Stay correct on Test and Protect

It is essential that operators understand what’s required

Test and Protect is now a legal requirement for Scottish premises

IT looks like a very straightforward requirement. Hospitality businesses are now under a legal obligation to collect customers’ contact details to support the NHS Test and Protect service.

However, as we’ve come to expect, the effect of the regulations isn’t quite so clear-cut.

In the first place, the expression “customers’ contact details” doesn’t properly capture what operators must do.

The regulations require the recording of “visitor information” so the requirement extends to anyone who steps over the threshold: not just customers, but also staff (including contract staff such as cleaners), delivery drivers and so on.

If premises operate purely as takeaways, the regulations don’t apply. They only cover “restaurants, cafés, public houses and hotels in which food or drink is sold for consumption on the premises”.

The Scottish Government guidance suggests that, “If a business offers a mixture of a sit-in and takeaway service, contact information only needs to be collected for customers who are dining in.” That’s not my interpretation.

The purpose of a visit to “on-consumption” premises isn’t relevant: if anyone steps over the threshold of “the premises” as defined above, the regulation kicks in. And because the premises to which the law applies covers “any building or structure and any land” it includes those only visiting outdoor areas.

A customer ordering a carry out meal could easily be sitting in the premises for 20 minutes or more while the food is being prepared; and from a policy point of view it makes no sense at all to leave this type of visitor out of the system.

There’s also confusion surrounding the data capture where customers arrive in a group. Businesses should not be collecting information from the person appearing to be the “group leader”.

Instead, the focus is on household members. Staff should record contact details – name and telephone number – for “one member of each household” together with “a note of the number of any members of that person’s household” and the date and time of arrival. (There’s no requirement to keep a note of the time when visitors leave the premises).

Only staff intervention ensures that the details are properly recorded: quite apart from hygiene considerations, it’s not acceptable to provide an unattended paper register for customers to complete.

In relation to staff, you should be recording the names of those working at the premises (including casual and part-time workers), contact phone numbers and the dates and times when they are on shift. Remember that businesses must be registered with the Information Commissioner’s Office (www.ico.org.uk) if they gather and store data by electronic means.

Inevitably, there will be occasions on which a prospective customer will refuse to provide contact information. In such a case, according to the guidance, the individual should be encouraged to provide the details in order to support Test and Protect. He or she should also be advised that the information will only be used in the event of a COVID-19 outbreak or if a number of new cases is tracked back to the premises. But, while there’s no legal duty to comply, anyone refusing to do so must be refused admission.

I’m already hearing reports of the “Three Sturgeons” phenomenon, with the First Minister apparently attempting to gain entry to a pub on three occasions on the same evening. It’s not an offence for a customer to give false information but in my view it’s time to recognise that we all have a part to play here.

The trade is under an immense regulatory burden – a minefield, in fact – and creating an offence would send a signal to the public that they absolutely must play their part and take their responsibilities seriously.


Jack Cummins is one of Scotland’s leading licensing lawyers. Every month he writes on licensing law and answers readers’ questions in SLTN.

Do you have a legal question for Jack Cummins?

Email sltn@peeblesmedia.com or write to Legal Clinic; freepost PEEBLES MEDIA GROUP

Jack Cummins is unable to enter into personal correspondence on readers’ questions. The advice offered in SLTN is published for information only. No responsibility for loss occasioned by persons acting or refraining from action as a result of material contained in SLTN can be accepted by the author or publisher.