Skip to content

What do we need to do?

Privacy policy – You must make sure the relevant privacy policies deal with how you will process Covid-19 data. You should have an employee privacy policy and this may already deal with health data (if it doesn’t, it should). You might also need to look at privacy policies for customers, visitors and suppliers. This ensures that processing is lawful, fair and transparent.

Lawful processing conditions – You will need to consider which processing conditions you are relying on (remembering that you need both an Article 6 condition and an Article 9 condition – this is the part of the GDPR which deals with special category data). As a lot of the data you collect will be about employees, you can’t use consent so you will have to find another lawful reason under GDPR which allows you to process the data.

Appropriate policy document – When you are considering your Article 9 processing conditions, remember you must also have an “appropriate policy document” in place.

Processing record – Finally make sure your processing record is up to date with information on what data you collect and use.

Related FAQs

What challenges to planning permission does the current lockdown situation present?
  • Delays in preparing and submitting applications to comply with pre-commencement conditions. In this respect there can be lengthy timescales gathering evidence to support applications to comply with pre-commencement conditions, ecology, contamination and archaeology are examples of matters which can require significant periods of survey work
  • Following on from the above the ability to get required experts on the site necessary to undertake the required survey work
  • Delays in the determination of applications to comply with pre-commencement conditions. In this respect whilst there are deemed discharge provisions/procedures concerning certain matters, the provisions cannot be used to discharge all types of conditions
  • The ability to get people on site to undertake material operations

In the circumstances, it is advisable to start considering the implementation of the planning permission early and the earlier the better. Under current legislation whilst it is possible to vary conditions, albeit potentially leading to wider issues, it is not possible to extend the life of a planning permission meaning that lawful implementation is essential to avoid the loss of that permission.

If a planning permission is lost, amongst other things it may not be granted again or may not be granted on similar terms. In the circumstances, it is advisable to seek advice given the specific facts of the case to minimise the risk of a planning permission not being lawfully implemented and expiring.

What are the limitations of furloughing staff for publicly funded organisations?

The guidance from the Government concerning private sector organisations is very different from the guidance for public sector and organisations that receive public funding. The guidance states:

“The government expects that the scheme will not be used by many public sector organisations, as the majority of public sector employees are continuing to provide essential public services or contribute to the response to the coronavirus outbreak.

Where employers receive public funding for staff costs, and that funding is continuing, we expect employers to use that money to continue to pay staff in the usual fashion – and correspondingly not furlough them. This also applies to non-public sector employers who receive public funding for staff costs. Organisations who are receiving public funding specifically to provide services necessary to respond to Covid-19 are not expected to furlough staff.”

This guidance isn’t particularly clear but it appears that there is a recognition that there are different types of organisations which could be caught by this:

  1. Organisations who will be required to provide frontline services during the Covid-19 response. It is interpreted that NHS organisations such as NHS Trusts will fall firmly into this category. Employees of such organisations are expected not to be furloughed and to continue to work and be paid their normal salary in the usual way.
  2. Organisations who receive public funding to provide services to respond to the Covid-19 crisis. These organisations are not expected to furlough their staff. The type of organisation that would fit into this category are those that have been commissioned to developing breathing apparatus or testing kits to meet the needs of the healthcare sector during the peak of the pandemic.
  3. Organisations who receive public funds for staff costs to operate services. Employers are expected to continue to pay staff if the money to pay them is publicly funded. It is strongly inferred that this is irrespective of whether such staff have any work to perform. The type of organisation that is likely to fall into this category are GP practices, charities and private sector companies that have won contracts with the public sector.
What are the holiday rules for someone on Flexible Furlough?

Employees continue to accrue leave during furlough (whether they are on full furlough or flexible furlough) and can take leave during periods of Flexible Furlough (so long as you top the grant up to full pay for any days taken as holiday).

Government guidance has been updated to state that “Employees should not be placed on furlough for a period simply because they are on holiday for that period.” If a period of furlough happens to coincide with an employee’s holiday then you should ensure that there are business grounds to support furlough being used in that instance so that it isn’t just being used as a means to fund holiday utilisation.

How should an employer handle personal information in relation to NHS Test and Trace?

Employers will be collecting and sharing health information. Health information is sensitive and higher data protection standards apply. Here are a few key pointers.

  • Update privacy notices to cover the new collection and sharing of employees’ information and provide these to the workforce. Be transparent and fair.
  • Identify the legal basis and condition for use of this information and put any required paperwork in place. The ICO guidance will help. For some conditions such as the employment condition, an Appropriate Policy Document (APD) will be required. The ICO has an APD template.
  • Only use the information for the purpose of managing the workforce during the pandemic.
  • Only collect or share information if it’s necessary – if it’s a targeted and proportionate way of achieving your purpose.
  • Make sure any health information collected and shared is accurate – there may be serious consequences if it’s not.
  • Work out how long the information must be kept for. Keep a record of that period and act on it at the appropriate time.
  • Security is very important – there may be malicious actors trying to trick employers and employees. Make sure employees know how to identify a genuine NHS Test and Trace contact. Keep the information secure. Use the ICO’s data sharing checklists** and keep a record of the disclosures made and why. Control external disclosures – only certain authorised members of staff should make them.
  • Make sure individuals can still exercise their data protection rights – that’s also very important. Keep data protection records up-to-date and ensure any exports of personal information outside the UK are compliant.
  • Before introducing employer-led testing like taking temperatures, thermal imaging or other potentially intrusive tests, work out if a data protection impact assessment (DPIA) is required. It will be if the intended processing is ‘high risk’. If it is, then carry out a full DPIA. It will help address the issues systematically and mitigate risks.
  • All this demonstrates ‘accountability’ – it shows affected individuals and the ICO that the employer is complying with data protection requirements.

If you need further help, please visit the ICO’s data protection and coronavirus information hub or ask our data protection team.

** Please note that this link is to the ICO’s existing checklists and data sharing code of practice. We will update the link to the ICO’s new checklists after they are published.

Given the recent decline in financial performance, the business is now in breach of its covenants with the bank. Should we be concerned?

That will depend on the terms of your facility and the stance taken by your bank.

Banking facilities often place obligations on businesses to stick to certain financial criteria. For example, an obligation to keep turnover or profit above certain levels or a commitment to keep the bank’s exposure within an agreed percentage of the value of the company’s assets (known as loan to value ratio).

The consequences of breaching those covenants will depend on the terms of your facility, but normally this amounts to an event of default. Events of default can result in the loan (or whatever form the facility takes) becoming repayable and could give the bank certain powers to take action to recover the money that they are owed.

Whether the bank will take action during these unprecedented times is another matter, particularly given the extent of support being offered to businesses via mainstream lenders and the political desire to keep viable businesses up and running. Lenders themselves will no doubt wish to remain supportive where possible. The underlying performance of the business (and whether but for the effects of Covid-19 it would have been in a healthy financial position), the relationship you have with the bank and your history with them will no doubt be relevant to the approach taken by the bank. However, early engagement with your bank (as well as other key stakeholders in the business) will be important.