Collecting of personal data for test and trace
The opening up of the economy following the COVID-19 outbreak is being supported by NHS Test and Trace.It is a legal requirement for venues and those responsible for organising events to record the contact details of those attending the event site (including workers and staff) and to keep a temporary record of attendees for 21 days, in a way that is manageable. They must also assist NHS Test and Trace with requests for that data if needed.
Those responsible for organising events, and businesses working on an event site, must also keep contact details of staff working on the site, and shift times, on any given day.These records must be kept for a period of 21 days.
Many events that sell tickets already have systems for recording their attendees. Those organising unticketed events should try to do so to help fight the virus. Details of how to maintain records can be found here.
There is also an NHS App which can be used to log in attendees - see here.
In the case of group bookings for events, the name and contact details of at least one member of the group must be taken and kept for 21 days.
Event sites, particularly those that are not pre-ticketed, must display an official NHS QR code poster at entry points so that staff and attendees can 'check in' using this option, if they wish.
Organisers must ensure that the General Data Protection Regulation (GDPR) is observed, which will involve understanding the legal requirements, notifying people of any testing that is undertaken and completing a data impact assessment.
It should be noted that those found not to be compliant with these regulations may be subject to financial penalties. Information about these requirements can be found here