Cafés violating customer privacy with Covid contact data

Since early in August, catering establishments in the Netherlands are obliged to take down customers' names and telephone numbers, so that they can be informed in case of a coronavirus outbreak. But not all cafes, restaurants, and bars are equally careful about their customers' privacy. The Dutch data protection authority AP received dozens of reports of lists of telephone numbers going from table to table, unwanted advertisements, and even numbers being used for "romantic" purposes, the Volkskrant reports.

Shortly after leaving a cafe on Saturday evening, a Volkskrant journalist received a WhatsApp message: "Had a nice evening?" It was sent by the bartender from the cafe that she had just left. The 21-year-old woman hadn't given him her number. He got it from the registration list for source and contact research. 

Professor of privacy law Frederik Zuiderveen Borgesius gave the newspaper another example. Say the Prime Minister is having a bite to eat at the table next to you and his number is on the registration list being taken from table to table. "Two very important values contrast here: privacy and public health. The most important question then is: is the measure effective enough to restrict privacy."

The privacy law AVG exists to guarantee that every individual has a degree of control over their own personal data. Gerrit-Jan Zwenne, professor of privacy law at Leiden University, told the newspaper that it is therefore extremely important that catering entrepreneurs handle their duty carefully and do not misuse the contact details of their clients. "If you fill it out because of this major health crisis and for public interest, then you should not be bothered afterwards with completely different things," he said. "It is really different if you yell from the rooftops on Facebook that you've eaten a sandwich on the Plein in The Hague, than if an entrepreneur of a restaurant announces it for you from such a list without you being asked."

Hospitality association KHN published several examples of how catering entrepreneurs can collect this data without violating privacy law, such as writing the details down on lose pieces of paper and without others being able to see it, a spokesperson said to the newspaper. The association also warned entrepreneurs against "smart constructions" to use data for other purposes, such as marketing. "That damages confidence," KHN said.