Collecting personal information: COVID-19 guidelines

For questions about the requirement that you collect information, contact Environmental Health Services.

Email: environmental.health@gov.yk.ca

Phone: 867-667-8391.

For questions about your legal obligations under Personal Information and Protection of Electronic Documents Act (PIPEDA), contact the Office of the Privacy Commissioner of Canada.

Phone: 819-994-5444

Phone toll free: 1-800-282-1376.

Help us with contact tracing

Yukon’s Chief Medical Officer of Health has directed businesses to collect information from guests to help with COVID-19 contact tracing. The places that need to collect this information are:

  • restaurants;
  • bars;
  • pubs;
  • lounges; and
  • nightclubs.

The CMOH may also recommend that specified establishments collect guest information. If so, establishments should follow these guidelines.

What information must be collected?

You must collect from 1 guest in the party:

  • the date and time of their visit;
  • their full name;
  • their email address;
  • their phone number;
  • the number of people in the party; and
  • the location of the visit.

Who does not have to collect guest information?

  • Quick service sit-down restaurants where people order and pick up their food at a counter.
  • Bars and restaurants if guests enter only to pick up a food order or to buy beverages (for example off-sales or take-out orders).
How to collect information

Inform your guests

You must collect personal information when guests enter your business. At the time you collect personal information, you must tell your guests why you’re collecting their information.

You must inform your guests that you’re collecting the information as directed by the Chief Medical Officer of Health. Tell your guests that the information will only be given to Yukon Communicable Disease Control for COVID-19 contact tracing. Post this public notice where guests will clearly see it upon entry.

Get consent

A guest consents to providing their information if they provide it after you explain why you’re collecting it.

Be sure that they understand what they’re consenting to. Direct their attention to the notice, or explain it to them if you are not sure they understand.

Protect personal information

The personal information you collect must not be seen by other guests. The information should only be seen by staff who need to handle this information for the purpose of:

  • collection;
  • disclosure; and
  • disposal.

Do not let customers write down their own information. You can use this sheet to collect customer information. Staff must fill out the sheet and keep it out of view. When the sheet is not being used, it must be stored in a locked cabinet or office.

The information you collect must also be protected from unauthorized disclosure. This means do not share it with staff who do not need to see the information, such as kitchen staff.

Who collects information?

Only staff members authorized to collect the information should collect it. Those staff members should make sure that only authorized staff have access to the information.

Where you should store the information

Store the information collected on paper in a locked:

  • file cabinet; or
  • office.

Restrict access to these secure locations to staff authorized to access the information. Store information collected electronically in a location that's:

  • password-protected; and
  • secure against unauthorized access by guests or staff.
How to disclose, use, store and dispose of information

Disclosure of information

Only give the information to Yukon Communicable Disease Control (YCDC).

  1. Ask for verification of the person’s status as a YCDC employee before giving them any information.
  2. Give them only what they ask for.
  3. Keep a record of what you disclosed to them.

Use of information

Do not use the information collected for any purpose other than to provide it to YCDC. For example, do not use the information for your business’s customer relations or marketing.

Disposal of information

You must destroy the information 30 days after you collect it. The only exception is if you need to keep it longer to fulfil your legal obligations under Canada’s Personal Information and Protection of Electronic Documents Act (PIPEDA). For example under PIPEDA, if a person asks for access to or a correction of their personal information, you may need to keep their information until you’ve completed their request.

Make sure that your method of destroying the information does not allow for reconstruction of it. 

If using paper:

Shred the paper before putting it in a garbage or recycling bin.

If using an electronic format:

Delete information from all storage devices. Delete electronic trash or recycling bins to ensure the information is permanently deleted. Because it can be difficult to permanently delete digital information, only collect information electronically if you know that you can permanently delete it.

Your legal obligation to collect and provide information

An Order made under the Civil Emergency Measures Act requires bars to close and restaurants to close for in-room dining. Ministerial authorizations allows bars and restaurants to reopen, so long as they meet guidelines established by the Chief Medical Officer of Health (CMOH). The CMOH has developed guidelines for reopening which directs all bars and restaurants to collect certain personal information. The CMOH has the authority to issue this direction under the Public Health and Safety Act.

Failure to comply with a Ministerial Order (for example, a CMOH direction) could result in:

  • a fine of up to $500; or
  • imprisonment of up to 6 months.
Authority for Yukon Communicable Disease Control (YCDC) to collect personal information

YCDC is subject to the Yukon Health Information Privacy and Management Act (HIPMA). Under HIPMA, for purposes of COVID-19 contact tracing YCDC is authorized to collect your personal information as necessary, and to:

  • keep it
  • use it; and
  • disclose it. 

YCDC must limit its use of information and protect it in accordance with HIPMA.

Legal requirements for businesses’ collection, use and disclosure of personal information

Businesses in Yukon that collect personal information for business purposes are subject to the federal Personal Information and Protection of Electronic Documents Act (PIPEDA). This law defines “personal information” as information about an identifiable person. The Act describes how you can handle your customer’s personal information:

  • collection (when and how);
  • usage; and
  • disclosure.

In essence, the law requires that you:

  • get your customer’s consent to collect information;
  • secure the information from unauthorized disclosure; and
  • report any failure to protect their information.

Under the law you can only use or disclose the information for the purpose it was collected. You cannot share or use it for any other purpose without your customer’s consent. The Office of the Privacy Commissioner of Canada has guidance to help businesses comply with PIPEDA.

What should you do if a person refuses to provide their information?

The Minister of Community Services ordered that businesses collect this information from their customers. If you do not do this, it’s an offense under Yukon’s Civil Emergency Measures Act. If a person refuses to provide their information to you, you can refuse to serve them.

Yukon’s Chief Medical Officer of Health has directed businesses to collect information from guests to help with COVID-19 contact tracing. The places that need to collect this information are:

  • restaurants;
  • bars;
  • pubs;
  • lounges; and
  • nightclubs.

The CMOH may also recommend that specified establishments collect guest information. If so, establishments should follow these guidelines.

You must collect from 1 guest in the party:

  • the date and time of their visit;
  • their full name;
  • their email address;
  • their phone number;
  • the number of people in the party; and
  • the location of the visit.

Who does not have to collect guest information?

  • Quick service sit-down restaurants where people order and pick up their food at a counter.
  • Bars and restaurants if guests enter only to pick up a food order or to buy beverages (for example off-sales or take-out orders).

Inform your guests

You must collect personal information when guests enter your business. At the time you collect personal information, you must tell your guests why you’re collecting their information.

You must inform your guests that you’re collecting the information as directed by the Chief Medical Officer of Health. Tell your guests that the information will only be given to Yukon Communicable Disease Control for COVID-19 contact tracing. Post this public notice where guests will clearly see it upon entry.

Get consent

A guest consents to providing their information if they provide it after you explain why you’re collecting it.

Be sure that they understand what they’re consenting to. Direct their attention to the notice, or explain it to them if you are not sure they understand.

Protect personal information

The personal information you collect must not be seen by other guests. The information should only be seen by staff who need to handle this information for the purpose of:

  • collection;
  • disclosure; and
  • disposal.

Do not let customers write down their own information. You can use this sheet to collect customer information. Staff must fill out the sheet and keep it out of view. When the sheet is not being used, it must be stored in a locked cabinet or office.

The information you collect must also be protected from unauthorized disclosure. This means do not share it with staff who do not need to see the information, such as kitchen staff.

Who collects information?

Only staff members authorized to collect the information should collect it. Those staff members should make sure that only authorized staff have access to the information.

Where you should store the information

Store the information collected on paper in a locked:

  • file cabinet; or
  • office.

Restrict access to these secure locations to staff authorized to access the information. Store information collected electronically in a location that's:

  • password-protected; and
  • secure against unauthorized access by guests or staff.

Disclosure of information

Only give the information to Yukon Communicable Disease Control (YCDC).

  1. Ask for verification of the person’s status as a YCDC employee before giving them any information.
  2. Give them only what they ask for.
  3. Keep a record of what you disclosed to them.

Use of information

Do not use the information collected for any purpose other than to provide it to YCDC. For example, do not use the information for your business’s customer relations or marketing.

Disposal of information

You must destroy the information 30 days after you collect it. The only exception is if you need to keep it longer to fulfil your legal obligations under Canada’s Personal Information and Protection of Electronic Documents Act (PIPEDA). For example under PIPEDA, if a person asks for access to or a correction of their personal information, you may need to keep their information until you’ve completed their request.

Make sure that your method of destroying the information does not allow for reconstruction of it. 

If using paper:

Shred the paper before putting it in a garbage or recycling bin.

If using an electronic format:

Delete information from all storage devices. Delete electronic trash or recycling bins to ensure the information is permanently deleted. Because it can be difficult to permanently delete digital information, only collect information electronically if you know that you can permanently delete it.

YCDC is subject to the Yukon Health Information Privacy and Management Act (HIPMA). Under HIPMA, for purposes of COVID-19 contact tracing YCDC is authorized to collect your personal information as necessary, and to:

  • keep it
  • use it; and
  • disclose it. 

YCDC must limit its use of information and protect it in accordance with HIPMA.

The Minister of Community Services ordered that businesses collect this information from their customers. If you do not do this, it’s an offense under Yukon’s Civil Emergency Measures Act. If a person refuses to provide their information to you, you can refuse to serve them.