COVID-19: Restaurants and cafés are encouraged to register visiting guests
The spread of COVID-19 has recently been alarmingly high, especially in and around the metropolitan area and in Odense. For that reason, the government has now implemented some new measures to limit the outbreak. Magnus Heunicke encouraged restaurants and cafés to implement a voluntary scheme, in which visiting guests can register for contact tracing.
What GDPR issues does this voluntary scheme raise?
Even if you as a business owner want to make a difference and help prevent the spread of COVID-19 by e.g., encourage your guests to register, there are a number of different legal GDPR issues that you must pay special attention to.
Registration must be voluntary
It must be the individual guest’s choice whether he or she wishes to register his or her information. Additionally, it must be voluntary – that is, there must be no inconvenience to the guest in rejecting registration of the information.
Inform about the purpose
Be sure to make it clear to guests what is being recorded, what it will be used for and how long the information will be stored. If, for example, you use an online booking system, you should write if the information from the booking can be used for contact tracing. If you already have a privacy policy, it will be relevant to add a section about the registration herein.
Register no more, than what is needed
This will usually include name, contact information and the period in which the guest has stayed at the restaurant or café. Depending on the size of the room, you can as a restaurateur or café owner register, where the person has been sitting in the room, as this information can be relevant and helpful in contact tracing.
If restaurants and cafés want to introduce such a voluntary scheme, Lund Elmer Sandager recommends that simple and predefined forms are prepared, which only contain name, address, telephone number and time. If you want to register the location of the guest in the restaurant or café, this can happen through your booking system when you assign the guest table, if such a solution is technically possible.
Pay attention to the information
Make sure that unauthorized people do not gain access to the information being recorded.
Do not use the information for anything else
The information can only be used for contact tracing as needed – and not for e.g., marketing or other purposes.
Delete the information continuously
When the information is no longer relevant for contact tracing, it must be deleted. In the light of COVID.19, it must therefore be assumed at the moment, that restaurants and cafés are probably not allowed to store guests’ personal information for longer than 14 days, as there is a 14-day incubation period for coronavirus, according to the authorities.
Do you, as a business owner, need advice in how to handle the registration of guests, or do you need help to prepare a registration scheme that complies with all applicable rules, please do not hesitate to contact Lund Elmer Sandager’s specialist in GDPR and IT law, Associated Partner, Attorney Torsten Hylleberg.
