ICO publishes contact-tracing guidance

The UK’s data protection body, the ICO, has issued privacy protection advice to businesses re-opening as the Covid-19 lockdown eases in the four nations.

With pubs, restaurants and hotels having to collect customers’ contact details, concerns have been raised about the information being used other than for tracing people, when required, to suppress the spread of coronavirus.

Therefore, the ICO is advising businesses how to proceed:

  • Ask for only what is needed;
  • Be transparent with customers, telling why you need the information and what you will do with it;
  • Carefully store the data;
  • Don’t use it for other purposes, such as direct marketing, profiling or data analytics; and
  • Erase it securely, in line with government guidance.

The advice is part of a package the ICO is issuing and updating as the UK’s nations – England, Scotland, Wales and Northern Ireland – vary in the way they ease lockdown measures.

Deputy chief executive Paul Arnold said: “So people can have this trust and confidence in the way their personal data will be kept safe and used properly as they prepare to return to their favourite pubs, restaurants and local businesses, we want to help businesses to get things right first time as they adapt to new ways of working.”

In a 3 July PrivSec article, Aman Johal, director of Your Lawyers, wrote: “Management must ensure that all staff members understand how to handle the data and, if necessary, seek official guidance to make sure their data protection responsibilities are met.”


Catch the replays and discover the best talks from Last Thursday in Privacy, addressing data protection, privacy and security challenges including working from home, COVID-19, global regulations and more. Visit https://digital.privsec.info/.

We have been awarded the number 1 GDPR Blog in 2019 by Feedspot.