How should an employer handle personal information in relation to NHS Test and Trace?
Employers will be collecting and sharing health information. Health information is sensitive and higher data protection standards apply. Here are a few key pointers.
- Update privacy notices to cover the new collection and sharing of employees’ information and provide these to the workforce. Be transparent and fair.
- Identify the legal basis and condition for use of this information and put any required paperwork in place. The ICO guidance will help. For some conditions such as the employment condition, an Appropriate Policy Document (APD) will be required. The ICO has an APD template.
- Only use the information for the purpose of managing the workforce during the pandemic.
- Only collect or share information if it’s necessary – if it’s a targeted and proportionate way of achieving your purpose.
- Make sure any health information collected and shared is accurate – there may be serious consequences if it’s not.
- Work out how long the information must be kept for. Keep a record of that period and act on it at the appropriate time.
- Security is very important – there may be malicious actors trying to trick employers and employees. Make sure employees know how to identify a genuine NHS Test and Trace contact. Keep the information secure. Use the ICO’s data sharing checklists** and keep a record of the disclosures made and why. Control external disclosures – only certain authorised members of staff should make them.
- Make sure individuals can still exercise their data protection rights – that’s also very important. Keep data protection records up-to-date and ensure any exports of personal information outside the UK are compliant.
- Before introducing employer-led testing like taking temperatures, thermal imaging or other potentially intrusive tests, work out if a data protection impact assessment (DPIA) is required. It will be if the intended processing is ‘high risk’. If it is, then carry out a full DPIA. It will help address the issues systematically and mitigate risks.
- All this demonstrates ‘accountability’ – it shows affected individuals and the ICO that the employer is complying with data protection requirements.
If you need further help, please visit the ICO’s data protection and coronavirus information hub or ask our data protection team.
** Please note that this link is to the ICO’s existing checklists and data sharing code of practice. We will update the link to the ICO’s new checklists after they are published.
Related FAQs
It has also been proposed in the Corporate Insolvency and Governance Bill that public companies who were due to file their accounts in the period from 26 March 2020 to 30 September 2020 will have until the earlier of the 30 September 2020 and the date which is 12 months after the end of their relevant accounting period to do this.
This is separate from the pre-existing scheme, announced on 25 March 2020, whereby companies can apply to Companies House for a 3 month extension for filing their accounts.
Yes, you can ask to see any information/documentation sent to an employee informing them that they should self-isolate.
The Business and Planning Act 2020 entered the statute books on 22 July 2020. Section 18 of the Act includes provisions for the extension of the date by which a reserved matters application must be submitted where the original date falls between 23 March 2020 and 31 December 2020. Where the original time limit for the submission of reserved matters is on or after 19 August 2020, the relevant conditions will be automatically read as requiring the reserved matters application to be submitted by 1 May 2021.
Where the original time limit for the submission of reserved matters is before 19 August 2020, an application will need to be made to the LPA for an Additional Environmental Approval (“AEA”), which the LPA must determine within 28 days otherwise the approval is deemed to be provided. The purpose of the AEA is to consider whether the environmental assessments carried out at the time of the original outline determination remain valid and up to date, and where that is not the case, the AEA will be refused. In such circumstances a new planning application will be required where an application is now out of time to comply with the original date for submission of reserved matters.
The now defunct Guidance for the Tier system suggested that the clinically extremely vulnerable would be treated in the same way as those who were shielding in Lockdown 1. This means that anyone who is clinically extremely vulnerable and cannot work remotely, will be entitled to SSP. These employees should receive a letter confirming that they are deemed to be clinically extremely vulnerable/shielding and you should ask for a copy of it as evidence to support a claim for SSP. It is likely that the Lockdown 3 Guidance will be the same.
You could also furlough an employee in the clinically extremely vulnerable category. Again we do not anticipate this changing.
A licence to occupy premises is not an interest land and operates as a commercial contract between the parties that enter into it. Licences tend to be put in place to cover short periods and consequently they are generally a lot more flexible than commercial leasing arrangements. To that extent occupants under licences should review the contract to establish whether or not there are any provision allowing them to terminate on notice to the Licensor.
Occupants under licences that are granted for longer periods without the option to terminate may try to argue that the contract has frustrated because they are effectively unable to occupy.