As coronavirus cases begin to climb once again, Track and Trace data has never been so vital. Useful for identifying and stemming the spread of the virus, this information needs to be collected, handled, shared and also properly destroyed in line with data protection regulations.
Collecting and Handling Track and Trace Data
How businesses handle Track and Trace data is crucial. The improper collection, handling or disposal of this information could amount to a data breach. Companies could even face fines for not meeting data protection regulations.
The Information Commissioner’s Office has published an ‘ABCDE’ approach for protecting Track and Trace data.
A – Ask only for what is needed.
Only ask visitors for specific information detailed in government guidance. For example, names, phone numbers and arrival times.
B – Be transparent.
Be transparent with those you collect Track and Trace data from, letting them know the exact reasons for data collection. Unlike GDPR, the government doesn’t require proven consent for collecting Track and Trace data. A poster on the window of your premises, a website banner, or even verbal confirmation with visitors will suffice.
C – Carefully store the data.
Make sure to carefully store any information you collect for Track and Trace away from unauthorised personnel. We’ll cover some data security practices in the next section of this blog.
D – Don’t use it for other purposes.
Do not use the personal information you collect for Track and Trace for any other reason. Businesses should not use this data for marketing purposes, customer profiling, or any other form of communications.
E – Erase data in line with government guidance.
You shouldn’t keep data for longer than specified by government guidelines. At the time of publication, this is 21 days. After 21 days, businesses should securely shred physical documents and permanently erase digital files from hard drives, online storage, and backup storage.
The allowed methods of collecting Track and Trace data are flexible. Collection can be digital or on paper. Whichever method is used, data should only be accessible by authorised personnel and should not be misused.
Making sure you keep data safe
Between collecting Track and Trace data and having it destroyed, data safety measures should be implemented. Data should be inaccessible to any unauthorised personnel, and should not be left unattended in environments where data could be stolen by other customers or visitors. Businesses should also consider whether the information they are collecting needs any additional protection.
Example – A group of children attend a sports club without an adult present.
Without adults present, businesses need to weigh up whether or not to gather Track and Trace data. One thing to consider is whether the child would understand the purposes of processing their information. Collecting the data of children comes with additional risks. Only approved staff should have access to this information. It should never be visible to other sports club visitors.
Other information taken such as temperature checks or other data regarding health is categorised as special category data and should be treated accordingly.
Remember that individuals are not currently under a legal obligation to share their information for Track and Trace purposes. However, as per the government guidance, hospitality venues must refuse entry to customers or visitors who refuse to provide their name and contact details, are not in a group, and haven’t scanned the NHS QR code.
Whichever way data is collected or stored, all personal data kept as part of Track and Trace should be treated as confidential and held securely in line with data protection regulations.
Another element of data security that requires consideration is how you responsibly destroy or delete Track and Trace data. Secure disposal is imperative for keeping individuals’ data safe.
Disposing of Track and Trace Data
A key factor of the protection of Track and Trace data is secure disposal.
Businesses should promptly and permanently delete digital files they no longer need and shred any paper documents.
The preferred method of disposal for a lot of businesses is via the process of shredding as it is quick, easy, and guarantees that information is irretrievable.
Shred Station’s secure shredding services are the perfect choice for destroying confidential information. As well as being flexible, cost-effective and eco-friendly, you will also receive a Waste Transfer Note and Certificate of Destruction after every collection for your data compliance records.
Get in touch today to see how we can help your business safely dispose of Track and Trace data.
If you’d like to read the Information Commissioner’s Office guidance around collecting customer and visitor information, you can do so here: https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2020/09/data-protection-guidance-for-collecting-customer-information/
To read the UK Government’s most up-to-date guidance on maintaining Track and Trace records, please visit the following link: https://www.gov.uk/guidance/maintaining-records-of-staff-customers-and-visitors-to-support-nhs-test-and-trace.
Sign up for our newsletter to receive alerts about new blog articles, data protection advice, and Shred Station news.
All information featured in this blog post is correct at the time of publication – September 2020.