COVID – 19: PRIVACY OBLIGATIONS OF VICTORIAN CAFES AND RESTAURANTS
We are noticing a potential second wave of the COVID-19 outbreak in Victoria. However, businesses, cafes and restaurants are so far allowed to operate.
As businesses re-open across Victoria, cafes and restaurants are starting to collect customers personal information to assist COVID-19 tracing and undertake compliance in order to remain open.
With such strategies being implemented, owners need to turn their minds to any privacy implications that may exist.
From the moment the Andrews Government loosened the restrictions allowing cafes and restaurants to operate at a limited capacity, owners commenced requesting customers provide their first name and phone number when attending a venue for more than 15 minutes. Venue operators then store a register on site for at least 28 days after a customer’s visit.
Since the 22 June 2020, when cinemas, gyms and other venues have reopened, the obligation has applied more broadly. The obligation now applies to all visitors, customers, staff, maintenance and delivery workers.
Businesses with annual turnover of $3million are subject to the Privacy Act 1988 (Cth) and can be subject to penalties if they don’t comply with their legal obligations in collecting personal information to trace COVID-19. Cafes and restaurants who are subject to the Privacy Act, must take reasonable steps to ensure that personal information is not misused, interfered with, lost, modified, disclosed, or accessed without authorisation. If patrons are told that the reason for collecting their personal information is for the purpose of COVID-19 tracing, then such personal information must not be used for any other purpose. As such, should a cafe and restaurant owner believe that the information that is used for COVID-19 tracing can also be utilised for marketing purposes, then they may find themselves in breach of the Privacy Act.
If cafes and restaurants are using electronic booking systems, then they need to ensure that such customers are not automatically added to their marketing list. Under the relevant government health direction, the contact tracing information must be securely stored and only used for or disclosed as requested by an officer under the Public Health and Well Being Act 2008 (Vic).
As businesses reopen across the country, many venues are collecting customer personal information to assist COVID-19 tracing efforts. As such, cafes and restaurant owners need to be vigilant as to what is required by them under privacy regulations and the Public Health and Well Being Act.
It has been seen that COVID – 19 is still lingering in Victoria. Everyone needs to be cautious and continue to comply with the social distancing requirements to ensure that we all help stop the spread.
This article is intended only to provide a summary of the subject matter covered. It does not purport to be comprehensive or to render legal advice. No reader should act on the basis of any matter contained in this article without first obtaining specific professional advice.
DISCLAIMER: We accept no responsibility for any action taken after reading this article. It is intended as a guide only and is not a substitute for the expert legal advice you can get from De Marco Lawyers and other relevant experts.