St Canna’s Ale House proprietor James Karran has apologized for “letting down the community” by messaging a woman who visited his bar using the contact details he’d obtained from her Test and Trace input – the method by which customers who may have been in the proximity of a customer who subsequently tested positive for Covid can be contacted. The woman and her partner were outraged by the message, which they described as “creepy.”

“Just so you know, you’ve got a super-pretty face so you’re allowed not to wear a mask at the bar. Everyone else must wear one,” Karran reportedly texted the woman several weeks ago. Her angry partner tore into the landlord on Facebook for taking the details she’d filled out on a Test and Trace sheet and “messag[ing] her illegally.” Referring to still-valid EU law on data protection, he said his girlfriend had been the “victim of a GDPR breach” and excoriated Karran for his “absolutely awful behavior.”

While the landlord responded to the post with “profound apologies,” and begged the couple not to “take it further,” the micropub’s founders did not comment on the incident until Friday, when they announced a PR campaign aimed at “re-establishing our reputation for safety and welcome to all.” The multi-level initiative apparently included becoming “accredited with the Good Night Out campaign [which combats sexual harassment]; implementing a ‘safer spaces’ policy,” overhauling its Covid-19 policy, and supporting the domestic-abuse charity Women’s Aid. However, many online have questioned whether the about-face was sincere.

Similar cases have occurred across the UK during the pandemic, ever since venues using Test and Trace methods – which either require punters to sign in using the NHS phone app or on an old-school paper form – became the norm. Over a year ago, the practice of bartenders hitting on young women whose numbers they’d gleaned from sign-in sheets was already making headlines as the likes of the Daily Mail wondered if the program hadn’t turned into a “stalker’s charter.”

While the Information Commissioner’s Office had sternly warned all venues that they were forbidden to “use the personal information that [they] collect for contact tracing for other purposes,” that hasn’t stopped some publicans from doing just that, perhaps assuming the attraction was mutual, or the object of their affection wouldn’t mind having their privacy violated. In practice, however, those harassed in this way said the incidents had not only brought back unpleasant memories, but had also affected their behavior in public, or spilled over into how they felt about the government’s Covid-19 directives.

Failure to comply with collecting Test and Trace details for the NHS is punishable by a fine from £1,000 to £4,000 ($1,326 to $5,307), but the program was initially rolled out without instructions as to how that data should be stored and secured, turning the whole system into what privacy campaign group Big Brother Watch referred to as a “free-for-all.”