How much data can I gather?
You also need to consider other aspects of data protection.
Be proportionate – only gather and use Covid-19 data where you need to.
Keep data to a minimum – you shouldn’t gather more data than you need. You need to know someone has Covid-19 but you don’t need to know all their symptoms. Data minimisation also applies to who gets access to the data. It’s unlikely that a spreadsheet, accessible to everyone updating them on the health status of all employees, would be appropriate. Data should be shared on a need to know basis. You need to balance the privacy of individuals against your duty of care to be responsible with regards to the data of your employees, visitors, customers and suppliers.
Keep it up to date – make sure you update data. People’s health status will change and if you keep a record of this, you need to make sure it is accurate and up to date (although this doesn’t mean you should batter individuals with constant requests for updates on health status. Again, be proportionate).
Identify individuals only when you need to – although you will need to know who has Covid-19, that doesn’t mean you need to tell everyone in the organisation. As soon as you can, you should remove personal data from any information you gather. For example, you might want to update employees on the health status of their fellow employees but you probably don’t need to name individuals and even if you feel it is necessary, you should keep the information you provide to a minimum. Removing personal identifiers in a document is also a good data security technique.
Keep the Covid-19 health data secure – Covid-19 data will be special category data and deemed high risk. This means that if you have a breach of this data you will need to notify it to the ICO. A breach could happen by someone losing a print-out of the names of Covid-19 employees, customers or visitors. It could also happen if you set access rights to lists of Covid-19 sufferers open to more people than need to know the information. The risk of ICO enforcement action increases with the potential harm the disclosure could cause. Although the ICO has indicated that it will be understanding about the impact of Covid-19 on normal operations, this doesn’t mean that they will not prosecute you if the breach is sufficiently serious.
Destroy the data once you don’t need it – Finally, of course, make sure that you delete data at the end of your needs. This might last longer than the pandemic, for example if you have an insurance claim or ongoing litigation. If you do need to keep it, consider whether or not you can delete some of the data to minimise what you hold.
Related FAQs
- Start critical care treatment with a clear plan of how the treatment will address the diagnosis and lead to agreed outcomes.
- Review critical care treatment regularly and when the patient’s clinical condition changes.
- Stop critical care treatment when it is no longer considered able to achieve the desired outcomes. Record the decision and the discussion with family, carers and the patient (if possible).
Yes: The Cabinet Office has published a number of Procurement Policy Notes to provide instructions to Public Bodies to enable payments to continue to be made to at risk suppliers (and their supply chains) who have been affected by Covid-19. Copies of this guidance can be obtained from the Government website at: https://www.gov.uk/government/publications/procurement-policy-note-0220-supplier-relief-due-to-covid-19
Individual contractors who are not operating via an intermediary (eg sole traders) do not need to be assessed under IR35. However, you will always have the risk with those individuals that there is no intermediary – therefore if their tax status is wrong, HMRC are very likely to consider that responsibility for this would fall on the hiring company in any event.
The NHS Test and Trace service is operated by the NHS in England to track and help prevent the spread of COVID-19. Where an individual displays symptoms of coronavirus they can be tested to determine whether or not they have the disease. Those with the disease will then be contacted by NHS contact tracers and asked who they have come into close contract with.
Close contact is defined as:
- Face to face (within 1 metre)
- Spent more than 15 minutes within 2 metres of another person
- Travelled in a car or on a plane with another person
The contact tracer will then contact those people with whom the individual has come into close contact and tell them to self-isolate for 14 days.
The government has announced a number of measures to try to protect businesses during the current period of uncertainty. However there is no outright ban on creditors being able to take legal action to recover money they are owed, though there are temporary restrictions on some forms of legal action, like winding up petitions.
However, it is important to note that these measures only relate to winding up proceedings. Creditors will still be free to commence county court claims.
The new Corporate Insolvency and Governance Act 2020 brings in a new “moratorium” procedure. Businesses in financial difficulty that are viable and can be rescued will now be able to work with an insolvency practitioner to obtain at least 20 business days’ breathing space from creditors to allow the business to formulate a plan to deal with its financial problems.
For more information on the Corporate Insolvency and Governance Act, click here
As part of the raft of measures put forward by the government over recent months, there are also restrictions on landlords taking action to evict commercial tenants who miss rent payments. Various payment holidays and forbearance have been put in place in respect of certain tax liabilities and some business rates.
If your business is going to go into an insolvency process like administration or a company voluntary arrangement, there is the ability to obtain a freeze on creditors taking action whilst those procedures are put in place. However, these sorts of moratoriums will not be available to everyone and in any event not unless an insolvency process is being instigated.
Regardless of whether a business has formal protection from creditors or not, engagement with creditors and trying to reach agreement with them to deal with the debt is therefore vital. Much of the protection measures that the Government has introduced like curbing the ability of landlords to evict a commercial tenant, do not wipe out the debt. They simply prevent action being taken or a payment becoming due for a short time. All businesses should use that time to consider how those debts can be dealt with and engage with the relevant stakeholders sooner rather than later.