Public Health Supplementary Guidance 2nd July 2020
Licenced premises – Collecting contact information
This guidance is to help support businesses to collect customer information for the purposes of contact tracing. The Jersey Office of the Information Commissioner (JOIC) has published a checklist for businesses called Track & Trace Personal Information which sets out how businesses can navigate their legal responsibilities in collecting personal data to assist Government with track and trace of COVID-19.
It is important that you read the checklists whether or not you already collect information from customers for other business purposes: https://jerseyoic.org/resource-room/data-protection-and-coronavirus/?audience=everything
Why are we asking for contact detail collection?
As we move through the Safe Exit Framework contact tracing has an increasingly important role to play in Jersey’s COVID-19 strategy and to help keep each other safe.
Following the relaxation of measures, including the reopening of seated alcohol only services, the number of close contact social interactions that individuals have will increase – close contact is direct or less than 2 metres for more than 15 minutes.
Contact tracing allows us to identify those that are at the highest risk of having caught the virus from a person who has been confirmed as having COVID-19 through a positive PCR test. The contact tracing process only starts when there has been a confirmed case of COVID-19 established through a positive PCR test.
The collection of simple contact information from customers allows the contact tracing team to help protect others who have been in close contact with someone who is a confirmed case of COVID-19 through the track and trace process.
What this means for Licenced Premises
For many licenced premises, delivering a seated only alcohol service will mean a change to operating procedures and how you are able to collect contact information.
Collecting information for the purpose of contact tracing
Upon arrival, you should ask customers to share their contact details, explaining why you are doing so and providing them with the information required by the Data Protection (Jersey) Law. This can be in the form of an information sheet or written notice or it can be verbal. See the guidance published by the JOIC if you are not sure how to do this.
You should also ask customers for their consent to you collecting their information and to you sharing it with the Government. Again, please refer to the guidance published by the JOIC for details on how to collect appropriate consent.
If the customer consents, you should ask them to provide the following information that is needed by the contact tracing team:
- Full Name
- Mobile contact number
- Date and time of arrival
- Area where seated when zoned layout is in place
- Confirming consent is given
No further information is needed for track and trace, so please do not collect or provide us with any further details.
When a group of customers arrives, one person may act as the lead of the group and be the point of contact on behalf of others in their group
Looking after customer information
You may already be collecting data for other purposes such as marketing and it is important that the data collected for track and trace purposes is not merged with this data or used for any other purpose than to provide it to the Government when requested. You should not, for example, ask customers if they will also consent to the data being provided to be used for marketing communications, as this may make individuals reluctant to provide their contact details for track and trace purposes. . Further understanding of this is available from the JOIC.
You cannot deny a patron entry or service if they refuse to consent to the collection of their information.
Staff members must be briefed that the customer information they are collecting is confidential and for the purposes of contact tracing only.
Customer information you collect, on paper or electronically, should be kept for 21 days. After this period, you must ensure it is securely destroyed. A daily procedure designated to an appropriate staff member may help you with this.
The data collected must be kept securely and should not be accessible to anyone who doesn’t have a reason associated with contact tracing to see it. This means that each customer should complete a separate form or provide their details in a manner that would not allow others to see them. For example, customers should not be asked to add their details to a list that contains the personal data of customers who had previously provided their information earlier in the day, and completed forms should not be left unsecured. Each person’s personal data must be kept confidential.
You may wish to put an information sheet together for customers to allow them to understand how their customer information will be used to help protect them and others if contact tracing is required including:
- Customer information collected will not be used for any other purposes than contact tracing by the Government of Jersey, in the event of a positive test for Covid-19. It will not be used for other purposes such as marketing.
- Information requested by the contact tracing team will only be used for the purposes of contact tracing. If requested, it will be kept securely on Government of Jersey systems and securely destroyed when no longer needed.
- Contact tracers will not reveal the identity of the person who has tested positive without their consent.
Government of Jersey.