors to customers on 4 July. 

Update – the Government guidance was updated on 2 July 2020 to provide guidance in relation to the maintenance of staff, customer and visitor records.  Premises preparing to open from 4 July should ensure they keep accurate records for NHS Test and Trace purposes. 

This updated guidance does not replace the government's previous guidance and it is important that businesses/organisations continue to maintain a safe working environment and following social distancing guidelines.

Sectors the guidance applies to

The updated guidance will be relevant to businesses/organisations operating in the following sectors:

• Hospitality -  including pubs, bars, restaurants and cafes
• Tourism and leisure - including hotels, museums, cinema, zoos and theme parks
• Close contact services - including hairdressers, barbershops and tailors
• Facilities provided by local authorities - including town halls and civic centres for events community centres, libraries and children's centres
• Places of worship - including use for events and other community activities

Information to collect

Under the new guidance, businesses/organisations will be required to keep a temporary record of staff, customers and visitors for 21 days to assist NHS Test and Trace with requests for that data if needed. There is no prescribed format for recording this data, and it can be recorded in advance or as the customer enters the premises. 

The following information should be retained for staff:

• Name
• Contact number
• Date and times at work

Similarly, a business/organisation should retain the following information for customers and visitors:

• Name 
• Contact number  
• Date of visit, arrival time and departure time (where possible)
• Name of assigned staff member should also be recorded where a customer will only interact with one member of staff (e.g. a hairdresser)
• Name and contact number of lead customer (where there is a group booking)

There is no requirement under the updated guidance for a business/organisation to verify a person's identity or contact details. The guidance also stresses that these requirements will only apply to those establishments that provide an on – site service, and/or where services are being provided on its premises.  There is no requirement to collect customer information in the context of deliveries or takeaways. 

Customer may opt out

Customers and visitors can choose to opt out from authorising a business/organisation to share their details with NHS Test and Trace.  However, the guidance stresses that a business/organisation should encourage consent and explain the reasons such information is being collated. 

Maintenance of records

The guidance states:

• Records should be held for 21 days.
• Records should be securely disposed of/deleted after 21 days. For paper records this will mean ensuring they are shredded, whilst for electronic records this will mean ensuring permanent deletion of electronic files. 
• All collected data must comply with GDPR and should not be kept for longer than is necessary. GDPR allows an organisation to request contact information from staff, customers and visitors, and to share it with NHS Test and Trace.  It is not necessary for a business/organisation to seek consent on an individual basis, but a notice should be displayed at the premises and/or on a website setting out what the data will be used for and the circumstances in which it might be accessed by NHS Test and Trace.   This information should be easily accessible by all, so a business/organisation should ensure that additional support is available for those that are visually impaired or cannot read English.  

When will information need to be shared with NHS Test and Trace?

The guidance makes clear that NHS Test and Trace will only ask for records where necessary.  For example, in circumstances where someone has tested positive for COVID – 19 and has listed the premises as a place they visited recently.  Alternatively, records may be requested if the premises have been identified as the location of a potential local outbreak. Should NHS Test and Trace make contact, it is imperative that information is shared as soon as possible to help identify people who may have been in contact with the virus. 

What action can be taken when contacted by NHS Test and Trace?

If NHS Test and Trace do get in touch, it does not necessarily mean that the premises will be closed.  The guidance states that they will firstly carry out a risk assessment with staff to determine whether other measures may be first implemented for example; further testing, enhanced social distancing and/or asking those infected or at risk to self-isolate. 

Where to Obtain Further Guidance 

The guide recommends the following sources in order to obtain further guidance for employers:

• NHS test and trace: how it works: https://www.gov.uk/guidance/nhs-test-and-trace-how-it-works
• Working safely during coronavirus: https://www.gov.uk/guidance/working-safely-during-coronavirus-covid-19
• Staying alert and safe(social distancing) until 4 July: https://www.gov.uk/government/publications/staying-alert-and-safe-social-distancing/staying-alert-and-safe-social-distancing
• Working safely during coronavirus (close contact services): https://www.gov.uk/guidance/working-safely-during-coronavirus-covid-19/close-contact-services
• ICO Guidance for contact tracing – protecting customer and visitor details: https://ico.org.uk/for-organisations/
• ICO Guidance – Individual rights: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/
• NHS Test and Trace: https://contact-tracing.phe.gov.uk/
• Find your local health protection team in England: https://www.gov.uk/health-protection-team