Skip to content

What are the data protection implications of holding Covid-19 health data?

The ICO is providing new guidance to organisations regarding data protection and coronavirus, which can be accessed here: https://ico.org.uk/for-organisations/data-protection-and-coronavirus/

Information about the Covid-19 health status of individuals is special category data under the GDPR. This means it is high risk which has implications for how you use it, store it and keep it secure.

You will already hold health data about your employees as this is necessary to provide a safe, accessible place to work and to make reasonable adjustments to the workplace. You now need to make sure that the information you gather about your employees, visitors to your sites, customers and suppliers about Covid-19 is processed in accordance with data protection laws.

Related FAQs

When should I apply to extend the period allowed to file accounts?

The application has to be made before the date on which the accounts should have been filed, so this process can’t be used if you are already late. If you don’t make the application before your filing deadline, then a fine will automatically be generated if your accounts are filed late. Whilst you could appeal against such a fine on the grounds that the delay was caused by coronavirus issues, this is likely to be a much more time consuming and uncertain process that applying in advance.

It does not appear that the process applies to Confirmation Statements or other returns.

Can I collect health data in relation to Covid-19?

Yes. With respect to employees you have an obligation to protect their health so you can gather information to do that. You might gather information from your employees on who has the virus, who has had it and recovered and also who has tested negative. You might also want to know if individuals have been in contact with someone who has it or if they are in a vulnerable group. It is reasonable to want to know where individuals have travelled. In the future it may also be reasonable to know if they are planning to travel to a virus hot spot, as the impact of the virus around the world is likely to continue for some time even after the outbreak has been contained in the UK.

It is reasonable to gather some information about visitors to your site, be they customers or suppliers, as this information will also help protect your staff. However, you should keep what you gather to a minimum. For visitors, it’s unlikely that you need to know anything more than they have Covid-19, are displaying symptoms or have recently been in contact with someone who has the virus.

What are the limitations of furloughing staff for publicly funded organisations?

The guidance from the Government concerning private sector organisations is very different from the guidance for public sector and organisations that receive public funding. The guidance states:

“The government expects that the scheme will not be used by many public sector organisations, as the majority of public sector employees are continuing to provide essential public services or contribute to the response to the coronavirus outbreak.

Where employers receive public funding for staff costs, and that funding is continuing, we expect employers to use that money to continue to pay staff in the usual fashion – and correspondingly not furlough them. This also applies to non-public sector employers who receive public funding for staff costs. Organisations who are receiving public funding specifically to provide services necessary to respond to Covid-19 are not expected to furlough staff.”

This guidance isn’t particularly clear but it appears that there is a recognition that there are different types of organisations which could be caught by this:

  1. Organisations who will be required to provide frontline services during the Covid-19 response. It is interpreted that NHS organisations such as NHS Trusts will fall firmly into this category. Employees of such organisations are expected not to be furloughed and to continue to work and be paid their normal salary in the usual way.
  2. Organisations who receive public funding to provide services to respond to the Covid-19 crisis. These organisations are not expected to furlough their staff. The type of organisation that would fit into this category are those that have been commissioned to developing breathing apparatus or testing kits to meet the needs of the healthcare sector during the peak of the pandemic.
  3. Organisations who receive public funds for staff costs to operate services. Employers are expected to continue to pay staff if the money to pay them is publicly funded. It is strongly inferred that this is irrespective of whether such staff have any work to perform. The type of organisation that is likely to fall into this category are GP practices, charities and private sector companies that have won contracts with the public sector.
Even if the Government pays the wages of my employees who are not working, there is still not enough money to pay the bills. What should I do?

Click here for details of what sort of things directors should consider if the business is insolvent .

There may be additional sources of funding available in addition to the funding made available to help pay the wages.

If you still have concerns that your business might not be able to survive you should take advice as soon as possible from our team of experts or an insolvency or restructuring practitioner. That doesn’t necessarily mean that the business is bound to fail but your advisers will be able to explore with you different ways to navigate through the current difficulties faced by the business and any restructuring/refinancing opportunities based on their extensive experience of helping companies that are facing financial problems. If ultimately saving the business in its current form is not possible, your advisors can help you ensure that you do everything you can to protect your employees and creditors whilst also ensuring that you comply with your duties as a director.

Coronavirus Statutory Sick Pay Rebate Scheme

The Coronavirus Statutory Sick Pay Rebate Scheme will repay employers the SSP paid to current or former employees and will be available from 26 May 2020. See here.

The scheme covers all types of employment contracts and employers will be eligible to claim if they:

  • Are claiming for an employee who is eligible for sick pay due to coronavirus
  • Had a payroll scheme that was created and started on or before 28 February 2020
  • Had fewer than 250 employees on 28 February 2020

The repayment will cover up to 2 weeks starting from the first qualifying day of sickness, if an employee is unable to work because they either:

  • have coronavirus (COVID-19) symptoms
  • cannot work because they are self-isolating because someone they live with has symptoms
  • are shielding and have a letter from the NHS or a GP telling them to stay at home for at least 12 weeks
  • have been notified by the NHS or public health bodies that they’ve come into contact with someone with coronavirus
  • they have been notified by the NHS to self-isolate before surgery

You can claim for periods of sickness starting on or after:

  • 13 March 2020 – if your employee had coronavirus or the symptoms or is self-isolating because someone they live with has symptoms; or
  • 16 April 2020 – if your employee was shielding because of coronavirus.
  • 28 May 2020 – if your employee has been notified by the NHS or public health bodies that they’ve come into contact with someone with coronavirus
  • 26 August 2020 – if your employee has been notified by the NHS to self-isolate before surgery

Employees do not have to give you a doctor’s fit note for you to make a claim. But you can ask them to give you either:

  • an isolation note from NHS 111 – if they are self-isolating and cannot work because of coronavirus
  • the NHS or GP letter telling them to stay at home for at least 12 weeks because they’re at high risk of severe illness from coronavirus
  • the evidence from the NHS or public health body requiring them to self-isolate

You must keep the following records in relation to a claim you make under the scheme for three years:

  • The reason for the employee’s absence
  • Details of each period the employee could not work, including start and end dates
  • Details of the SSP qualifying days when the employee could not work
  • National insurance numbers for each employee you have paid SSP to

You’ll need to print or save your state aid declaration (from your claim summary) and keep this until 31 December 2024.