How should an employer handle personal information in relation to NHS Test and Trace?
Employers will be collecting and sharing health information. Health information is sensitive and higher data protection standards apply. Here are a few key pointers.
- Update privacy notices to cover the new collection and sharing of employees’ information and provide these to the workforce. Be transparent and fair.
- Identify the legal basis and condition for use of this information and put any required paperwork in place. The ICO guidance will help. For some conditions such as the employment condition, an Appropriate Policy Document (APD) will be required. The ICO has an APD template.
- Only use the information for the purpose of managing the workforce during the pandemic.
- Only collect or share information if it’s necessary – if it’s a targeted and proportionate way of achieving your purpose.
- Make sure any health information collected and shared is accurate – there may be serious consequences if it’s not.
- Work out how long the information must be kept for. Keep a record of that period and act on it at the appropriate time.
- Security is very important – there may be malicious actors trying to trick employers and employees. Make sure employees know how to identify a genuine NHS Test and Trace contact. Keep the information secure. Use the ICO’s data sharing checklists** and keep a record of the disclosures made and why. Control external disclosures – only certain authorised members of staff should make them.
- Make sure individuals can still exercise their data protection rights – that’s also very important. Keep data protection records up-to-date and ensure any exports of personal information outside the UK are compliant.
- Before introducing employer-led testing like taking temperatures, thermal imaging or other potentially intrusive tests, work out if a data protection impact assessment (DPIA) is required. It will be if the intended processing is ‘high risk’. If it is, then carry out a full DPIA. It will help address the issues systematically and mitigate risks.
- All this demonstrates ‘accountability’ – it shows affected individuals and the ICO that the employer is complying with data protection requirements.
If you need further help, please visit the ICO’s data protection and coronavirus information hub or ask our data protection team.
** Please note that this link is to the ICO’s existing checklists and data sharing code of practice. We will update the link to the ICO’s new checklists after they are published.
Related FAQs
Potentially, yes. If someone refuses to follow the health and safety measures that have been put in place to protect them, colleagues and possibly their customers, including (where appropriate) the use of PPE then this is a disciplinary issue and should be dealt with as such. Repeated failure to comply with the requirement to follow these measures, or a one off significant failure, may be sufficient to justify dismissal, depending on the circumstances.
An employer has a duty of care to its workforce and must take reasonable precautions to protect the health and safety of employees. Employers also have a duty of care towards anyone entering or using their place of business, such as visiting clients or customers.
This means that if an employer reasonably believes that wearing face masks at work is appropriate and necessary, it can issue an instruction to employees to this effect and employees should abide by this as far as possible.
However employers should be cautious about introducing and enforcing a policy across its business which requires its staff to wear face masks as there is the risk of unlawfully discriminating against people who are exempt from wearing face coverings or have legitimate reasons for not doing so. An employer should also consider the duty to make reasonable adjustments for disabled employees and discuss any concerns raised by employees who do not want to or feel unable to wear a mask.
To qualify for a grant under the scheme you must pay your furloughed staff the wages you are claiming for. Failure to do so may result in a HMRC investigation and/or claims from furloughed staff for unlawful deductions from wages and possibly constructive dismissal claims.
Normal benefits including non-monetary benefits should continue during furlough unless the individual has agreed in writing to reduce or remove a benefit during this time.
Employers are expected to apply for one or more of the financial support schemes available to be able to continue to pay staff.
Parties are encouraged to review upcoming matters to assess the viability for there to be any agreement which can be reached in relation to the issues in dispute or to consider whether the case needs to proceed to a remote hearing. If directions or issues can be agreed between the parties, reducing the need for remote hearings, then that is the preferred option.
The fundamentals of risk assessment remain the same as for any other foreseeable risk.
Focus on risk controls which reflect Government guidance; social distancing (2 metres) and avoiding contact with occupiers if possible, high-quality PPE – disposable overalls, gloves and fluid repellent surgical face masks, ready access to antibacterial wipes for surfaces, tools and equipment and plentiful hand sanitizer.