How is the Pensions Regulator reacting to the crisis?

Employers will be collecting and sharing health information. Health information is sensitive and higher data protection standards apply. Here are a few key pointers.

• Update privacy notices to cover the new collection and sharing of employees’ information and provide these to the workforce. Be transparent and fair.
• Identify the legal basis and condition for use of this information and put any required paperwork in place. The ICO guidance will help. For some conditions such as the employment condition, an Appropriate Policy Document (APD) will be required. The ICO has an APD template.
• Only use the information for the purpose of managing the workforce during the pandemic.
• Only collect or share information if it’s necessary – if it’s a targeted and proportionate way of achieving your purpose.
• Make sure any health information collected and shared is accurate – there may be serious consequences if it’s not.
• Work out how long the information must be kept for. Keep a record of that period and act on it at the appropriate time.
• Security is very important – there may be malicious actors trying to trick employers and employees. Make sure employees know how to identify a genuine NHS Test and Trace contact. Keep the information secure. Use the ICO’s data sharing checklists** and keep a record of the disclosures made and why. Control external disclosures – only certain authorised members of staff should make them.
• Make sure individuals can still exercise their data protection rights – that’s also very important. Keep data protection records up-to-date and ensure any exports of personal information outside the UK are compliant.
• Before introducing employer-led testing like taking temperatures, thermal imaging or other potentially intrusive tests, work out if a data protection impact assessment (DPIA) is required. It will be if the intended processing is ‘high risk’. If it is, then carry out a full DPIA. It will help address the issues systematically and mitigate risks.
• All this demonstrates ‘accountability’ – it shows affected individuals and the ICO that the employer is complying with data protection requirements.

If you need further help, please visit the ICO’s data protection and coronavirus information hub or ask our data protection team.

** Please note that this link is to the ICO’s existing checklists and data sharing code of practice. We will update the link to the ICO’s new checklists after they are published.

With the outbreak of coronavirus leading to a requirement for more employees to be working remotely, especially following Government advice that all non-essential travel including to and from work should be avoided, there has been an increased requirement for businesses to be more flexible in their approach to signing contracts.

The traditional approach has been for contracts to be printed and signed with a “wet ink” signature. However, this is not a strict legal requirement in the majority of circumstances and contracts can be formed without this degree of formality. English law recognises that contracts can be formed by electronic means – including the exchange of emails or the typing of a name into a document to signify agreement to it.

Whilst this approach offers a lot of flexibility, more sophisticated electronic signature tools are recommended for important documents, to enable the identity of the signatory to be validated and reduce the possibility of fraud.

If businesses are considering changing their contracting processes because of coronavirus, or because of a general shift towards paperless working, it is important to ensure that proper approval processes remain in place, and to consider whether a software tool should be used to complement them. Systems such as DocuSign are widely used.

There also remain some situations where legal advice is recommended before relying on an electronic signature:

• Where the other party is abroad – as local laws that are different from English law might apply
• If executing a deed – the law requires certain types of document to be executed as a deed (for example, transfers of land and powers of attorney), and the issues around electronic signature and witnessing are more complicated here

We recommend that ongoing support is provided to all MHFA’s beyond completion of the MHFA training. It is necessary to do refresher training (approx. every 3 years) and ideally ongoing ‘continued professional development’ should be provided as well as regular opportunities for debriefing / seeking support. One way of supporting your MHFAs in the workplace is by creating a buddy system amongst the MHFAs. That way the individuals carrying out the role of MHFAs have a support structure in place amongst themselves. All trained MHFAs can also reach out to management to discuss any concerns they have or to seek any further support they need.

Every company has to file accounts at Companies House every year. If they are filed late, a fine is automatically levied. If there is a long delay in filing them, the directors are at risk of prosecution and the Registrar of Companies might start a process which could ultimately lead to the company being struck from the register.

However, Companies House has recognised that businesses might currently face exceptional problems in preparing and filing their accounts on time and so have posted a notice on their website which says that if immediately before the filing deadline, it becomes apparent that accounts will not be filed on time due to coronavirus, you can make an application to extend the period allowed for filing.

Arrangements for end point assessments can be modified or rescheduled. End point assessment organisations should engage with External Quality Assurance Providers to agree arrangements for the end point assessments where face-to-face assessments are being modified. Where rescheduling is required due to Covid-19 issues and there is a specified time limit for the ESA post gateway, a further pause of 12 weeks is allowable. This should be recorded by the training provider in the ILR.