Cities on high alert in the face of the Covid-19 epidemic, restaurateurs saved
in extremis by a strict sanitary protocol, but still many questions for their customers.
Since Monday, thousands of restaurants in Paris and its inner city, Marseille, Aix-en-Provence and Guadeloupe have been forced to set up, among other measures, a reminder book.
This document, which the Ministry of Health supervised at least its operation on Monday, will "be put in place at the entrance to restaurants and will condition access to the establishment".
On the notebook, which can be handwritten or digital, "customers will leave their contact details" and the restaurant owner "will make it available to the Regional Health Agency or health insurance in the event of triggering of a contact-tracing. ".
Last precision of the ministry, and not the least: “In all cases, this data will be destroyed after a period of 14 days.
"
Collective notebooks, individual files or QR code
The collection method is left free.
Since Monday, some customers have therefore been required to enter their data (last name, first name, telephone number, even e-mail address) in notebooks, offering the occupants of neighboring tables to view this sensitive information.
Delighted to be able to collect at a glance all the names, first names and 06 of the customers who were eating around me in Japanese this afternoon pic.twitter.com/3S30MaP7Pk
- Michaël Szadkowski (@szadkowski_m) October 6, 2020
Restaurateurs have opted for individual files, while others have chosen to collect this data digitally, sometimes using a QR code to scan.
But who will have access to this data?
How to check that they are deleted after 14 days?
That they will not be used for sales canvassing or any other derivative use?
These collections of personal information raise many questions about their protection, normally framed by the GDPR (general data protection regulation).
Especially since the precedents in Germany, where this notebook has been in place for several weeks, attest that abuses are possible.
According to the newspaper Der Spiegel, entrepreneurs took advantage of access to these notebooks to create a file and send newsletters.
The daily also evokes the setbacks of this lawyer having been contacted by a court employee who frequented the same restaurant as him.
"A support created in an emergency"
Neither the Ministry of Health, nor the Paris police headquarters, nor the regional health agencies, have, for the time being, responded to our requests for the legal framework put in place in France.
The CNIL (National Commission for Informatics and Freedoms), authority responsible for the protection of our data, indicates for its part that a "reflection is underway" and that a committee is meeting this Wednesday to look into this. point.
Proof that the issue of supervision is still far from being resolved.
READ ALSO>
Covid-19: three questions on the tracing of customers of restaurants and cafes
“Under an innocuous and simple appearance, it is complicated: we set up a full-fledged data processing, which the restorer has the obligation, with a support created in the emergency, which perhaps does not have always been well understood, according to the obligations of the RGPD ”, analysis with the Parisian Véronique Rondeau-Abouly, lawyer specializing in the protection of personal data, in Marseille.
Newsletter - Most of the news
Every morning, the news seen by Le Parisien
I'm registering
Your email address is collected by Le Parisien to enable you to receive our news and commercial offers.
Learn more
For restaurateurs, setting up these notebooks should simply show common sense.
“It's a question of citizenship.
Obviously, our professionals must keep this register at the reception area, but they must ensure that it is not available for consultation by customers ”, supports Franck Trouet, spokesperson for the GNI (National Group of Independents) , about this reminder book on which his organization has been working since the end of the summer.
"We are not interested in coping our customers!"
"
Me Véronique Rondeau-Abouly recommends that traders inform their customers, by means of a document left at the entrance or on the menus, of the legal necessity and the precise purpose of this collection of information.
“Customers should not have access to this data,” she also insists.
In an emergency, the best is to have one file per table, then slipped into a binder, which will only be consulted by the manager or a specific person deemed responsible for the confidentiality of the data.
"
The question of their access by all the servers, or only by designated persons, has not in fact been developed by the Ministry of Health.
“In each company, there is a Covid referent.
It would be legitimate for him to be in charge of this register ”, judge Franck Trouet, of the GNI.
He also insists on the desire to “respect the rules of confidentiality” on the part of restaurateurs and the refusal of misuse: “We are not interested in coping our customers!
"
“There is no way we can market this data.
The question does not even place itself.
It will only be useful in the event of a cluster ”, abounds Franck Delvau, co-president general Paris of the Union of trades and industries of the hotel industry (Umih), rather in favor of the use of a“ paper notebook that 'we will throw in the trash after 14 days'.
A fine for abusive canvassing
According to Franck Trouet, the prefectures could also carry out checks, in order to verify that this deletion after two weeks is indeed effective.
In the event of abusive canvassing of a customer, the restaurant owner faces sanctions of several types, also recalls the lawyer Véronique Rondeau-Abouly.
“He may incur a sanction from the CNIL, with an obligation of publicity, but also an administrative fine.
Illegal processing of this data can also lead to civil liability, even criminal liability ”, she warns.
READ ALSO>
Paris: “Sir, where is your customer recall register?
"
Another possible diversion: that of the police services.
According to Der Spiegel, the Hamburg police, on the trail of the perpetrator of a knife attack, consulted one of these recall files as part of their investigation.
In France, one could imagine such a situation, legally.
"As with any other material element, nothing prevents them from being seized and used as part of a judicial investigation", argues with the Parisian the police headquarters of Bouches-du-Rhône.
The solution of digital applications?
To prevent this information from being too exposed to customers, applications such as Chef!
or Guestonline have set up digital reminder books for a few days.
"Our system makes it possible to retrieve the information of all the guests, not just those who have reserved on the Internet, while respecting the GDPR rules", assures Antoine Girard, general manager of Guestonline, convinced that "storing this data on paper risks to be hell for the restaurateur ”.
If the customer makes a reservation on the Internet, he enters his contact details and receives a link to add those of his guests.
Or the restaurant presents him with a QR code to flash, which refers to a form to fill out.
"These data are stored in a separate database, not accessible by the restaurant, which only has the possibility of exporting the file and transmitting it to the ARS", explains Antoine Girard, who guarantees that "after 14 days , all contact details and information on the guests are automatically deleted.
"But here too, underlines the expert lawyer in data collection," this application must be accepted by digital control agents and that we have proof that the data is indeed erased.
The restaurant also has the option of offering its customers to keep this information for commercial use, but the box is unchecked by default, says the managing director of Guestonline.
The latter is convinced that the simplest for this data collection would be a massive use of the StopCovid tracing application.
"The customer would only give his identifier and, like that, the restaurant owner would not keep his data", he explains.
A very illusory proposal, while StopCovid has, to date, been downloaded by only 3 million people, or less than 5% of the French population.