How should an employer handle personal information in relation to NHS Test and Trace?
Employers will be collecting and sharing health information. Health information is sensitive and higher data protection standards apply. Here are a few key pointers.
- Update privacy notices to cover the new collection and sharing of employees’ information and provide these to the workforce. Be transparent and fair.
- Identify the legal basis and condition for use of this information and put any required paperwork in place. The ICO guidance will help. For some conditions such as the employment condition, an Appropriate Policy Document (APD) will be required. The ICO has an APD template.
- Only use the information for the purpose of managing the workforce during the pandemic.
- Only collect or share information if it’s necessary – if it’s a targeted and proportionate way of achieving your purpose.
- Make sure any health information collected and shared is accurate – there may be serious consequences if it’s not.
- Work out how long the information must be kept for. Keep a record of that period and act on it at the appropriate time.
- Security is very important – there may be malicious actors trying to trick employers and employees. Make sure employees know how to identify a genuine NHS Test and Trace contact. Keep the information secure. Use the ICO’s data sharing checklists** and keep a record of the disclosures made and why. Control external disclosures – only certain authorised members of staff should make them.
- Make sure individuals can still exercise their data protection rights – that’s also very important. Keep data protection records up-to-date and ensure any exports of personal information outside the UK are compliant.
- Before introducing employer-led testing like taking temperatures, thermal imaging or other potentially intrusive tests, work out if a data protection impact assessment (DPIA) is required. It will be if the intended processing is ‘high risk’. If it is, then carry out a full DPIA. It will help address the issues systematically and mitigate risks.
- All this demonstrates ‘accountability’ – it shows affected individuals and the ICO that the employer is complying with data protection requirements.
If you need further help, please visit the ICO’s data protection and coronavirus information hub or ask our data protection team.
** Please note that this link is to the ICO’s existing checklists and data sharing code of practice. We will update the link to the ICO’s new checklists after they are published.
Related FAQs
A reduction in hours or salary or changes to hours or patterns of work is a contractual change – you can’t just impose it without significant risk. The same applies for lay-off or short-time working where there is no existing contractual right to impose these.
In summary, the process that an employer should follow to implement these measures is as follows:
- Communicate the Company’s position clearly and the urgent need to achieve temporary cost-saving to ensure the ongoing financial viability of the organisation
- Explain the proposed changes in detail and seek the employee’s agreement, and
- Record the agreed changes in a letter which is counter-signed by the employee.
If employees will not agree then employers will be at substantial risk of claims for unlawful deduction of wages, breach of contract and/or constructive unfair dismissal if they seek to impose these changes unilaterally. Employers should be mindful that this approach is likely to cause significant employee relations issues and dissatisfaction if only some employees agree to a reduction in pay. Employers should have a clear strategy for what their approach will be if this is the case – for example, they may wish to instead explore a different measure such as redundancies. This may form part of the employer’s communication when explaining the reason for the changes and seeking the employee’s agreement.
Unions: Employers should also be aware that where there is a recognised trade union in respect of any part of the workforce which is being asked to agree to a change to terms and conditions, the recognition agreement or collective agreement will require the employer to consult and/or negotiate with the trade union in the first instance.
Collective consultation: Where 20 or more dismissals are proposed at one establishment in any 90-day period, there are stringent collective consultation rules which apply (regardless of whether the employees have two years’ service or not). All dismissals count towards this total unless the dismissal is “not related to the individual concerned” – therefore dismissals for things such as conduct or capability do not count, but most other dismissals will count. This will include where you are imposing changes to the contract such as reduced hours or pay.
The rules on collective consultation set out a prescriptive and time-consuming process which must be followed, and minimum timescales before any redundancies can take effect. The cost of any claims relating to failure to follow collective consultation requirements are substantial, and specific advice should therefore always be sought before seeking to implement collective redundancies. We will be publishing further guidance on this on the Hub shortly.
As above, employees must not leave their home unless they have a ‘reasonable excuse’.
It has also been proposed in the Corporate Insolvency and Governance Bill that public companies who were due to file their accounts in the period from 26 March 2020 to 30 September 2020 will have until the earlier of the 30 September 2020 and the date which is 12 months after the end of their relevant accounting period to do this.
This is separate from the pre-existing scheme, announced on 25 March 2020, whereby companies can apply to Companies House for a 3 month extension for filing their accounts.
The Act was obviously subject to much debate and criticism as the Bill passed through Parliament. It is difficult to properly assess any gaps until after the necessary secondary legislation has been published and comes into force (along with the remainder of the Act), but some of the likely issues include:
- The impact on the insurance market, and the (lack of) availability and increased cost of insurance in light of the provisions of the Act
- How the introduction of retrospective claims will affect the market, both in relation to how parties might go about trying to prove matters which are 30 years old, but also the lack of certainty for those potentially on the receiving end of these claims which they previously had by virtue of the Limitation Act provisions
- Whether the definition of higher risk buildings is correct, or will require some refinement.
The Martlet v Mulalley case provides some useful observations and clarifications, for example that designers cannot necessarily rely on a ‘lemming’ defence that they were simply doing what others were doing at the time, that ‘waking watch’ costs are generally recoverable, and commentary on certain specific Building Regulations. The judgment however made clear that much of the case turned on its specific facts, so it is useful from the perspective of providing some insight as to how the Courts will deal with cladding disputes in future, rather than setting significant precedents to be followed.
Unfortunately, losses caused by pandemics are not often covered expressly under standard policies, as the risk has been difficult for insurers to price and understand.
Even where additional cover in respect of notifiable diseases has been purchased, it typically will not include Covid-19 within the range of diseases covered by the policy. If the policy includes a list of notifiable diseases, and which does not include Covid-19, it is very unlikely that cover will be available for pandemic-relates losses.
The most common types of covers that could be afforded by insurance policies for coronavirus-related losses and liabilities are traditional business interruption insurance, contingent business interruption insurance, liability insurance, as well as cancellation and abandonment insurance.