Privacy Commissioner John Edwards is warning the hospitality and retail sectors against using contact tracing apps or web-based solutions that ask for too much personal information, including whether a customer has had Covid-19.

Mr Edwards says his office has published a stocktake of contact tracing apps that generally do a good job of helping a business meet their obligations under the health regulations.

“The apps we looked at work without being too intrusive or by putting sensitive information at risk. But if a bar or restaurant is asking a customer, as a condition of entry, to declare through a third-party app or website what, if any, medical conditions or symptoms they have, or any exposure to Covid-19, they could be at risk of breaching patrons’ privacy.

“It’s hard to see why a café or restaurant would need to use a service that scans and retains a copy of an identity document or keeps a record of a vehicle registration or clinical information.

“Business shouldn’t be collecting information about Covid-19 symptoms, as you need clinical expertise to be able to do anything useful with that information.”

Advice on how much information a business can ask for its contact tracing register can be found here.