The ICO advice https://ico.org.uk/global/data-protection-and-coronavirus-information-hub/contact-tracing-protecting-customer-and-visitor-details/ does not comment on which lawful basis would apply nor does it comment on individual rights. Is the ICO going to update its guidance following the publication of this guidance by the @DHSCgovuk https://www.gov.uk/guidance/maintaining-records-of-staff-customers-and-visitors-to-support-nhs-test-and-trace ??

2 July. The @DHSCgovuk issues guidance on 'Maintaining records of staff, customers and visitors to support NHS Test and Trace'.

The guidance applies to pubs, restaurants, cafes, hotels, museums, places of worship ....

Those to whom the guidance applies are expected to:

"assist this service by keeping a temporary record of your customers and visitors for 21 days, in a way that is manageable for your organisation, and assist NHS Test and Trace with requests for that data if needed."

Records are to be maintained on "staff, customers & visitors"