Premises and venues across England like pubs, restaurants, hairdressers and cinemas must have a system in place by law to record contact details of their customers, visitors and staff in the latest move to break the chains of transmission of coronavirus.
These businesses and organisations had been advised to collect and share data, with many effectively doing so, but following the recent move to ban social gatherings of more than six people, the data collection programme will now be formally mandated from 18 September.
Further guidance and, where necessary, regulations will be set out specifying the settings which will be included, but the scope will cover the hospitality industry, such as pubs, bars, restaurants and cafés, as well as close contact services and other tourism and leisure venues.
Additionally, venues could be fined if they fail to ensure their premises remain COVID-Secure, such as failing to take specified steps to collect contact information or taking bookings for groups of more than six. Further details will be set out shortly.
Health Secretary Matt Hancock said:
"NHS Test and Trace is a vital part of the Government's response to fighting coronavirus, designed to help us return to a more normal way of life and reduce the need for local lockdowns in the future.
"The system cannot operate without the cooperation of business. We are now mandating venues collect the necessary contact details and support NHS Test and Trace to stop the spread of the virus."
Business Secretary Alok Sharma said:
"Each and every one of us needs to play our part to control the virus and avoid a second deadly peak.
"While the vast majority of businesses have done an incredible job by following the guidance to keep customers safe, we are now making it the law for certain establishments to collect life-saving NHS Test and Trace data and to keep this on record for 21 days.
"We need to take these tough measures now to reduce the risk of local lockdowns in the future. If we don't all pull together to drive this virus down, businesses will need to close and people's jobs will be put at serious risk."
The new rules mean organisations in scope will be legally required to request the contact details of every customer and visitor on their premises.
Venues must keep a record of all staff working on the premises on a given day and their contact details.
These will be stored for 21 days and shared with NHS Test and Trace, if requested.
This will assist NHS Test and Trace to effectively contact everyone who may have been exposed to the virus during an outbreak in these settings and to provide the appropriate public health advice. This will help to stop the onward spread of the virus.
The contact details include: the name, a contact number, date of visit, arrival time and - if possible - departure time.
All collected data must comply with GDPR and will not be kept for longer than necessary
Data collection should be as straightforward as possible for organisations. Each organisation will have the freedom to collect the data in a way that best suits them, either using an existing system or finding a new solution. This method will vary from sector to sector, and we will continue to engage with organisations to consider what additional support or guidance may be needed.
Contact details will only be shared with NHS Test and Trace if it is requested. This will usually be because the venue has been identified as the location of a potential local outbreak of COVID-19. If this is the case, the NHS Test and Trace service will work closely with any affected establishments to take appropriate action.
Businesses should continue to follow the Government's comprehensive workplace guidance [1] with practical steps employers should take to make workplaces COVID-secure and ensure employees feel safe in their place of work.