How should an employer handle personal information in relation to NHS Test and Trace?
Employers will be collecting and sharing health information. Health information is sensitive and higher data protection standards apply. Here are a few key pointers.
- Update privacy notices to cover the new collection and sharing of employees’ information and provide these to the workforce. Be transparent and fair.
- Identify the legal basis and condition for use of this information and put any required paperwork in place. The ICO guidance will help. For some conditions such as the employment condition, an Appropriate Policy Document (APD) will be required. The ICO has an APD template.
- Only use the information for the purpose of managing the workforce during the pandemic.
- Only collect or share information if it’s necessary – if it’s a targeted and proportionate way of achieving your purpose.
- Make sure any health information collected and shared is accurate – there may be serious consequences if it’s not.
- Work out how long the information must be kept for. Keep a record of that period and act on it at the appropriate time.
- Security is very important – there may be malicious actors trying to trick employers and employees. Make sure employees know how to identify a genuine NHS Test and Trace contact. Keep the information secure. Use the ICO’s data sharing checklists** and keep a record of the disclosures made and why. Control external disclosures – only certain authorised members of staff should make them.
- Make sure individuals can still exercise their data protection rights – that’s also very important. Keep data protection records up-to-date and ensure any exports of personal information outside the UK are compliant.
- Before introducing employer-led testing like taking temperatures, thermal imaging or other potentially intrusive tests, work out if a data protection impact assessment (DPIA) is required. It will be if the intended processing is ‘high risk’. If it is, then carry out a full DPIA. It will help address the issues systematically and mitigate risks.
- All this demonstrates ‘accountability’ – it shows affected individuals and the ICO that the employer is complying with data protection requirements.
If you need further help, please visit the ICO’s data protection and coronavirus information hub or ask our data protection team.
** Please note that this link is to the ICO’s existing checklists and data sharing code of practice. We will update the link to the ICO’s new checklists after they are published.
Related FAQs
The CMA is the government body that is responsible for protecting consumers from unfair trading practices. It has announced programme of work to investigate reports of businesses failing to respect cancellation rights during the Coronavirus pandemic.
Based on the complaints received by them from consumers, the CMA has identified three sectors of particular concern:
- Weddings and private events
- Holiday accommodation
- Nurseries and childcare providers
The CMA has expressed concern about the number of complaints that it has received about businesses seeking to retain deposits for cancelled events, undue restrictions being placed on use of vouchers provided for cancelled bookings, and payments being demanded to hold open nursery places.
The CMA has said it will prioritise investigation of these sectors, and then move on to other sectors.
As part of the Coronavirus Bill there is some good news for tenants in so far as it included the following:
- All commercial tenants in England, Wales and Northern Ireland missing rent payments are to benefit from a government ban on forfeiture of their lease.
- Landlords then will be prevented from terminating leases and “evicting” commercial tenants.
- The above provisions rules will apply not only to principal rent, but to “any sum a tenant is required to pay”, leaving the burden of supplying services and insuring the premises on landlords. The bill will last until 30 June 2020, with an option for the government to extend this deadline.
Whist this is helpful to any Tenant planning not to pay rent or other payments due under their lease insofar as they will not suffer forfeiture and be evicted, it should be noted that the contractual obligation to continue paying rent and all other costs due under the lease remains and Landlords will still be able to take action to recover any payments due under the lease that are in arrears.
If you sponsor migrants under Tier 2 or Tier 5, you will not be required to report a sponsored employee’s absence if it is linked to coronavirus and you have authorised this absence e.g. they are self-isolating and you have received an online isolation note.
The Home Office has confirmed that sponsors do not need to withdraw sponsorship for affected employees who have been absent from work for more than 4 weeks if they consider these are exceptional circumstances, which would include absences related to coronavirus. It does however remain extremely important to know where your sponsored workers are and to have up to date contact details.
If suppliers still wish to terminate the contract, they must contact the directors or the officeholder dealing with the insolvency process and obtain their approval to terminate the contract – which, of course, might not be given.
If the continued obligation under the contract to supply goods/services to the customer would place the supplier in financial hardship the supplier can apply to court for permission to terminate the contract. This will involve time and legal expense.
The Government has announced a £750 million funding package for charities to ensure they can continue their vital work during the coronavirus outbreak. This is for a 3 month period and further specific funding may be made available.
Charities which are businesses can also access the Government’s Coronavirus Business Interruption Loan Scheme (CBILS) – Please see our Funding and Finance FAQ’s.