How should an employer handle personal information in relation to NHS Test and Trace?
Employers will be collecting and sharing health information. Health information is sensitive and higher data protection standards apply. Here are a few key pointers.
- Update privacy notices to cover the new collection and sharing of employees’ information and provide these to the workforce. Be transparent and fair.
- Identify the legal basis and condition for use of this information and put any required paperwork in place. The ICO guidance will help. For some conditions such as the employment condition, an Appropriate Policy Document (APD) will be required. The ICO has an APD template.
- Only use the information for the purpose of managing the workforce during the pandemic.
- Only collect or share information if it’s necessary – if it’s a targeted and proportionate way of achieving your purpose.
- Make sure any health information collected and shared is accurate – there may be serious consequences if it’s not.
- Work out how long the information must be kept for. Keep a record of that period and act on it at the appropriate time.
- Security is very important – there may be malicious actors trying to trick employers and employees. Make sure employees know how to identify a genuine NHS Test and Trace contact. Keep the information secure. Use the ICO’s data sharing checklists** and keep a record of the disclosures made and why. Control external disclosures – only certain authorised members of staff should make them.
- Make sure individuals can still exercise their data protection rights – that’s also very important. Keep data protection records up-to-date and ensure any exports of personal information outside the UK are compliant.
- Before introducing employer-led testing like taking temperatures, thermal imaging or other potentially intrusive tests, work out if a data protection impact assessment (DPIA) is required. It will be if the intended processing is ‘high risk’. If it is, then carry out a full DPIA. It will help address the issues systematically and mitigate risks.
- All this demonstrates ‘accountability’ – it shows affected individuals and the ICO that the employer is complying with data protection requirements.
If you need further help, please visit the ICO’s data protection and coronavirus information hub or ask our data protection team.
** Please note that this link is to the ICO’s existing checklists and data sharing code of practice. We will update the link to the ICO’s new checklists after they are published.
Related FAQs
In some circumstances, visitors and customers are required to wear face coverings, such as those travelling on public transport, shoppers and museum visitors. The government guidance states that:
- businesses must remind people to wear face coverings where mandated; and
- premises where face coverings are required should take reasonable steps to promote compliance with the law.
As part of their duty of care to employees and to uphold a relationship of mutual trust and confidence, employers should consider how employees can ensure that visitors and customers comply with the rules and provide their staff with guidance. They must also seek ways to protect their employees both from the risks of those customers not wearing face masks and potential abuse from customers or visitors who decline to wear a face covering. This may include having signs in place requiring customers and visitors to wear a mask and allowing staff to refuse to serve customers if they do not follow the rules.
However, it is ultimately the responsibility of the police, security and public transport officials to remove customers from premises where they are not complying with the rules on face coverings.
The police and Transport for London have been given greater powers by the government to take measures if the public do not comply with the law relating to face coverings without a valid exemption, such as refusing to wear a face covering. This includes issuing fines which have now been increased to £200 for the first offence (and £100 if paid within 14 days). Transport operators can also deny access to their public transport services if a passenger is not wearing a face covering, or direct them to wear one or leave a service.
The workplace will not revert to its pre-Covid-19 state overnight, with social distancing in the work place likely to remain in place for quite some time to come.
This could mean that businesses will need to think carefully about how their capacity will be impacted, and how this will affect their ability to perform contractual obligations.
For example, if a business has an outsourcing contract under which it has to perform a business process, or produce a particular output, will it be able to comply with contractual performance standards whilst social distancing is still in place? In the context of a manufacturing business, what will be the impact on production schedules and delivery dates? There might also be an impact on operating costs, for example if processes are changed and additional shifts are introduced – can these additional costs be sustained?
Businesses need to plan a safe system of work for their employees to ensure they comply with Health and Safety legislation, but they also need to consider how this will impact on their ability to perform pre-existing contractual obligations. Ultimately, contractual arrangements with customers might need to remain on a revised footing for a number of months.
Getting to a point where agreement is reached on allocation of additional costs and/or changes to key elements of a contract such as scope of work, performance standards and delivery date will require co-operation between contracting parties. Again, it is important that any variations that are agreed are recorded properly and follow the required contractual procedures.
As mentioned earlier, if an agency is involved you must send them a copy of the status determination statement for each contractor, and they will also have the right to dispute the outcome.
If the agency pays the contractor, they will be responsible for the operation of PAYE and NIC’s deductions and any apprenticeship levy. The agency may try to recover these costs from the end user client.
If workers are supplied by an agency or umbrella company and are already treated as employees by the agency, they will remain unaffected by IR35.
The application has to be made before the date on which the accounts should have been filed, so this process can’t be used if you are already late. If you don’t make the application before your filing deadline, then a fine will automatically be generated if your accounts are filed late. Whilst you could appeal against such a fine on the grounds that the delay was caused by coronavirus issues, this is likely to be a much more time consuming and uncertain process that applying in advance.
It does not appear that the process applies to Confirmation Statements or other returns.
The Government’s Corporate Insolvency and Governance Act introduces amendments to the current rules for companies on holding meetings, to address the difficulties companies are facing due to the Covid-19 pandemic.
The new provisions apply to meetings held between 26 March 2020 and 30 September 2020 (referred to as the “Relevant Period”). Subsequent regulations by the Government can be used to shorten this period or extend by up to 3 months but not past 5 April 2021.
The provisions will have retrospective effect, so meetings that were held after 26 March 2020 that may not have met the usual legal requirements due to lockdown, will be validated under these new provisions. These provisions under the Act make amends to relevant legislation and override a company’s articles of association.
For general meetings and certain other meetings of companies, the Act states that:
- The meeting need not be held in any particular place;
- The meeting may be held, and any votes may be cast, by electronic means or other means;
- The meeting may be held without anyone being in the same place
- Persons attending the meeting no longer have the following rights: the right to attend in person, the right to participate in the meeting other than by voting, or the right to vote by particular means.
The aim of these changes is to facilitate virtual meetings, and remove the need for a physical venue.
Where a company was required to hold its AGM between 26 March and 30 September 2020, it can be held at any time before 30 September 2020. The Secretary of State has the power to make regulations to further extend the deadline.