How much data can I gather?
You also need to consider other aspects of data protection.
Be proportionate – only gather and use Covid-19 data where you need to.
Keep data to a minimum – you shouldn’t gather more data than you need. You need to know someone has Covid-19 but you don’t need to know all their symptoms. Data minimisation also applies to who gets access to the data. It’s unlikely that a spreadsheet, accessible to everyone updating them on the health status of all employees, would be appropriate. Data should be shared on a need to know basis. You need to balance the privacy of individuals against your duty of care to be responsible with regards to the data of your employees, visitors, customers and suppliers.
Keep it up to date – make sure you update data. People’s health status will change and if you keep a record of this, you need to make sure it is accurate and up to date (although this doesn’t mean you should batter individuals with constant requests for updates on health status. Again, be proportionate).
Identify individuals only when you need to – although you will need to know who has Covid-19, that doesn’t mean you need to tell everyone in the organisation. As soon as you can, you should remove personal data from any information you gather. For example, you might want to update employees on the health status of their fellow employees but you probably don’t need to name individuals and even if you feel it is necessary, you should keep the information you provide to a minimum. Removing personal identifiers in a document is also a good data security technique.
Keep the Covid-19 health data secure – Covid-19 data will be special category data and deemed high risk. This means that if you have a breach of this data you will need to notify it to the ICO. A breach could happen by someone losing a print-out of the names of Covid-19 employees, customers or visitors. It could also happen if you set access rights to lists of Covid-19 sufferers open to more people than need to know the information. The risk of ICO enforcement action increases with the potential harm the disclosure could cause. Although the ICO has indicated that it will be understanding about the impact of Covid-19 on normal operations, this doesn’t mean that they will not prosecute you if the breach is sufficiently serious.
Destroy the data once you don’t need it – Finally, of course, make sure that you delete data at the end of your needs. This might last longer than the pandemic, for example if you have an insurance claim or ongoing litigation. If you do need to keep it, consider whether or not you can delete some of the data to minimise what you hold.
Related FAQs
The General Medical Council (GMC) have published guidance online for doctors during this time of uncertainty.
Alongside this, their website displays guidance for temporary registration to approximately 15,000 doctors, who left the register or gave up their licence to practise in the last three years.
These clinicians have been contacted to assist with the growing pandemic, outlining the process they would follow and informing them of their right to opt-out. The Secretary of State for Health can ask the GMC to grant such registration under Section 18a of the Medical Act 1983, in an emergency.
Under their obligations arising from Regulation 36 of the Gas Safety (Installation and Use) Regulations 1998, landlords must service domestic gas appliances on an annual basis and provide tenants with a record of the service within 28 days of that service. Failure to comply can result in prosecution by the Health and Safety Executive (HSE) or downgrading by the Regulator.
We know how important this is. But how can you comply with your obligations during the Covid-19 epidemic?
The latest restrictions on leaving the home, currently allow registered gas engineers to undertake essential work, whilst taking the appropriate precautions advised to avoid spreading or contracting the virus in a new setting.
It is envisaged that employees of organisations falling into the first two categories set out above and won’t be eligible for the job retention scheme in relation to the majority of their employees. It is envisaged that NHS Trusts for example are going to require their staff to be working at full capacity where possible. However, the guidance doesn’t definitely exclude public sector organisations from furloughing employees and notably the government expects such organisations to use public money to continue to pay staff and not furlough them, rather than say requires. In reality, it is difficult to see how such an organisation will be able to rely on the scheme, but the guidance doesn’t completely rule it out.
Any hearings attended in person will need to be approved by the judge hearing the matter, if necessary, in consultation with the regional lead COP judge. Such requests are highly unlikely to be granted during COVID-19 unless there is a genuine urgency. However, it is deemed to be appropriate matters are likely to be adjourned on the basis that a remote hearing is not possible and a hearing in person is not safe or possible.
An amendment to the Civil Procedure Rules’ Practice Directions has been approved by the Master of the Rolls and the Lord Chancellor on 1 April 2020, and is now Practice Direction 51ZA. This has the effect of allowing the parties to extend by prior written agreement up to a maximum of 56 days (rather than the usual 28 days detailed at CPR 3.8(4)) any rule, practice direction or order provided that any extension does not put at risk any hearing date. This Practice Direction will cease to have effect on 30 October 2020.
Additionally each regions’ Designated Civil Judge (DCJ) has issued a Covid-19 Protocol. There are some minor variations between the regions, but overall the guidance is very similar.
In Northumbria, Durham and Teesside the DCJ guidance for multi-track cases provides that “The parties are at liberty to extend, by consent, any step in the timetable up to a maximum of 90 days (as opposed to the present limit of 28 days)” and the Court does not need to be notified if the Trial date is not effected. Where Trial windows are likely to be impacted due to Covid-19 and the parties are in agreement to extending this, a letter can be sent to the Court with a draft order proposing a new timetable, including a new trial window and agreed availability within the trial window.
The same guidance also confirms that an electronic signature on all documents including witness statements and disclosure statements will suffice.