How much data can I gather?
You also need to consider other aspects of data protection.
Be proportionate – only gather and use Covid-19 data where you need to.
Keep data to a minimum – you shouldn’t gather more data than you need. You need to know someone has Covid-19 but you don’t need to know all their symptoms. Data minimisation also applies to who gets access to the data. It’s unlikely that a spreadsheet, accessible to everyone updating them on the health status of all employees, would be appropriate. Data should be shared on a need to know basis. You need to balance the privacy of individuals against your duty of care to be responsible with regards to the data of your employees, visitors, customers and suppliers.
Keep it up to date – make sure you update data. People’s health status will change and if you keep a record of this, you need to make sure it is accurate and up to date (although this doesn’t mean you should batter individuals with constant requests for updates on health status. Again, be proportionate).
Identify individuals only when you need to – although you will need to know who has Covid-19, that doesn’t mean you need to tell everyone in the organisation. As soon as you can, you should remove personal data from any information you gather. For example, you might want to update employees on the health status of their fellow employees but you probably don’t need to name individuals and even if you feel it is necessary, you should keep the information you provide to a minimum. Removing personal identifiers in a document is also a good data security technique.
Keep the Covid-19 health data secure – Covid-19 data will be special category data and deemed high risk. This means that if you have a breach of this data you will need to notify it to the ICO. A breach could happen by someone losing a print-out of the names of Covid-19 employees, customers or visitors. It could also happen if you set access rights to lists of Covid-19 sufferers open to more people than need to know the information. The risk of ICO enforcement action increases with the potential harm the disclosure could cause. Although the ICO has indicated that it will be understanding about the impact of Covid-19 on normal operations, this doesn’t mean that they will not prosecute you if the breach is sufficiently serious.
Destroy the data once you don’t need it – Finally, of course, make sure that you delete data at the end of your needs. This might last longer than the pandemic, for example if you have an insurance claim or ongoing litigation. If you do need to keep it, consider whether or not you can delete some of the data to minimise what you hold.
Related FAQs
The Government’s guidance says walk, cycle or drive to work and avoid public transport if you can. Businesses will need to support workers in adopting alternative travel methods to reduce exposure to the virus. You could consider staggering start and finish times for shifts to reduce commuting during peak hours, or support cycling with secure storage facilities and a drying room.
- It is important to have a clear paper trail for any agreed reduction in salary, and hence any reduction in the amount of contributions. However, the contribution rates (as opposed to the amounts) should be the same as normal, and hence all processes and software should function as per normal and, amongst other things, remain compliant with auto-enrolment employer duties.
- However, if the period of affected contributions does not overlap precisely with the period of reduced salary, for example because of different cut-off dates, there may well be instances of non-compliance with auto-enrolment employer duties at the beginning as well as at the end of the period covered by the Coronavirus Job Retention Scheme.
- Accordingly, where an employer takes advantage of the Coronavirus Job Retention Scheme, good communication with the persons responsible for pensions administration and detailed record-keeping are essential to prevent non-compliances in the short-term and confusion in the long term.
An extension to the traditional business interruption insurance, “contingent business interruption insurance” often covers areas such as business interruption due to damage to property of a customer or suppliers. Nonetheless, proving loss can be problematic.
Claims for loss of use of the property may be possible as a result of forced business closure due to lockdown. Accordingly policies should be carefully reviewed to see if cover is available.
With the exception of the Covid-19 Corporate Financing Facility (see below), there was initially little dedicated financial assistance for medium-sized and larger businesses affected by the coronavirus outbreak (the so-called “stranded middle”); however, from 20 April 2020 such businesses (with a turnover above £45 million) have been able to access finance via the Coronavirus Large Business Interruption Loan Scheme (“CLBILS“).
CLBILS operates in a similar manner to CBILS except that a lender can provide:
- up to £25 million to businesses with turnover from £45 million up to £250 million; and
- up to £50 million to businesses for those with a turnover of over £250 million.
Finance is available in the form of:
- term loans
- revolving credit facilities (including overdrafts)
- invoice finance and
- asset finance,
in each case available on repayment terms of up to three years.
Several changes to CLBILS took effect from 26 May 2020. The maximum amount available through CLBILS to a borrower and its group increased from £50m to £200m. Term loans and revolving credit facilities over £50m will be offered by CLBILS lenders which have secured additional accreditation. The maximum size for invoice finance and asset finance facilities remains at £50m. Companies borrowing more than £50m through CLBILS will be subject to further restrictions on dividend payments, senior pay and share buy-backs during the period of the loan. Further information on the most recent changes, including new provisions on seniority of CLBILS facilities, can be found on the CLBILS page on the British Business Bank website. There is also an in-depth FAQs section for businesses, which has the full details of the changes to the scheme.
Unlike CBILS, the UK government will not make payments to cover the interest and any lender-levied fees in the first 12 months of any facility so these larger businesses will not benefit from the no upfront costs and lower initial repayments that smaller businesses eligible for CBILS benefit from. The other key provisions of CLBILS, such as the eligibility criteria, the 80% government-backed guarantee and security, are similar to those of CBILS.
Eligibility is similar to CBILS and businesses must:
- Be UK-based in its business activity
- Have an annual turnover of more than £45 million
- Have a borrowing proposal which the lender would consider viable, were it not for the current pandemic, and for which the lender believes the provision of finance will enable the business to trade out of any short-term to medium-term difficulty
- Self-certify that it has been adversely impacted by the coronavirus (COVID-19)
- Not have received a facility under the Bank of England’s Covid Corporate Financing Facility.
Businesses from any sector can apply, except the following:
- Credit institutions (falling within the remit of the Bank Recovery and Resolution Directive), insurers and reinsurers (but not insurance brokers)
- Building Societies
- Public-sector bodies
- Further-education establishments, if they are grant-funded
- State-funded primary and secondary schools
All lending decisions remain fully delegated to the accredited lenders.
You must exercise reasonable care in assessing status and making a status determination, considering what the position would be if the contractor was engaged directly by the end user client instead of via a PSC.
Status is usually determined by looking a number of factors and how they apply to the contractor’s working arrangements. This is a difficult exercise that is usually carried out by employment and tax lawyers and it is full of grey areas. We have a toolkit that can help you navigate this process which Paul will tell you more about at the end of the session.
The key factors used to determine status are:
- Control:
- How much control does the end user client have over the contractor in terms of working arrangements (hours, place of work) and how the work is carried out? Or is the individual contractor able to determine how and when they work and without direct supervision of the end user client?
- Personal service:
- Is the contractor required to perform the services personally without the right to send a substitute? If there is a right to appoint a substitute is this subject to end user client approval?
- Mutuality of obligation:
- Is the end user client obliged to provide the contractor work with a mutual obligation on the contractor to accept that work?