Can I wait until April to carry out assessments?

As mentioned earlier, if an agency is involved you must send them a copy of the status determination statement for each contractor, and they will also have the right to dispute the outcome.

If the agency pays the contractor, they will be responsible for the operation of PAYE and NIC’s deductions and any apprenticeship levy. The agency may try to recover these costs from the end user client.

If workers are supplied by an agency or umbrella company and are already treated as employees by the agency, they will remain unaffected by IR35.

There has been a significant amount of press coverage talking about institutional racism within the NHS not only in terms of the treatment of patients but also in terms of the low representation of ethnic minority staff in management positions. Whilst tackling that issue is beyond the brief here, it is important to recognise that sub conscious bias can, regrettably, play a part in decision making processes. An Employment Tribunal will explore a alleged discriminator’s conscious and sub conscious decision making and working in an environment which has not set out sufficient controls to avoid such sub conscious stereotyping places someone at a greater risk of being discriminated against.

In the context of the issues we are addressing here, i.e. risk assessments around BAME staff, as we have stated above, it is essential that BAME staff are represented at all levels in the discussion. Trusts need to be mindful that BAME are underrepresented in management positions.

BAME staff need to be included in the dialogue and need to have a safe place where they can challenge decisions that are being made in relation to them. There needs to be accountability in the processes applied. Meaningful conversations need to happen and concerns should not be dismissed.

Yes, you can ask to see any information/documentation sent to an employee informing them that they should self-isolate.

With the loss of face-to-face meetings in the current situation, video conferencing has taken centre stage. But how do you do that in a compliant way? Here are some of the main high-level data protection issues to consider when selecting and implementing a new third party provider’s video conferencing system.

1. Make sure you do your due diligence on the security measures offered by the provider. Clearly you can’t visit them, so look at the information offered publicly by the provider and read good quality, reliable, third party sources and ask the provider questions directly. Also ask any other organisations you know that use the provider. Document all this.
2. If personal information is being sent outside of the UK/European Economic Area, make sure that transfer complies with GDPR. If it’s a US provider, is it registered in the EU-US Privacy Shield list or does it offer a model clause contract (you’re likely to need the 2010 version)? Or is the service provided from a country whose data protection laws offer equivalent protection to those in Europe? Look at the support service as well as the hosting. Document this.
3. Make sure you put a compliant processor agreement in place. The provider should offer one as part of the contract terms. Check it meets GDPR requirements.
4. You’re likely to need to update your privacy notice, particularly if you’re going to record calls. Provide participants with a short message and link to the privacy notice in the meeting invite and on any registration page.
5. Create or update other GDPR-mandated documentation – for example, depending on your use, you may need a legitimate interests assessment and to update your record of processing.
6. Finally, configure and use the system in a secure and compliant way. Look at the settings/options carefully and think through the security and compliance implications of each. That could include deciding who in the meeting can share their screen; whether or not you use passwords for participants; whether or not to record, and if you’re going to record, where to store the recording. Document your decisions and the reasons for them.

The ICO has said it understands that resources, whether they are finances or people, might be diverted away from usual compliance work during the pandemic. However the last thing you need at the moment is to create a bigger problem than the one you are trying to solve. So do the best you can, ask for help from one of our specialists if you need it, and keep the whole thing under review.

On 16 April 2020, Ian Hulme, the ICO’s Director of Assurance, posted a blog for business owners, employers and managers about how to safely roll out the latest video conferencing technology.

On 21 April 2020, the NCSC published security guidance for organisations on choosing, configuring and deploying video conferencing services.

Yes.

Workers (and agency workers) who are aware of the requirement to self-isolate and are due to work during their isolation period at a place other than their designated place (see below) must, as soon as reasonably practicable and in any event before they are next due to start work within the isolation period, tell their employer that they are self-isolating, and set out the start and end dates of their isolation period.

Clear communication to all workers about their obligation to do this is strongly recommended.