What are the data protection implications of holding Covid-19 health data?
The ICO is providing new guidance to organisations regarding data protection and coronavirus, which can be accessed here: https://ico.org.uk/for-organisations/data-protection-and-coronavirus/
Information about the Covid-19 health status of individuals is special category data under the GDPR. This means it is high risk which has implications for how you use it, store it and keep it secure.
You will already hold health data about your employees as this is necessary to provide a safe, accessible place to work and to make reasonable adjustments to the workplace. You now need to make sure that the information you gather about your employees, visitors to your sites, customers and suppliers about Covid-19 is processed in accordance with data protection laws.
Related FAQs
Many businesses that supply directly to consumers have been concerned to understand their legal position in relation to services that have been cancelled, or that they have been unable to perform, because of the Covid-19 pandemic, and in particular how to deal with deposits paid by consumers for such services. With some degree of restriction on the hospitality and tourism sectors likely to remain in place for some time, such questions will remain important for the foreseeable future.
Many charities have money that are considered restricted funds which are given to the charity or raised for a specific purpose. The Charity Commission gives guidance on this, please see the link below. Depending on the circumstances in which these monies have been given to a charity or raised you may or may not be able to use them.
Monies raised in an appeal or specific fund raising campaign are unlikely to be available as it is likely to be impossible to get the permission of the donor to change the use. If however you have had monies donated for a specific purpose and you can identify the donor you can use these funds for general overheads and to pay wages etc. if you receive the donor’s specific permission to do so.
The now defunct Guidance for the Tier system suggested that the clinically extremely vulnerable would be treated in the same way as those who were shielding in Lockdown 1. This means that anyone who is clinically extremely vulnerable and cannot work remotely, will be entitled to SSP. These employees should receive a letter confirming that they are deemed to be clinically extremely vulnerable/shielding and you should ask for a copy of it as evidence to support a claim for SSP. It is likely that the Lockdown 3 Guidance will be the same.
You could also furlough an employee in the clinically extremely vulnerable category. Again we do not anticipate this changing.
The Government’s guidance says walk, cycle or drive to work and avoid public transport if you can. Businesses will need to support workers in adopting alternative travel methods to reduce exposure to the virus. You could consider staggering start and finish times for shifts to reduce commuting during peak hours, or support cycling with secure storage facilities and a drying room.
You will need to keep a copy of the written agreement for a period of 5 years. If the hours of work change from that which you initially agree, you are likely to need something new in writing to cover each separate arrangement.
You should also keep records of how many hours your employees work and how many hours they are furloughed (i.e. not working). You must keep these records for 6 years, together with a record of the amount claimed, your claim reference number and your calculations.