Skip to content

What are the data protection implications of holding Covid-19 health data?

The ICO is providing new guidance to organisations regarding data protection and coronavirus, which can be accessed here: https://ico.org.uk/for-organisations/data-protection-and-coronavirus/

Information about the Covid-19 health status of individuals is special category data under the GDPR. This means it is high risk which has implications for how you use it, store it and keep it secure.

You will already hold health data about your employees as this is necessary to provide a safe, accessible place to work and to make reasonable adjustments to the workplace. You now need to make sure that the information you gather about your employees, visitors to your sites, customers and suppliers about Covid-19 is processed in accordance with data protection laws.

Related FAQs

Have you had any safeguarding issues in relation to staff they see and do you follow your normal safeguarding pathway?

Safeguarding issues are relatively uncommon, however, if they do occur, the normal safeguarding procedure of the organisation should be followed.

What is the NHS coronavirus Test and Trace scheme and how does it work?

The NHS Test and Trace service is operated by the NHS in England to track and help prevent the spread of COVID-19. Where an individual displays symptoms of coronavirus they can be tested to determine whether or not they have the disease. Those with the disease will then be contacted by NHS contact tracers and asked who they have come into close contract with.
Close contact is defined as:

  • Face to face (within 1 metre)
  • Spent more than 15 minutes within 2 metres of another person
  • Travelled in a car or on a plane with another person

The contact tracer will then contact those people with whom the individual has come into close contact and tell them to self-isolate for 14 days.

Can directors, partners or those working under umbrella companies be furloughed?

Yes. The updated government guidance has confirmed that office holders (including company directors), salaried members of Limited Liability Partnerships (LLPs) individuals working under umbrella companies (including agency workers) and individuals who are classified as ‘workers’ rather than employees can be furloughed but only to the extent that they are paid via PAYE. Therefore director’s fees can be claimed (subject to the cap) but dividends are excluded, as are bonuses and commission payments.

Those who are paid annual are now eligible to make a claim, subject to meeting the remaining requirements. This includes being notified to HMRC on an RTI submission on or before 19 March 2020 which relates to a payment of earnings in the 19/20 tax year.

The decision to furlough a director or office holder should be adopted as a formal decision of the company or LLP which should be minuted and notified in writing.

Company directors can only undertake work to fulfil a duty or other obligation arising from an Act of Parliament relating to the filing of company accounts or provision of other information relating to the administration of the director’s company while furloughed and they cannot carry out work that would generate revenue or perform services to or on behalf of their company. This also applies to salaried individuals who are directors of their own personal service company (PSC).

Who is responsible for arranging the remote hearing in COP matters?

Where one or more of the parties is represented, responsibility for making the arrangements for the remote hearing will fall on either the applicant or the first represented party. If no party is legally represented, the court office will contact the parties to explain that the hearing will be held by telephone conference and will send them instructions on how this is to be achieved.

All remote hearings must be recorded. The responsibility for arranging the recording will be addressed on a case by case basis.

How can RPs carry out Person Centred FRAs/PEEPs on tenants within directly managed supported living units where the RP is not providing support and any floating support provider doesn't see it as part of their responsibility?

There is no simple answer.

The NFCC guidance states:

“The person-centred fire risk assessment is intended only as a simple means for non-specialists who have suitable understanding of relevant fire risks to determine whether additional fire precautions might be needed. The person who carries out the person-centred fire risk assessment will depend on the circumstances of the housing and support provision. It can be carried out by those who regularly engage with the resident, with input from specialists where necessary. Assessments will normally be undertaken with residents themselves.

In sheltered housing with scheme managers, the scheme managers normally engage with residents on a routine basis, enabling residents who need a person-centred fire risk assessment to be identified. Many vulnerable residents will be in receipt of care, so enabling the care provider to identify residents in need of a person-centred fire risk assessment. Providers of regulated care are required to take into account risks to people from their wider environment, to take steps to help people ensure that they are dealt with by appropriate agencies, or to raise safeguarding alerts when this is appropriate. Where a ‘stay put’ strategy is adopted, there will be a need to identify residents who need assistance from the fire and rescue service to evacuate the building.

In supported housing, the number of residents in each property is usually quite small. This, and the nature of the care service normally provided, enables person-centred fire risk assessments to be carried out asa matter of course, when a resident first moves into the property.

Where additional fire precautions cannot be provided in the short term, the risk should be reduced as far as reasonably practicable and an adult at risk referral should be made to Adult Social Care.”

Ideally then the RP will need to engage with any care providers in order to conduct the PCRA and identify risk mitigation measures. If they are reluctant to do so, the RP should engage with the individual in any event in undertaking the assessment.