Virus checklist sparks privacy concerns for patrons visiting pubs, cafes and restaurants

The collection of personal data at cafes, pubs and restaurants to notify patrons of a potential coronavirus outbreak has sparked privacy concerns.

Since lockdowns began to be eased around the country businesses are required to keep contact information for all customers, workers and contractors, including names, addresses and mobile phone numbers for at least 56 days.

It's part of the COVID Safe Checklist where the information is to be "captured and stored confidentially and securely".

This is to ensure that if there is a COVID-19 outbreak in the establishment, they are able to easily contact anyone who visited during that time period and make sure they are tested and the virus doesn't spread.

But many businesses have turned to paper forms, often in books or spreadsheets, allowing other patrons to see the personal data.

It's prompted privacy concerns with calls for more specific rules about collecting and storing information.

Civil libertarians claim other patrons can easily access your name, address and phone number, allowing anyone to keep tabs on who has been there throughout the day.

While some establishments say they are locking the lists up in a safe area, others are simply keeping it up on a desk or in public view for days on end.

Australian Information Commissioner and Privacy Commissioner Angelene Falk said "the information should not be visible to other customers".

"It is important that personal contact details are kept private," Ms Falk told Today.

Customers' details should be "put into a safe place and that it's only disclosed to state authorities if requested for contact tracing purposes".

"There's obligations on these businesses to make sure that the information is secured and it's not used for other purposes," Ms Falk said.

"It shouldn't be used for direct marketing or other business purposes. It's important that businesses that are being entrusted with this personal information do keep it safe and only use it for those public health purposes."

Once the information is kept for the required time, businesses should then destroy it securely, she said.

"That means putting it through a shredder, having a responsible records disposal unit come and take that information, not putting personal information in ordinary bins or recycle."