Where everybody knows your name: pubs and data

The UK Government has announced that pubs can reopen on 4 July, and in the process asked them to start collecting the personal data of their customers to assist in test and trace. This is clearly going to create some big data protection challenges for pubs across the United Kingdom.

Voluntary measures invite things to go wrong in a number of ways. At one extreme, registers may not be taken by outlets at all.. This risks failing to notify potential Covid-19 patients.

Another version is pubs and restaurants wrongly seeing this as an opportunity to build up some nice marketing lists – ripe for commercial exploitation. This would also be a horrible outcome.

All the outcomes here are heavy on the downsides, from state databases, to more opportunity for commercial exploitation or data breaches through sloppy data handling practices. The only upside being you could enjoy a drink in a pub, but at what cost?

The current guidelines help no-one. Opening up the economy is an important objective, and getting back to beer gardens would be great during this heatwave but we don’t want to be heading to a place where everybody knows your name in all the wrong ways.

Voluntary Guidelines create uncertainty

The Government released guidance on 23 June 2020 for keeping workers and customers safe during covid-19 in restaurants, pubs, bars and takeaway services. In the document the Government said:

“You should assist this service by keeping a temporary record of your customers and visitors for 21 days, in a way that is manageable for your business, and assist NHS Test and Trace with requests for that data if needed.”

The Government commits to working with “industry and relevant bodies to design this system in line with data protection legislation, and set out details shortly”. 

The first thing to note here is that this recording of customer details are voluntary, but without a doubt the Government wants to see every pub doing this in case of a cluster or outbreak that includes a patient visiting a pub and increasing the chances of transmission.

The other condition to note is that registration must be “manageable for your business”. This invites myriad practices, from a glorified guest book for signing in – good luck phoning Hugh Jass to tell them about a coronavirus positive test occurring in the pub – to more sophisticated practices like QR codes when an individual enter pubs and restaurants, as implemented in New Zealand, or pushing customers to pre-existing corporate Apps.

ORG is concerned by this request. The imprecision will lead to confusion from pubs and customers. Confusion may allow for the collection of personal data by pubs for purposes beyond contact tracing like building up their marketing lists for commercial exploitation. We have seen other countries suffer from privacy breaches after setting out on this path.

The guidance does not reflect practice

The guidance appears to equate pubs with restaurants and hotels, which from a data collection point of view is wholly wrong. Hotels and restaurants – at least those with reservation systems – havealready established data collection, preservation and deletion practices. Must pubs now have that same system in place? In less than 10 days? When most pubs’ systems for marking out customers are basically spoons in jars?

What to do about it?

The Government have stopped short of mandating this, but they have given a moral weight to pubs collecting more personal data.This has been done without suitably considering how best to head off the negatives: no data collection at all leads to risk of outbreak; no clear safeguards or practices in place risks data breaches or abuses. As the Government sits down with industry to discuss the design of this system they have to answer these key questions:

• How do we help create a system that permanently splits personal data of customers collected for potential contact tracing with pubs existing data such as marketing lists?
• How do we ensure that the practice by pubs are at least somewhat consistent and avoid unnecessary risks such as handwritten ledgers accessible to many?

There are no good sides to this from a privacy perspective, but the Government are choosing to create principles for data collection for pubs without establishing practice, leaving everyone short at the bar.

Cheers, Gov.

Photo by Donald Windley cc-by-nc https://www.flickr.com/photos/afghan-don/14314254905 Adapted with image by Michael Morel