A Covid World - Making a List, Checking it Twice

The government has eased the Covid-19 restrictions and allowed the hospitality industry to reopen from the 4th July. Great news for all that have been shut since March 23rd, however as always, we can open with conditions. If you open your pub, restaurant, bar or other hospitality venue for business to the public you are “advised” to keep a record of customers who visit and be ready to provide it to help with national test and trace efforts. We say advised because it’s all still a bit unsure. You should do it, be safe, remain compliant, make your life easier, but you don’t legally have to, yet!

Now, how do we collect such vast information and still remain GDPR (General Data Protection Regulation) compliant? Hospitality guidance that was published on 23rd June has stated venues are to assist with the NHS Track and Trace efforts by “keeping a temporary record of your customers and visitors for 21 days”. Now it’s important to note that this applies to all businesses, whether you already have a way of collecting customer information through such avenues as bookings or not. If you are a venue that requires advance bookings you should already have the tools in place to collect this information easily. For others, it may involve setting up systems to collect the data or simply keeping a written log.

There are still many questions to answer about how much information needs to be collected, how it will work and how it will be accessed, but whatever happens your business must collect, store and manage that data in accordance with data protection laws. The government has said it will set out details shortly on how to design these systems in line with data protection legislation.

Data laws such as GDPR are there to protect individuals in any situation where their personal data is collected. Although this business obligation to collect customer information has come about from an international public health emergency it does not detract from your responsibilities to follow GDPR rules.

Make sure you’re not only keeping track of your customers and visitors, but also your staff. They will also be important to helping the track and trace efforts and will need to be notified if there is/was any risk of contact with someone who has tested positive.

Things To Consider

To make things simpler we’ve listed the main things your business should consider with this new customer record keeping in order to comply with GDPR.

• Minimalist - only collect the minimum amount of data and personal information that is needed. This will most likely be limited to name, time of entry, and contact information (phone number or email). Keep it simple.

• Informer - make sure you have an easily visible notice upon entering your venue informing your customers and visitors about the data you are collecting and why. Do not assume that everyone will know, you must have informed consent. Transparency is key in data protection and being honest will help build trust with your customer base.

• Confidant: ensure your information notice states the security of your system and that the system you use can keep data secure. Teach your staff about the importance of keeping this information confidential, the new system changes and have them sign a training disclosure to store in your records.

• Outsourcer - if you plan on using a third party (eg. app, online booking system etc.) to collect and manage your visitor information make sure you choose a reputable vendor that wouldn’t compromise data security or damage your reputation.

• Keeper - in this situation the retention period for the data is 21 days. Make sure after this period you have a way to securely and permanently delete the data. Also note that visitor information is being collected to assist the national track and trace efforts and that is the only reason it will be used. Although as tempting as it is to add these people to your mailing list it can only be done if you have received the individuals permission.

A great new technology that will be able to help streamline the data collection and management process is a company called FinGo, who use VeinID to scan customer data safely and securely. With an initial Manchester launch planned for March 2020, they have taken the time during lockdown to redesign their “FinGo solution to help hospitality venues re-open safely and in line with government guidelines”. Recently they’ve secured funding from Manchester City Council and are already in use at Manchester City’s Etihad Stadium.

The FinGo solution will quickly and easily collect customer data, age verify and take payment with minimal need for physical contact, all through a finger scan of the individuals VeinID. Simple to set up for customers and add any ID or payment details on their own devices, and upon their first visit to a FinGo venue they link their finger vein biometric to their account using the scanner.

Check out more information about FinGo and benefiting from their service please visit https://fingo.to/