What do we need to do?
Privacy policy – You must make sure the relevant privacy policies deal with how you will process Covid-19 data. You should have an employee privacy policy and this may already deal with health data (if it doesn’t, it should). You might also need to look at privacy policies for customers, visitors and suppliers. This ensures that processing is lawful, fair and transparent.
Lawful processing conditions – You will need to consider which processing conditions you are relying on (remembering that you need both an Article 6 condition and an Article 9 condition – this is the part of the GDPR which deals with special category data). As a lot of the data you collect will be about employees, you can’t use consent so you will have to find another lawful reason under GDPR which allows you to process the data.
Appropriate policy document – When you are considering your Article 9 processing conditions, remember you must also have an “appropriate policy document” in place.
Processing record – Finally make sure your processing record is up to date with information on what data you collect and use.
Related FAQs
You cannot include the following payments in a claim:
- Discretionary bonus or commission payments
- Tips
- Non-cash payments
- Non-monetary benefits including taxable benefits in kind
- Salary sacrifice benefits that reduce an employee’s pay (however HMRC has agreed that such arrangements can be stopped by agreement if due to COVID-19 and the contract is changed)
The updated guidance has confirmed that all of the grant claimed should be paid to the employee in the form of money and that none of the grant is to the used to pay for the provision of benefits or a salary sacrifice scheme.
This is a concern for many businesses at the moment.
Firstly, the directors need to be mindful of their duties to creditors . Click here for further information on those duties and the measures introduced by the government to help support directors during these difficult times.
There is also a raft of funding and grants as well as commercial finance that might be available to you. Click here for further information or contact us if you would like to discuss further.
If you are coming under increasing creditor pressure, there are other options to explore like the new “moratorium” procedure, which allows viable businesses in financial difficulty to work with an insolvency practitioner to obtain at least 20 business days’ breathing space from creditors to allow the business to formulate a plan to deal with its financial problems.
If you have any concerns about the viability of your business you should speak to your advisors, whether that is your lawyers, accountants or an insolvency practitioner who should be able to help you.
The parties to litigation should still take the steps they have been ordered to take and comply with any Orders made by the court. If for any reason it looks as if a direction cannot be complied with because of the Covid-19 virus then an extension of time can be agreed with the other party (up to 28 days) or through the court. We are aware that Orders have been made extending the time for certain steps to be taken by 56 days.
Yes – there should be a framework in place to ensure that MHFAs are fully supported themselves and so that individuals are supported beyond the support the MHFAs provide.
Obtaining an employee’s Covid-19 test result will amount to processing personal data for the purposes of the General Data Protection Regulation 2016/679 (GDPR) and information about an employee’s health is a special category of data (sensitive personal data under the Data Processing Act 2018 (DPA)).
In accordance with the GDPR and DPA, there must be lawful grounds for processing such information. Most employers rely on employees’ consent to obtain medical information and process sensitive personal data and if the employee is unwilling to give consent, you will not normally be entitled to the information.
Special category data can be processed lawfully if it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller. Employers may be able to require an employee to disclose their Covid-19 test if there is a substantial public interest, such as ensuring that the employee self-isolate if they have a positive test. However, there is a risk that this measure could be considered disproportionate particularly if it is enforced on all employees as a blanket measure.