Schleswig-Holstein: ULD issues guidance on contact-tracing measures for hospitality sector
The Schleswig-Holstein State Commissioner for Data Protection ('ULD') issued, on 28 August 2020, guidance on privacy requirements under the Corona Combatting Order of Schleswig-Holstein ('the Order'). In particular, the Order requires businesses in the hospitality sector to collect contact data of their customers, which has led to privacy concerns in the past. Specifically, the ULD stated that in cases where businesses operate manual lists, the data may only be stored for four weeks and must be physically destroyed afterwards. Furthermore, the ULD noted that if businesses use a digital method for contact data collection, they often need to rely on service providers, furthermore warning that in the past several data breaches have taken place following contact data collection by this means. In addition, the ULD highlighted that digital data collection methods are not always accessible for all customers because some customers may not own a smartphone or be able to submit their data through the use of an app. Therefore, the ULD stated that businesses in the hospitality sector must always provide a manual option for the contact data collection.
You can read the guidance, only available in German, here.