Contact Tracing guidance

Stage 2 of the Bailiwick's 2021 Exit from Lockdown framework requires some organisations to collect information from anyone visiting their premises. This information is personal data and is protected by The Data Protection (Bailiwick of Guernsey) Law, 2017.

If you are a local organisation affected by these requirements, please take time to work through the following action list: 
 

1. Read the relevant government guidance carefully. 
2. Register with the Office of the Data Protection Authority, if you are not already. 
3. When using the government template forms (‘Sample Data Collection Form’ and ‘Sample Fair Processing Notice’ both available via: Stage 2 of the Bailiwick's Exit from Lockdown) to collect the information, ensure these are updated with your own organisation’s details and clear information about: 
   - why the information is needed, 
   - how it will be handled, 
   - and the legal basis* for the collection
4. Only collect the information specified by government: name, telephone number, date of attendance. 
5. This information must only be used for contact tracing purposes so should be kept separate from other information which may be collected even if it is similar in nature (e.g. restaurant bookings).
6. Ensure that the information collected, whether in hard copy or electronic form, is only available to authorised staff. 
7. Ensure that the information collected, whether in hard copy or electronic form, is held securely for the period defined by government (currently 14 days as specified on page 13: Guidance for businesses for operation under Recovery Stage 2). 
8. Ensure that the information collected, whether in hard copy or electronic form, is destroyed securely at the end of the above period defined by government. 
9. People have a legal right to know why their information is needed and what is going to happen to it. Take the time to explain this to them if they want to know more.

 
Find more information about data protection compliance requirements. 

More information about people’s rights over their data. 
 

* these are the legal bases government are using (extract taken from Sample Fair Processing Notice on 4 March 2021): 

• The processing is necessary for MoH to exercise her powers or perform her duties under the Emergency Powers (Coronavirus) (Bailiwick of Guernsey) Regulations, 2020; 
• The processing is necessary for reasons of public health and is carried out with appropriate safeguards for the significant interests of data subjects; 
• The processing is necessary for a law enforcement purpose, specifically safeguarding against or preventing public threats to security; and 
• The processing is necessary to protect vital interests of the individuals and those who they may pose a risk of contaminating.