How should an employer handle personal information in relation to NHS Test and Trace?
Employers will be collecting and sharing health information. Health information is sensitive and higher data protection standards apply. Here are a few key pointers.
- Update privacy notices to cover the new collection and sharing of employees’ information and provide these to the workforce. Be transparent and fair.
- Identify the legal basis and condition for use of this information and put any required paperwork in place. The ICO guidance will help. For some conditions such as the employment condition, an Appropriate Policy Document (APD) will be required. The ICO has an APD template.
- Only use the information for the purpose of managing the workforce during the pandemic.
- Only collect or share information if it’s necessary – if it’s a targeted and proportionate way of achieving your purpose.
- Make sure any health information collected and shared is accurate – there may be serious consequences if it’s not.
- Work out how long the information must be kept for. Keep a record of that period and act on it at the appropriate time.
- Security is very important – there may be malicious actors trying to trick employers and employees. Make sure employees know how to identify a genuine NHS Test and Trace contact. Keep the information secure. Use the ICO’s data sharing checklists** and keep a record of the disclosures made and why. Control external disclosures – only certain authorised members of staff should make them.
- Make sure individuals can still exercise their data protection rights – that’s also very important. Keep data protection records up-to-date and ensure any exports of personal information outside the UK are compliant.
- Before introducing employer-led testing like taking temperatures, thermal imaging or other potentially intrusive tests, work out if a data protection impact assessment (DPIA) is required. It will be if the intended processing is ‘high risk’. If it is, then carry out a full DPIA. It will help address the issues systematically and mitigate risks.
- All this demonstrates ‘accountability’ – it shows affected individuals and the ICO that the employer is complying with data protection requirements.
If you need further help, please visit the ICO’s data protection and coronavirus information hub or ask our data protection team.
** Please note that this link is to the ICO’s existing checklists and data sharing code of practice. We will update the link to the ICO’s new checklists after they are published.
Related FAQs
Once the collective process concludes, an employer can make the decision to proceed with the restructure. They will then have 1-on-1 meetings with employees about the impact of the restructure on them. This will include consideration of alternative employment. There is no need to consult further about the proposal, merely the effect of the restructure on the individual.
No. No action need be taken in relation to the demand but we would advise against presentation of a petition based upon any Statutory Demand issued between 1 March 2020 and the end of the restrictions. As you may be aware, with Winding Up there is no requirement to issue a Statutory Demand notice before proceeding so this is unlikely to create too many issues – click here to see whether you should issue petitions on other grounds.
There is nothing to prevent statutory demands being served at this time. However, there may be limited benefit as it cannot form the basis of a future winding up petition.
If your 30-day visa to travel to the UK (vignette) has expired or is about to, you can request a replacement free of charge until the end of 2020 by contacting the Coronavirus Immigration Help Centre. This can be granted with new and extended validity dates to allow travel once you are able to.
Employers will need to be flexible with employees who are unable to return to work at present due to childcare difficulties. While schools have reopened, a period of isolation may result in employees having to keep children off school/nursery and therefore have childcare issues. Some employees will be able to manage this with their partner and extended family, whereas others will not. Where an employee simply cannot make any other arrangements to care for their children in the short term then they will be unable to return to work until that situation changes. Any dismissals on the basis that someone is unable to return to work as a result of lack of childcare are likely to be unfair, at least in the short term where such employees may well be able to demonstrate that they had no options available to them.
As with a Will, your solicitor can take instructions by telephone, Skype or a similar tool. Your solicitor can then post or email the documentation to you. As with Wills, your signature and those of your proposed Attorneys will need to be witnessed, but in this case only by one other person. However, there are specific requirements as to who can witness your signature. The witness must be aged 18 or older and cannot be your Attorney but they can be your Certificate Provider.
Your Certificate Provider must either be someone you have known personally for at least two years or an appropriate professional. However, they must not be your Attorney and they must not be a member of your family or the partner, boyfriend or girlfriend of a member of your family or a business partner or employee of yours.
Also, if you are living in a care home, the Certificate Provider cannot be the owner, manager, director or employee of the home you live in.
Given the current restrictions on movement, if you have regular medical checks you could ask your GP or another medical professional to witness your signature and act as your Certificate Provider when you go to see them or they come to you. Alternatively, if someone you have known for two years or more is dropping off essentials, they could act as a witness and Certificate Provider remembering to retain the necessary distance and protective measures.
Concerning your Attorney(s) you cannot act as their witness. Otherwise, anyone aged 18 or older can act as their witness, including the other Attorney. Ideally, a witness to your or your Attorney’s signatures should not be a family member for the sake of impartiality and to avoid disputes. If necessary they can be.