How should an employer handle personal information in relation to NHS Test and Trace?
Employers will be collecting and sharing health information. Health information is sensitive and higher data protection standards apply. Here are a few key pointers.
- Update privacy notices to cover the new collection and sharing of employees’ information and provide these to the workforce. Be transparent and fair.
- Identify the legal basis and condition for use of this information and put any required paperwork in place. The ICO guidance will help. For some conditions such as the employment condition, an Appropriate Policy Document (APD) will be required. The ICO has an APD template.
- Only use the information for the purpose of managing the workforce during the pandemic.
- Only collect or share information if it’s necessary – if it’s a targeted and proportionate way of achieving your purpose.
- Make sure any health information collected and shared is accurate – there may be serious consequences if it’s not.
- Work out how long the information must be kept for. Keep a record of that period and act on it at the appropriate time.
- Security is very important – there may be malicious actors trying to trick employers and employees. Make sure employees know how to identify a genuine NHS Test and Trace contact. Keep the information secure. Use the ICO’s data sharing checklists** and keep a record of the disclosures made and why. Control external disclosures – only certain authorised members of staff should make them.
- Make sure individuals can still exercise their data protection rights – that’s also very important. Keep data protection records up-to-date and ensure any exports of personal information outside the UK are compliant.
- Before introducing employer-led testing like taking temperatures, thermal imaging or other potentially intrusive tests, work out if a data protection impact assessment (DPIA) is required. It will be if the intended processing is ‘high risk’. If it is, then carry out a full DPIA. It will help address the issues systematically and mitigate risks.
- All this demonstrates ‘accountability’ – it shows affected individuals and the ICO that the employer is complying with data protection requirements.
If you need further help, please visit the ICO’s data protection and coronavirus information hub or ask our data protection team.
** Please note that this link is to the ICO’s existing checklists and data sharing code of practice. We will update the link to the ICO’s new checklists after they are published.
Related FAQs
Government guidance is that public transport should be avoided wherever possible. Transport providers will be expected to follow government guidance to make their services more COVID-19 secure.
Specialist healthcare lawyers from Ward Hadaway ran a free webinar looking at the practical and legal considerations if required to treat healthcare workers from a BAME background or other vulnerable groups differently in the fight against the Covid-19 pandemic.
The formal Government position relating to construction sites is that construction work should continue on site if it can be conducted safely, and the Business Secretary, Alok Sharma, has written an open letter to the UK Construction Industry thanking it for all its help in the current crisis. The letter also confirms the Government’s current official policy of keeping construction sites open. The full text of the letter can be downloaded.
This also remains the formal position of the Construction Leadership Council (CLC) with the qualification that sites should operate in accordance with Public Health England instructions; without compromising health and safety; and in accordance with the Site Operating Procedures issued last week by the CLC.
In practice, many construction sites have been closed by national developers and house builders due to difficulties with staffing and supply chain, and practical issues with compliance with the social distancing and site operating procedures.
The Scottish Government has recently issued guidance that all non-essential construction sites, which includes housing, office, leisure, schools and retail sites, must close to reduce the risk of the spread of Covid-19.
The latest Cabinet Office guidance published Monday 6 April 2020 titled ‘Procurement Policy Note PPN 02/20: Additional guidance. FAQs and model terms for construction’ provides model deeds of variation for JCT and NEC3 contracts to provide for such payments to be made. As the Cabinet Office guidance states, legal advice is likely to be required to make sure that the model variations work with your specific contracts. Please contact one of our construction specialists if you need advice and assistance.
For a copy of the guidance note click here: https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/878338/PPN_02_20._Additional_guidance__FAQS_and_model_terms_for_construction.pdf
Because they all have devolved governments, when there are changes to spending levels in England, the Government makes adjustments to the amount of public expenditure allotted to Scotland, Wales and Northern Ireland. In this case £60 million will be made available for all of the devolved administrations as a result of the £370 million funding allocated to charities in England. This is broken down as follows:
- £30 million for the Scottish Government
- £20 million for Welsh Government
- £10 million for the Northern Ireland Executive
There may be further allocations, dependent on the final projects funded, through the £360 million direct grant pot.