How should an employer handle personal information in relation to NHS Test and Trace?
Employers will be collecting and sharing health information. Health information is sensitive and higher data protection standards apply. Here are a few key pointers.
- Update privacy notices to cover the new collection and sharing of employees’ information and provide these to the workforce. Be transparent and fair.
- Identify the legal basis and condition for use of this information and put any required paperwork in place. The ICO guidance will help. For some conditions such as the employment condition, an Appropriate Policy Document (APD) will be required. The ICO has an APD template.
- Only use the information for the purpose of managing the workforce during the pandemic.
- Only collect or share information if it’s necessary – if it’s a targeted and proportionate way of achieving your purpose.
- Make sure any health information collected and shared is accurate – there may be serious consequences if it’s not.
- Work out how long the information must be kept for. Keep a record of that period and act on it at the appropriate time.
- Security is very important – there may be malicious actors trying to trick employers and employees. Make sure employees know how to identify a genuine NHS Test and Trace contact. Keep the information secure. Use the ICO’s data sharing checklists** and keep a record of the disclosures made and why. Control external disclosures – only certain authorised members of staff should make them.
- Make sure individuals can still exercise their data protection rights – that’s also very important. Keep data protection records up-to-date and ensure any exports of personal information outside the UK are compliant.
- Before introducing employer-led testing like taking temperatures, thermal imaging or other potentially intrusive tests, work out if a data protection impact assessment (DPIA) is required. It will be if the intended processing is ‘high risk’. If it is, then carry out a full DPIA. It will help address the issues systematically and mitigate risks.
- All this demonstrates ‘accountability’ – it shows affected individuals and the ICO that the employer is complying with data protection requirements.
If you need further help, please visit the ICO’s data protection and coronavirus information hub or ask our data protection team.
** Please note that this link is to the ICO’s existing checklists and data sharing code of practice. We will update the link to the ICO’s new checklists after they are published.
Related FAQs
The Act was obviously subject to much debate and criticism as the Bill passed through Parliament. It is difficult to properly assess any gaps until after the necessary secondary legislation has been published and comes into force (along with the remainder of the Act), but some of the likely issues include:
- The impact on the insurance market, and the (lack of) availability and increased cost of insurance in light of the provisions of the Act
- How the introduction of retrospective claims will affect the market, both in relation to how parties might go about trying to prove matters which are 30 years old, but also the lack of certainty for those potentially on the receiving end of these claims which they previously had by virtue of the Limitation Act provisions
- Whether the definition of higher risk buildings is correct, or will require some refinement.
The Martlet v Mulalley case provides some useful observations and clarifications, for example that designers cannot necessarily rely on a ‘lemming’ defence that they were simply doing what others were doing at the time, that ‘waking watch’ costs are generally recoverable, and commentary on certain specific Building Regulations. The judgment however made clear that much of the case turned on its specific facts, so it is useful from the perspective of providing some insight as to how the Courts will deal with cladding disputes in future, rather than setting significant precedents to be followed.
The ICO is providing new guidance to organisations regarding data protection and coronavirus, which can be accessed here: https://ico.org.uk/for-organisations/data-protection-and-coronavirus/
Information about the Covid-19 health status of individuals is special category data under the GDPR. This means it is high risk which has implications for how you use it, store it and keep it secure.
You will already hold health data about your employees as this is necessary to provide a safe, accessible place to work and to make reasonable adjustments to the workplace. You now need to make sure that the information you gather about your employees, visitors to your sites, customers and suppliers about Covid-19 is processed in accordance with data protection laws.
This free Getting back to business webinar was held on Wednesday 6th May. On this video, employment partner Paul Scope and associate Flora Mewies looked at your options if you need to flex your employee resource or reduce cost without reducing headcount. This may apply across the business or to particular functions. They discussed a range of options when the furlough scheme comes to an end, including: lay off, short time working, reduced hours, reduced pay and other ways to be flexible.
They also discussed the pros and cons of each option, and cover what you will need to undertake with each of these routes.
You must exercise reasonable care in assessing status and making a status determination, considering what the position would be if the contractor was engaged directly by the end user client instead of via a PSC.
Status is usually determined by looking a number of factors and how they apply to the contractor’s working arrangements. This is a difficult exercise that is usually carried out by employment and tax lawyers and it is full of grey areas. We have a toolkit that can help you navigate this process which Paul will tell you more about at the end of the session.
The key factors used to determine status are:
- Control:
- How much control does the end user client have over the contractor in terms of working arrangements (hours, place of work) and how the work is carried out? Or is the individual contractor able to determine how and when they work and without direct supervision of the end user client?
- Personal service:
- Is the contractor required to perform the services personally without the right to send a substitute? If there is a right to appoint a substitute is this subject to end user client approval?
- Mutuality of obligation:
- Is the end user client obliged to provide the contractor work with a mutual obligation on the contractor to accept that work?
The Construction Leadership Council (with backing from the Government) has issued practical guidance and draft pro-forma documents to enable all parties involved in the construction supply chain to enter into collaborative and open dialogue about applications for extensions of time and additional payment and to minimise potential disputes. The guidance can we downloaded here
The draft letters and notices included in the guidance have been prepared on the basis of the standard JCT Design and Build 2016 and NEC 3/4 Engineering and Construction Contract (Option A) and parties will need to make sure that they are completed/adjusted to comply with their own specific contracts.
The Cabinet Office has also issued a general statement calling on parties to contracts adversely affected by C-19 to act responsibly and fairly and to support national efforts to protect jobs and the economy.