Covid-19 coronavirus: Privacy Commissioner warns against over-collection of customer info

Privacy Commissioner John Edwards: a bar or restaurant can't ask about your medical symptoms. Photo / John Stone

A government watchdog says any pub or restaurant register that asks if you are sick, or wants a copy of your driver's licence, is over-stepping the mark.

Privacy Commissioner John Edwards is warning the hospitality industry against using contact tracing apps or web-based solutions that ask for too much personal information, including whether a customer has had Covid-19.

He is also reminding businesses that while pubs, restaurants and cafes are required to keep a record of patrons, retailers and takeaway outlets are not.

Information collected for a Covid-19 register cannot be used for marketing, and must be deleted after it is no longer required.

Edwards said his office has today published a stocktake of contact tracing apps that generally do a good job of helping a business meet their obligations under the health regulations.

"The apps we looked at work without being too intrusive or by putting sensitive information at risk," he said.

"But if a bar or restaurant is asking a customer, as a condition of entry, to declare through a third-party app or website what, if any, medical conditions or symptoms they have, or any exposure to Covid-19, they could be at risk of breaching patrons' privacy."

(Employers are separate case; they can seek information and share it with other staff are at risk.)

"It's hard to see why a café or restaurant would need to use a service that scans and retains a copy of an identity document or keeps a record of a vehicle registration or clinical information," Edwards added.

"Business shouldn't be collecting information about Covid-19 symptoms, as you need clinical expertise to be able to do anything useful with that information."

Edwards said complaints to his office could lead to liability for the business, which could be passed on to the technology platform provider.

"As our stocktake of contact tracing apps shows, there's no need to take that risk when there are privacy safe options available."

Advice on how much information a business can ask for its contact tracing register can be found here.