Designated venues in certain sectors are required to have a system in place to request and record contact details of their customers, visitors and staff to help break the chains of transmission of coronavirus. From 24 September, venues in hospitality, the tourism and leisure industry, close contact services and local authority facilities must, inter alia, display an official NHS QR code poster so that customers and visitors can ‘check in’ using this option as an alternative to providing their contact details.
In some circumstances, these provisions are applicable to places of worship, and on 23 September, the Church of England issued comprehensive guidance. This post summarizes:
Our post New COVID-19 legislation and guidance to 19 September included three items of relevance to QR Codes:
- The Health Protection (Coronavirus, Collection of Contact Details etc and Related Requirements) Regulations 2020, SI 2020/1005. [“Data Collection Regulations”].
- The Health Protection (Coronavirus, Restrictions) (Obligations of Hospitality Undertakings) (England) Regulations 2020, SI 2020/1008. Requires certain undertakings in the hospitality industry, to take measures to ensure that their customers follow the rules on social distancing. [“Social distancing regulations]
- Maintaining records of staff, customers and visitors to support NHS Test and Trace, [“DHSC Guidance”], 18 September.
The ambit of the Data Collection Regulations concerns the provision of “listed services” by “relevant persons” who occupy “relevant premises” (definitions in regulation 4). Further provisions related to premises which are hired, or used by more than one person on a temporary basis. Regulation 6.(1) states
“A relevant person must in an appropriate place display and make available a QR Code [defined in regulation 4 as meaning “a dynamic quick response (QR) code developed by, or on behalf of, and issued by, the Secretary of State”] at relevant premises that they occupy or operate with a view to achieving the aim in paragraph (2).
(2) The aim is to enable an individual who seeks to enter the relevant premises in a case set out in regulation 9 and has a smartphone in their possession to scan the QR code with that smartphone as, or immediately after, they enter the premises.
Part 1 of the Schedule provides a non-exhaustive list of “listed services” including: (a) restaurants, including restaurants and dining rooms in hotels or members’ clubs; (b) cafes, including workplace canteens; (c) bars, including bars in hotels or members’ clubs; (d) public houses.
Part 2 includes: leisure and tourism services, provided by or at various categories of establishment ; those providing “close physical contact services” ; and services provided for social, cultural and recreational purposes in the following premises . This last group includes: (a) community centres; (b)youth and community centres; and (c) village halls.
The Guidance COVID-19 NHS Test & Trace Data, v4 was issued on 23 September and updates an earlier version. The text has been revised to reflect the change in legal status which makes collecting data mandatory in some circumstances, and to give information on the Test & Trace app. It notes that it should be read alongside the advice from Government on collecting data for NHS Test & Trace and for places of worship. Extracts relating to the legislative requirements are reproduced below [emphasis added]:
2. Should churches take part in Test & Trace?
Places of worship are not covered in legislation requiring use of the NHS Test & Trace service, (except where they offer certain facilities such as a café, or are open as a tourist destination; see question 5 below). However, along with other venues where people spend time, churches are strongly encouraged to keep a record of those who have attended to facilitate NHS Test and Trace in the event of an outbreak of coronavirus. Participating in Test & Trace will help to slow the spread of Covid-19.
5. Under what circumstances do churches legally have to take part in Test & Trace?
- Under the Health Protection (Coronavirus, Collection of Contact Details etc and Related Requirements) Regulations 2020 churches and cathedrals only have a legal requirement to enable and require the collection of data when they are being used for specific non-worship purposes. These are:
- Leisure and tourism services, provided by or at heritage locations and attractions open to the public;
- Services provided for social, cultural and recreational purposes in youth and community centres and village halls.
- Hospitality services, including cafes and restaurants, where food or drink is served that is intended to be consumed on the premises (the consecrated bread and wine consumed as part of a Communion service, and takeaway venues, do not come under this regulation).
- If you are open to tourists or casual visitors, are open to the public for any purpose not connected to worship, or are running a community centre or hall, you are required by law to display an NHS Test & Trace poster. Visitors should be encouraged but cannot be forced to give their details.
- Groups categorised as formal support groups, such as bereavement groups, employment drop ins etc. do not come under the categorisation of social, cultural or recreational purposes, and so do not come under the legal requirement to display a poster. Nevertheless you may wish to display a poster and offer people the option to check in.
- If you are running a service providing facilities for consuming food or drink on the premises (including food given out for free that is intended to be eaten on site, but excluding the consecrated bread and wine consumed as part of a Communion service) then you are subject to stronger regulations. You must take all reasonable steps to prevent access to an individual who refuses to provide the requisite details in a
hospitality venue such as a café or restaurant. You should make this clear to visitors, perhaps with a sign indicating this at the entrance to hospitality areas.
6. How an churches start encouraging visitors to use the NHS Test & Trace app?
- Churches can generate a poster with a unique QR code for their building by visiting this website: https://www.gov.uk/create-coronavirus-qr-poster.
- At least one poster should be available on the entrance of the building, in a place that is easy to see and convenient for visitors including those in wheelchairs and those with other disabilities. Multiple copies can be produced for different entrances and different size options are available.
- Visitors will not be able to scan other QR codes with the NHS Covid-19 app because they use a different type of technology. If you need to continue with your own QR code system for non-contact tracing reasons, you must remove any NHS, NHS Test and Trace, or ‘NHS Test, Trace, Protect’ logos to avoid confusion for app users which would result in them failing to log in via the official code and miss potentially important public health messaging.
- There is a dedicated FAQs page on the app which may answer any more questions you have.
7. What about people who cannot or do not want to use the app?
- It is important to provide an alternative way of giving details for those who wish to do so. In collecting this data you need to let potential participants know what you are intending to do with their details, when these might be accessed by NHS Test and Trace and clearly get their consent for this purpose. You can, for example, use a consent form and display a privacy notice at your premises or on your website.
- Privacy Notice templates for display in buildings and for online use together with a version of the Government template consent form are available here, which you can adapt and use. Please note you must amend the template as indicated for it to be specific for your church. If you are unsure about details, please seek advice from your Data Protection Officer or lead contact for data protection.
- As an alternative to completing the consent form the Government and the Information Commissions Officer have advised that an explanation of why the data is being collected from the top of the consent form can be read out in the service or to the individual coming into the building and their name, telephone number, date/time and an explicit tick to indicate their consent to their data being used for NHS Test and Trace. For staff and those who volunteer working in the building they can have their attention drawn to the wording of the Privacy Notice or wording on the consent form and record their name, telephone number, date/time and an explicit tick to confirm consent on a sheet when they enter.
- The information that should be collected is:
- the name of the individual;
- a telephone number on which the individual may be contacted;
- an e-mail address if the individual is unable to provide a telephone number;
- a postal address if the individual is unable to provide an email address;
- the date and time that the individual entered the relevant premises;
- where the individual is a member of a group, the number of people in that group (including any member of the group that has scanned a QR Code when seeking to enter the relevant premises)
- Any information collected should be stored and deleted after 21 days in a way that does not risk unintended access (e.g. shredding paper documents and ensuring permanent deletion of electronic files).
9. What about recording consent for children?
- The Government guidance states that young children should be supervised by a parent or guardian when coming to a place of worship. If you are collecting data for NHS Test and Trace the details of the parent or guardian of an accompanied young person or child need only be collected. The app cannot be used by people under 16.
- For unaccompanied children or young people aged 13 years old or over, they can be asked to provide their details and sign the consent form, or make an individual booking where consent is required. …
- Where young people or children are coming unaccompanied then we would advise consulting Safer Environment and Activities from the National Safeguarding Team and adding a safeguarding assessment as part of the overall risk assessment for opening, particularly sections 1.3 on risk assessment and 2.10 on young people who attend church activities without their parents.
10. Do we need to check that people have provided their information, either through the app or via an alternative system?
No. You are strongly encouraged to provide ways of people registering, but there is no obligation to check they have done so. The only exception to this is if people are coming into a restaurant or café where they will be sitting down to eat or drink where it must be made clear to them that they are required by law to give details.
11. Should people be refused entry if they don’t want to give their details?
No, unless it is at a café, restaurant or other place where food or drink is served (excluding the consecrated bread and wine consumed as part of a Communion service). There is no legal obligation to provide details for Test & Trace unless you are entering a restaurant, café, or similar type of hospitality venue. If someone does not wish to give information they may choose to opt out. They should not be barred from worship.
12. Should we have different QR codes for different parts of our buildings?
- In most cases one QR code will be sufficient, although you might want to print multiple copies of the poster so you can have one at each entrance.
13. Should we have someone on duty to tell people about Test & Trace?
It is suggested that for worship someone be available at the entrance to help facilitate the collection of the data, but this is not required. You can leave your building unattended with the poster on display.
14. What to do if the NHS contact you.
Contact tracers will:
- call you from 0300 013 5000
- send you text messages from ‘NHStracing’
- ask you to sign into the NHS Test and Trace contact-tracing website
Contact tracers will never:
- ask you to dial a premium rate number to speak to them (for example, those starting 09 or 087)
- ask you to make any form of payment or purchase a product or any kind
- ask for any details about your bank account
- ask for your social media identities or login details, or those of your contacts
- ask you for any passwords or PINs, or ask you to set up any passwords or PINs over the phone
- disclose any of your personal or medical information to your contacts
- ask about protected characteristics that are irrelevant to the needs of test and trace
- provide medical advice on the treatment of any potential coronavirus symptoms
- ask you to download any software to your PC or ask you to hand over control of your PC, smartphone or tablet to anyone else
- ask you to access any website that does not belong to the government or NHS
Other issues covered by this advice include:
- What is NHS Test & Trace? 
- What is the best way of collecting Test & Trace data? 
- How does Test & Trace app work? 
- How do people scan the QR code on a Test & Trace poster?