Restaurant and café owners should be storing contact tracing details of customers securely, out of sight of other clients.
That is the view of the Data Protection Commission, after some concerns were expressed over the current practice.
The details have to be kept securely for contact tracing purposes only.
In an exclusive interview with Newstalk's technology correspondent Jess Kelly, Deputy Commissioner Graham Doyle told The Hard Shoulder business owners need to make sure details are stored away from other customers.
"Firstly I'd say that businesses they should only ask and retain the information that's required.
"There's no requirement to obtain any information beyond the name and contact details of the person who's making the booking.
"And as well as that the time and the date of the party's attendance at the venue.
"Also the customer's contact details, and this is really important, they should not be used for any other purpose.
"So they should not be given out to anyone except public health officials in the course of their own official inquiries into COVID.
"In terms of the storing of the contact details... I'm aware of some coverage recently where they're talking about there was some businesses who have been taking details at a door, maybe writing it on a sheet of paper and leaving the sheet of paper there visible for anybody to see.
"It has names, phone numbers, etc - so again, the storing is important.
"Whether it's manual or digital, it must be kept secure and confidential.
"So in circumstances where somebody is using a sheet of paper to record the information, they should use it, record the information if somebody walks into a premises - but then store the information away so as that a member of the public cannot see it.
"And the only people who are actually accessing it are the staff members themselves."
"I'd also recommend that these details, they should be stored separately to any other customer databases.
"This is important because the purpose of why this is being done is just for COVID and for contact tracing.
"So just to be careful that... it's not used for other purposes, such as direct marketing."
"We often see organisations they have client lists and they will direct market with consent through SMS or e-mail.
"So just to be careful: store it separately from these kind of databases, and also make sure that they only retain the information for as long as is necessary and under the guidelines - what's been set is it's currently one month.
"So therefore after one month, these contact details should be deleted or securely destroyed if they're kept in hard copy".
"The final thing to say on it is... when making a booking, the customers should always be informed that their contact details are being taken and that they will be retained for the contact tracing purposes".
