How should an employer handle personal information in relation to NHS Test and Trace?
Employers will be collecting and sharing health information. Health information is sensitive and higher data protection standards apply. Here are a few key pointers.
- Update privacy notices to cover the new collection and sharing of employees’ information and provide these to the workforce. Be transparent and fair.
- Identify the legal basis and condition for use of this information and put any required paperwork in place. The ICO guidance will help. For some conditions such as the employment condition, an Appropriate Policy Document (APD) will be required. The ICO has an APD template.
- Only use the information for the purpose of managing the workforce during the pandemic.
- Only collect or share information if it’s necessary – if it’s a targeted and proportionate way of achieving your purpose.
- Make sure any health information collected and shared is accurate – there may be serious consequences if it’s not.
- Work out how long the information must be kept for. Keep a record of that period and act on it at the appropriate time.
- Security is very important – there may be malicious actors trying to trick employers and employees. Make sure employees know how to identify a genuine NHS Test and Trace contact. Keep the information secure. Use the ICO’s data sharing checklists** and keep a record of the disclosures made and why. Control external disclosures – only certain authorised members of staff should make them.
- Make sure individuals can still exercise their data protection rights – that’s also very important. Keep data protection records up-to-date and ensure any exports of personal information outside the UK are compliant.
- Before introducing employer-led testing like taking temperatures, thermal imaging or other potentially intrusive tests, work out if a data protection impact assessment (DPIA) is required. It will be if the intended processing is ‘high risk’. If it is, then carry out a full DPIA. It will help address the issues systematically and mitigate risks.
- All this demonstrates ‘accountability’ – it shows affected individuals and the ICO that the employer is complying with data protection requirements.
If you need further help, please visit the ICO’s data protection and coronavirus information hub or ask our data protection team.
** Please note that this link is to the ICO’s existing checklists and data sharing code of practice. We will update the link to the ICO’s new checklists after they are published.
Related FAQs
Directors of a company that is in, or potentially facing, financial difficulty have a duty to act in the best interests of creditors as a whole. Failure to comply with that duty can have consequences for directors (including personal liability and disqualification if directors get it wrong).
The duty to act in the best interests of creditors as a whole begins when the company is (or in some cases is potentially or at risk of becoming) insolvent i.e. its assets are worth less than its liabilities and/or the business is unable to pay its liabilities as and when they fall due. However, just because a company is insolvent doesn’t always necessarily mean than an insolvency process is inevitable. Sometimes, the insolvency might just be caused by a temporary cashflow problem or perhaps wider problems in the business that can be overcome by making changes to the business itself.
In addition to that, the potential liability of directors ramps up even further when the company reaches the stage that the directors have concluded (or ought to have concluded) that there was no reasonable prospect of the business avoiding liquidation or administration. If the business reaches that stage, in addition to having to act in the best interests of creditors as a whole, directors can find themselves personally liable unless, from the time the directors ought to have reached that conclusion, they took every step that they ought to have done to minimise the loss to creditors. This is known as wrongful trading.
On the 25th June 2020, the government introduced new legislation – the Corporate Insolvency and Governance Act 2020 – which includes measures to temporarily relax the rules around wrongful trading with the proposed changes to take effect retrospectively from the 1st March 2020. Essentially, the changes say that any court looking at a potential wrongful trading claim against a director is to assume that the director is not responsible for worsening the company’s financial position between 1st March 2020 and the 30th September 2020. Whilst the wrongful trading rules have relaxed, directors still need to proceed with caution if the business is potentially insolvent as the new Act does alter other potential pitfalls for directors, like the risk of breaching their duties or allowing the company to enter into transactions that can potentially be challenged.
The support being offered by the government is potentially a lifeline for businesses under pressure through no fault of their own, but notwithstanding the recent changes to the wrongful trading rules it is still likely to be important for the board to carefully consider whether it is appropriate to make use of the loans, grants and tax forbearance that are on offer.
Exactly what the board should consider will vary from business to business and getting it right can sometimes involve balancing several different (and at times conflicting) priorities, challenges and concerns.
That will depend on the terms of your facility and the stance taken by your bank.
Banking facilities often place obligations on businesses to stick to certain financial criteria. For example, an obligation to keep turnover or profit above certain levels or a commitment to keep the bank’s exposure within an agreed percentage of the value of the company’s assets (known as loan to value ratio).
The consequences of breaching those covenants will depend on the terms of your facility, but normally this amounts to an event of default. Events of default can result in the loan (or whatever form the facility takes) becoming repayable and could give the bank certain powers to take action to recover the money that they are owed.
Whether the bank will take action during these unprecedented times is another matter, particularly given the extent of support being offered to businesses via mainstream lenders and the political desire to keep viable businesses up and running. Lenders themselves will no doubt wish to remain supportive where possible. The underlying performance of the business (and whether but for the effects of Covid-19 it would have been in a healthy financial position), the relationship you have with the bank and your history with them will no doubt be relevant to the approach taken by the bank. However, early engagement with your bank (as well as other key stakeholders in the business) will be important.
Another obvious cost cutting measure is to reduce working hours, either temporarily or permanently. Again, it should be done fairly, either across the board or by selecting teams/individuals based on objective business reasons. Imposing without agreement would create significant risk, therefore would require fair selection and consultation.
The Chief Coroner supports the position, communicated by NHS England and the Chief Medical Officer that Covid-19 is an acceptable direct or underlying cause of death for the purposes of completing the Medical Certificate of Cause of Death (MCCD) and is considered a naturally occurring disease. This cause of death alone is not a reason to refer a death to a coroner under CJA 2009.
If the cause of death is believed to be due to confirmed Covid-19 infection, there is unlikely to be any need for a post mortem to be conducted and the MCCD should be issued, and guidance is given on how this is delivered to the Registrar in the event of the next of kin/informant being in self-isolation.
In a hospital setting the MCCD process should be straightforward because of diagnosis and treatment in life. This may be more complex in a community setting. The Coronavirus Act 2020 however expanded the window for last medical review from 14 to 28 days. Outside of this, the death will need to be reported to the coroner.
Although Covid-19 is a naturally occurring disease, there may be additional factors around the death which mean it should be reported to the coroner; for example, the cause of death is unclear, or where there are other relevant factors. Guidance is given to coroners on how to manage such reported deaths, particularly where post mortem examinations may not be readily availability.
There is no simple answer.
The NFCC guidance states:
“The person-centred fire risk assessment is intended only as a simple means for non-specialists who have suitable understanding of relevant fire risks to determine whether additional fire precautions might be needed. The person who carries out the person-centred fire risk assessment will depend on the circumstances of the housing and support provision. It can be carried out by those who regularly engage with the resident, with input from specialists where necessary. Assessments will normally be undertaken with residents themselves.
In sheltered housing with scheme managers, the scheme managers normally engage with residents on a routine basis, enabling residents who need a person-centred fire risk assessment to be identified. Many vulnerable residents will be in receipt of care, so enabling the care provider to identify residents in need of a person-centred fire risk assessment. Providers of regulated care are required to take into account risks to people from their wider environment, to take steps to help people ensure that they are dealt with by appropriate agencies, or to raise safeguarding alerts when this is appropriate. Where a ‘stay put’ strategy is adopted, there will be a need to identify residents who need assistance from the fire and rescue service to evacuate the building.
In supported housing, the number of residents in each property is usually quite small. This, and the nature of the care service normally provided, enables person-centred fire risk assessments to be carried out asa matter of course, when a resident first moves into the property.
Where additional fire precautions cannot be provided in the short term, the risk should be reduced as far as reasonably practicable and an adult at risk referral should be made to Adult Social Care.”
Ideally then the RP will need to engage with any care providers in order to conduct the PCRA and identify risk mitigation measures. If they are reluctant to do so, the RP should engage with the individual in any event in undertaking the assessment.