Eleven restaurants used common registration forms or logbooks, rather than individual forms for customers to register their visits during the pandemic, the Office of the Privacy Commissioner for Personal Data says.
Patrons to eateries can choose to register their personal information on forms as an alternative to using the LeaveHomeSafe app to comply with contact-tracing procedures.
The latest discovery came after the privacy commissioner received 15 complaints against restaurants for failing to protect customers' privacy.
Some of the 11 restaurants that failed to use individual forms were in Admiralty, Mong Kok, Discovery Bay, Causeway Bay, Tsuen Wan, Tai Hang, Tuen Mun, Sha Tin, Yau Ma Tei, North Point and Sheung Shui, the office said.
Another three failed to set up collection boxes for forms, left them in the open and used uncut sheets of paper as forms. The office said although the restaurants had subsequently taken remedial actions, privacy commissioner Ada Chung Lai-ling warned them to better protect customers and take steps to avoid recurrence in the future.
"These measures include providing written policy and guidance to staff, as well as circulating [it] regularly and providing training to raise awareness of their staff to the protection of personal data privacy."