How should an employer handle personal information in relation to NHS Test and Trace?
Employers will be collecting and sharing health information. Health information is sensitive and higher data protection standards apply. Here are a few key pointers.
- Update privacy notices to cover the new collection and sharing of employees’ information and provide these to the workforce. Be transparent and fair.
- Identify the legal basis and condition for use of this information and put any required paperwork in place. The ICO guidance will help. For some conditions such as the employment condition, an Appropriate Policy Document (APD) will be required. The ICO has an APD template.
- Only use the information for the purpose of managing the workforce during the pandemic.
- Only collect or share information if it’s necessary – if it’s a targeted and proportionate way of achieving your purpose.
- Make sure any health information collected and shared is accurate – there may be serious consequences if it’s not.
- Work out how long the information must be kept for. Keep a record of that period and act on it at the appropriate time.
- Security is very important – there may be malicious actors trying to trick employers and employees. Make sure employees know how to identify a genuine NHS Test and Trace contact. Keep the information secure. Use the ICO’s data sharing checklists** and keep a record of the disclosures made and why. Control external disclosures – only certain authorised members of staff should make them.
- Make sure individuals can still exercise their data protection rights – that’s also very important. Keep data protection records up-to-date and ensure any exports of personal information outside the UK are compliant.
- Before introducing employer-led testing like taking temperatures, thermal imaging or other potentially intrusive tests, work out if a data protection impact assessment (DPIA) is required. It will be if the intended processing is ‘high risk’. If it is, then carry out a full DPIA. It will help address the issues systematically and mitigate risks.
- All this demonstrates ‘accountability’ – it shows affected individuals and the ICO that the employer is complying with data protection requirements.
If you need further help, please visit the ICO’s data protection and coronavirus information hub or ask our data protection team.
** Please note that this link is to the ICO’s existing checklists and data sharing code of practice. We will update the link to the ICO’s new checklists after they are published.
Related FAQs
Hosted by The North East England Chamber of Commerce, this webinar discussed practical advice on Covid-19 and the specific challenges for International Trade.
Partner Damien Charlton along with Andrew Needham,from Haines Watts and Grant Murray from XE Finance, provided an update on the challenges and potential solutions in their field, as well as a look forward for the “New Normal”.
To watch the full recording, please click here or to view the slides, please click here.
Funding audits are being paused and no new audits will be commenced during the lockdown period.
The Government will allocate £360 million to charities providing key services and supporting vulnerable people during the crisis. £200 million of this amount will be paid to Hospices UK to be distributed to hospices to help increase capacity and give stability to the sector. The remaining amount is to be allocated to:
- St Johns Ambulance to support the NHS
- victims charities, including domestic abuse, to help with potential increase in demand for charities providing these services
- charities supporting vulnerable children, so they can continue delivering services on behalf of local authorities;
- disabled people
- Citizens Advice Bureau to increase the number of staff providing advice during this difficult time
The Government Departments will identify priority recipients, with the aim that these charities will receive money in the form of a cash grant over the next few weeks and by the end of April to assist in paying amongst other costs April’s wage bill.
- Employee pensions contributions are often paid by way of salary sacrifice arrangements.
- Use of such arrangements may reduce the amount of wage an employer can claim under the Coronavirus Job Retention Scheme, as the reimbursement is calculated by reference to an employee’s actual pay as at 28 February 2020, hence post sacrifice pay.
- Using the Coronavirus Job Retention Scheme does not in itself bring a salary sacrifice arrangement to an end, but where an employer wishes to maximise the amount of an employee’s pay that will be covered by the CJRS, the employer and employee(s) concerned may agree to terminate the salary sacrifice arrangement as part of furlough. HMRC has recently announced that the Covid-19 pandemic will be considered a “life event” (i.e. one of the permitted reasons to break a salary sacrifice arrangement mid-term), if the employment contract is updated accordingly.
This scheme is specifically aimed at creating jobs for 18-24 year olds who are on Universal Credit and considered most at risk of unemployment because of the economic downturn. The Government has announced that it will pay young people’s wages (equivalent to 100% the National Minimum Wage plus the associated National Insurance contributions and employer minimum automatic enrolment contributions) for up to 6 months, and that this will amount to a grant worth approximately £6,500 per young person.
The jobs that are created must provide a minimum of 25 hours per week and be paid at a minimum of the National Minimum Wage The Chancellor announced that will be no cap on the number of jobs that will be funded under the Kickstart scheme.