New Information on Track & Trace
On 22nd September 2020 the government announced mandatory requirements for Track and Trace which came into effect on 24th September.
Designated venues in certain sectors must have a system in place to request and record contact details of their customers, visitors and staff to help break the chains of transmission of coronavirus. NHS Test and Trace or Public Health Officers will ask for these records only where it is necessary.
These have wide ranging implications; have a look below to check the requirements for your organisation:
For groups & charities…
If your organisation hires a space to run support groups and community activities, there is a mandated requirement to register for an NHS QR code which must be available at each session for participants to record their details. Participation by the public is voluntary but it is a legal requirement to display the required posters.
If you run activities from your own space, you will need to check guidance to see if you are required to register for an NHS QR code. However, it is recommend that you register for an NHS QR code regardless of whether you are required to do so.
Facilities provided by local authorities…
There is a higher risk of transmitting COVID-19 in venues where customers and visitors remain in the same space for a long time and potentially come into close contact with other people outside of their household.
To manage this risk, facilities provided by local authorities including community centres, libraries and village halls, must request contact details from staff, customers and visitors, and display the official NHS QR code poster. Community halls also need to ensure hirers comply with the regulations. This guidance complies whether it is an indoor or outdoor venue or mobile setting.
You can find out more about NHS QR codes and how to generate them on the NHS COVID-19 app website.
GDPR Guidelines
Collecting contact details and maintaining records for NHS Test and Trace is a legal requirement and failure to comply is punishable by a fine. The data that you collect is personal data and must be handled in accordance with GDPR to protect the privacy of your staff, customers and visitors.
Every organisation who processes personal information (which now includes for the purposes of contact tracing for COVID-19), must be registered with the ICO and pay a fee, unless you are exempt. If you are unsure whether you need to register, visit the ICO website.
