The Scottish hospitality industry is now required to collect visitor information to minimise the risk of the incidence and spread of coronavirus. The Health Protection (Coronavirus) (Restrictions) (Scotland) Amendment (No.11) Regulations 2020 which make it mandatory to do so took effect on 14 August 2020.
The Regulations apply to pubs, restaurants, cafes, bars and hotels in which food and drink are sold for consumption on their premises. Businesses involved in offering such hospitality must now collect the contact details of visitors to their premises in support of Test and Protect.
For the moment, there is no corresponding requirement in England for the hospitality industry to collect and retain this data.
What has changed?
Parts of the hospitality sector had already begun to take details of customers who visited their premises following Government advice to do so. However, following recent widely reported outbreaks of COVID-19, all relevant hospitality businesses must now record the name and telephone number of one member of each household visiting the premises, the date of their visit and arrival time together with a note of the number of any members of that person’s household visiting the premises at the same time.
Businesses must store the information they gather for a period of 21 days and share it when requested to do so by public health officers as soon as reasonably practicable but in any event within 24 hours.
Guidance for businesses on how to collect personal information
As outlined in our previous guidance on contact tracing, information being gathered must be collected in line with data protection requirements. The Scottish Government has issued guidance on collecting and recording information. For example, for larger establishments, and where possible, it would be helpful for businesses to note the location of where the customers were sitting in the premises. Hospitality businesses should collect, where possible, additional information in relation to their staff and visitors to premises (such as delivery drivers or cleaners). For visitors, they should collect the name of the visitor, date and time they visited the premises and time of departure. For staff, the hospitality business should collect the staff member’s name, a contact number for the staff member and dates and times that the staff are at work. For larger establishments, and where possible, it is also helpful to record the area the staff member works in e.g. which section of tables they serve.
The guidance highlights the privacy notice template which is available for businesses to use in order to notify their customers of the reason for the collection of their personal information and how this will be used.
Crucially, the guidance outlines the stance business are expected to take should an individual refuse to share the personal information necessary for the support of the Test and Protect system. Should this occur, the business is expected to refuse its services to this individual.
What happens if a business fails to follow the new regulations?
A failure to have the required contact tracing arrangements in place will be punishable by a Fixed Penalty Notice under the Regulations. A continuing failure could be enforced by repeated fines of up to £960.
