This instrument introduces a statutory requirement requiring designated venues to collect certain contact details mainly from customer, visitors and staff (as set out in the regulations), store this information for 21 days, and share it with NHS Test and Trace or local public health officials, if requested.

In particular, this instrument imposes requirements to facilitate contact tracing such that NHS Test and Trace can more easily contact individuals who may have been exposed to the virus and provide them with appropriate advice.  This instrument will facilitate this by, in summary, requiring specified persons to display a QR code and which will log the person’s entry to the premises on their phone). 

The Regulations provide for this as follows:

• Regulation 5 provides that the regulations apply to specified persons who operate or occupy specified premises. Specified persons is defined in regulation 4, and specified premises are those that are occupied wholly or in part for the purposes of providing a service listed in the Schedule.  Regulation 5 also provides that the requirement in regulation 16 (which is to deny entry in particular cases), does not apply where a specified person is providing a service in Part 2 of the Schedule.

• Regulations 6 to 9 set out the obligations on specified persons regarding the displaying of the QR Code and requesting certain information. In particular, the requirement to display a QR Code is set out in regulation 6.

• Regulation 7 provides the requirement to request certain details where an individual seeks to enter specified premises to access a service or activity or to provide a service or activity (see regulation 9), unless that individual is under 16 or has a mental or physical disability that means they are unable to provide the details. This will include customers, staff members and visitors, subject to a number of exemptions.

• Regulation 8 sets out the requirements relating to where a group of individuals seeks entry. In particular, where all members of the group use the QR code, the specified person need not request any further contact details.  Otherwise, the specified person must request contact details from one person in the group, (up to a maximum of 6 in the group) or contact details from all those who haven’t checked in using the QR code. 

• Regulation 9 also provides a number of exemptions. Contact details (or use of the QR code) need not be requested from a constable or police community support officer or an emergency responder, acting in the course of their duty.  There are also exemptions in respect of visitors who simply make deliveries.

• The contact details to be requested are provided in regulation 10, namely, the name and surname of the individual, their telephone number or, where they do not have one, their email address or failing that a postal address. The date and time of entry should also be noted.

• Regulation 11 also provides that where the individual will only come into contact with one member of staff, volunteer or those providing the service, the name of that person, as well as the name of the individual who was in contact with that member of staff, should also be taken (unless the individual used the QR code).

• Regulations 12 to 15 set out how any details collected must be stored, disposed of or disclosed. In particular, where details are requested and obtained, the specified person must keep them securely for a period of 21 days and dispose of them as soon as reasonably practicable thereafter, unless there is a lawful basis for them to retain them.  The specified person must disclose all or some of the details to the Secretary of State as soon as reasonably practicable where the Secretary of State makes such a request for the purposes of contact tracing.

• Regulation 16 provides that a specified person as set out in Part 1 of the Schedule, (principally pubs, cafes, restaurants and private members’ clubs where the main purpose of entry is to consume food and drink on the premises), must take all reasonable steps to refuse entry to an individual who has not provided the requisite details or where none of the group has done so in accordance with the requirements. This regulation also applies where the details provided are incomplete or the specified person believes they are inaccurate.
• Regulation 17 provides that a person who contravenes any of the requirements commits an offence punishable by a fine. The instrument (see regulation 18) provides that a fixed penalty notice (a notice which enables a person to discharge their liability to criminal conviction) may be issued by an authorised persons to anyone over the age of 18 whom they reasonably believe to have committed an offence under the Regulations. The amount of the first fixed penalty is £100, reduced to £50 if paid within 14 days of a notice being issued. The amount then doubles for each subsequent penalty notice, up to a maximum of £3200.