Bars, restaurants, hairdressers and churches face a minefield, privacy campaigners have warned, after the government instructed them to record people’s contact details in case they need to assist with test-and-trace efforts. From 4 July, hospitality businesses and other venues in England will be able to reopen. To minimise customer contact, restaurants will be limited to table service inside, Boris Johnson said on Tuesday, and will be asked to help NHS Test and Trace “by collecting contact details from customers, as happens in other countries”. He added: “We will work with the sector to make this manageable.” But privacy groups said the industry had been given no guidance on how to gather and store potentially sensitive data, while customers had been given no assurance that their information would be handled safely. “This sounds like an excessive and intrusive move designed to paper over the cracks of a much bigger contact tracing failure,” said Silkie Carlo, the director of the Big Brother Watch campaign group. “It also poses privacy risks. Asking pubs and restaurants to become data controllers overnight is unfair – and could see personal data hoarded, lost or misused – whether for marketing or unwanted personal contact. We’ll be monitoring to ensure the scheme is voluntary, safe and respects privacy.” The Information Commissioner’s Office (ICO) said it was “assessing the potential data protection implications of this proposed scheme and is monitoring developments”. Some establishments will find it easy to follow the guidance. Since all customers must be seated, many bars will require reservations, creating a list of customers’ contact details. Online booking services such as OpenTable provide secure systems on which to store data. In New Zealand, where a similar requirement was implemented in late March, businesses without online bookings were asked to record customers’ full names and phone numbers or email addresses on paper forms. The registers would be destroyed after eight weeks, according to the New Zealand privacy commissioner. The system still led to privacy breaches. One woman found herself at the receiving end of numerous approaches, friend requests and text messages from a Subway sandwich maker, who had taken her name from his store’s contact-tracing form. “I felt pretty gross, he made me feel really uncomfortable,” the woman, identified as Jess, told the Newshub website in May. In late May, New Zealand’s register system was superseded by a more sophisticated approach that asked customers to scan a QR code upon entering a shop or restaurant to register their attendance. No such system has been set up in the UK. “The sad reality is that people’s contact details could potentially be inappropriately handled by pub staff, opening consumers up to all kinds of privacy and security risks, including the potential of stalking or other unwanted criminal activities,” said Ray Walsh, a digital privacy expert at security site ProPrivacy. “These privacy risks are particularly concerning in regards to women, minorities and other vulnerable or discriminated-against groups who could find themselves targeted or harassed.” The ICO said businesses were not exempt from data protection rules, even under the current circumstances. “We understand businesses may need to take steps to help manage the risk of spreading Covid-19 to their staff and customers as they begin to reopen,” a spokesperson said. “Key data protection principles must be considered so that people’s data is handled responsibly. This includes only collecting personal data that is necessary, making sure that it is not retained for longer than needed and keeping it secure. Organisations must also tell people how and why they need to use their personal information.”