NHS Test and Trace

As the leisure and hospitality industry gears to re-open tomorrow we take a look at the guidance just published by the Government as regards the requirement to obtain data to support the NHS Test & Trace.

Who does the guidance apply to?

The guidance applies to all establishments, whether indoor or outdoor venues or mobile settings, in the following sectors:

• Hospitality including pubs, bars, restaurants and cafes;
• Tourism & leisure including hotels, museums, cinemas, zoos & theme parks;
• Close contact services including hairdressers, barbers & tailors;
• Local authority facilities including town halls & civic centres for events, community centres, libraries & children’s centres; and
• Places of worship including use of events and other community activities.

The guidance applies to any establishment in the above sectors that provides an on-site service and to any events that take place on its premises but not where services are taken off-site immediately – for example, any take away facilities. It also does not apply to drop-off deliveries made by suppliers or contractors.

What information needs to be collected?

Where possible, the following information should be collected:
For staff:

• The name of the staff who work at the premises;
• A contact telephone number; and
• The dates and times that staff are at work.

For customers and visitors:

• Their name. If there is more than one person a record need only be kept of the “lead member” together with the number of people in the group;
• A contact phone number for the customer or visitor (or lead member if in a group);
• Date of visit including arrival times and, where possible, departure times; and
• If a customer will only interact with one staff member (for example, hairdressers) the name of the assigned staff member should be recorded alongside the name of the customer or visitor.

If not collected in advance, the information should be collected at the point of entry into the premises by the customer or visitor or, if impracticable to do so then, at the point of service.

Ideally, the information should be recorded digitally but paper records are acceptable.

What if someone does not want to share their information?

NHS Test & Trace is voluntary and so although venues do not need to obtain consent to collect the data, customers and visitors can choose to opt out from giving the information. However, venues should encourage customers and visitors not to do so in order to support the scheme. They should be advised that the information will only be used where necessary to help stop the spread of COVID-19. If, however, the customer or visitor still choosing to opt out then any information obtained for booking purposes should not be shared.

Venues do not have to verify the accuracy of any information provided by customers or visitors.

Maintaining records

Records should be held for 21 days to reflect the incubation period for COVID-19. After 21 days it should be deleted or securely disposed of. Records made and kept for other business needs do not need to be deleted or disposed of. However, all data collected must comply with the General Data Protection Regulations and should not therefore be kept for any longer than is necessary.

General Data Protection Regulations (“GDPR”)

As data to be collected is personal data, venues must ensure that it is handled in accordance with GDPR to ensure the privacy of their staff, customers and visitors. Whilst it is not necessary to seek consent from each person to collect the data, venues must make it clear why the information is being collected and what they intend to do with it. It is, however, not necessary to inform every customer individually – a display notice at a venue’s premises or on its website would suffice.

Personal data collected for the NHS Test & Trace must only be used to share with the scheme and not for any other purpose.

Appropriate technical and security measures must be in place to protect customer contact information. Venues must also ensure that individuals are able to exercise their data protection rights, such as the right of erasure.

When should information be shared with the NHS Test & Trace?

NHS Test & Trace will only ask for a venue’s records where necessary, either because someone has tested positive for COVID-19 and identified your premises as somewhere they have visited recently or because your premises have been identified as the location of a potential local outbreak. When asked to do so, information should be shared as soon as possible.

NHS Test & Trace will contact you by:

• Calling from 033 013 5000;
• Sending you a text message from “NHStracing”; or
• Asking you to sign into the NHS Test & Trace contact tracing website – www.contact-tracing.phe.gov.uk.

Receiving contact from NHS Test & Trace does not mean you will need to close your establishment. NHS Test & Trace will carry out an assessment, if necessary, and work with you to understand what action needs to be taken.

This could include arranging for people to be tested, asking them to take extra care with social distancing and/or, in certain circumstances, asking them to self-isolate.

However, if there is more than one case of COVID-19 at your establishment you should arrange to contact your local health protection team to report the suspected outbreak.