Hospitality businesses could be hit for six if they fall foul of the latest government pandemic legislation.

That is the warning from commercial lawyer Amy Peacey, who was reacting to changes governing the collection of data and social gatherings – the so-called “rule of six” – which come into effect next week.

Under the latest changes to the law announced by Prime Minister Boris Johnson, pubs, cafes, bars and restaurants have a clear duty to support the NHS Test and Trace system, while they risk closure if they operate in a way that increases the risk of transmission of Covid-19.

From Friday, 18th September it will be mandatory for hospitality businesses to have a system to collect Test and Trace data and to keep this for 21 days. Meanwhile, any businesses found to be facilitating indoor gatherings between multiple households, or of more than six people, can be closed by local authorities.

“There was a sigh of relief throughout the hospitality industry when venues were allowed to re-open on 4th July, but the Government guidance was not clear enough and the whole situation risked descending into a data protection nightmare,” says Amy Peacey, who is a senior associate specialising in commercial law in the Southampton office of national law firm Clarke Willmott.

“The easing of lockdown measures for these businesses came with a caveat – the fact that they were being asked to collect and store the contact details of their customers in order to assist with the NHS Test and Trace system, should it become necessary.

“The Government requested that businesses keep a temporary record of their customers for 21 days but this is now mandatory and subject to penalties for non-compliance.

“As the numbers of people testing positive for Covid-19 begins to edge up again this represents a welcome clarification of the situation, as do the more stringent penalties for breaching the new ‘rule of six’ guidelines governing social gatherings.

“Taken together, the message is clear – failing to abide by the new legislation could be terminal for many businesses which are already operating in a sector which is already under severe financial pressure.”

Amy Peacey says that, having become data collectors since 4th July, hospitality businesses are subject to data protection rules under the Data Protection Act 2018 and the General Data Protection Regulations (GDPR).

“This means you must make sure that any personal data collected for compliance with Covid-19 requirements is not used for any other purpose, such as sending marketing communications about offers or promotions.

“When collecting personal data from your customers only take what you need, such as a name and telephone number/email address, and you must also provide your customer with a privacy notice setting out why you are collecting the data and what you will be doing with it.

“In addition, hospitality businesses need to have in place clearly documented processes for how they will collect, store, and dispose of customer personal data, while ensuring that all employees are aware of and follow the required processes.”