How much data can I gather?
You also need to consider other aspects of data protection.
Be proportionate – only gather and use Covid-19 data where you need to.
Keep data to a minimum – you shouldn’t gather more data than you need. You need to know someone has Covid-19 but you don’t need to know all their symptoms. Data minimisation also applies to who gets access to the data. It’s unlikely that a spreadsheet, accessible to everyone updating them on the health status of all employees, would be appropriate. Data should be shared on a need to know basis. You need to balance the privacy of individuals against your duty of care to be responsible with regards to the data of your employees, visitors, customers and suppliers.
Keep it up to date – make sure you update data. People’s health status will change and if you keep a record of this, you need to make sure it is accurate and up to date (although this doesn’t mean you should batter individuals with constant requests for updates on health status. Again, be proportionate).
Identify individuals only when you need to – although you will need to know who has Covid-19, that doesn’t mean you need to tell everyone in the organisation. As soon as you can, you should remove personal data from any information you gather. For example, you might want to update employees on the health status of their fellow employees but you probably don’t need to name individuals and even if you feel it is necessary, you should keep the information you provide to a minimum. Removing personal identifiers in a document is also a good data security technique.
Keep the Covid-19 health data secure – Covid-19 data will be special category data and deemed high risk. This means that if you have a breach of this data you will need to notify it to the ICO. A breach could happen by someone losing a print-out of the names of Covid-19 employees, customers or visitors. It could also happen if you set access rights to lists of Covid-19 sufferers open to more people than need to know the information. The risk of ICO enforcement action increases with the potential harm the disclosure could cause. Although the ICO has indicated that it will be understanding about the impact of Covid-19 on normal operations, this doesn’t mean that they will not prosecute you if the breach is sufficiently serious.
Destroy the data once you don’t need it – Finally, of course, make sure that you delete data at the end of your needs. This might last longer than the pandemic, for example if you have an insurance claim or ongoing litigation. If you do need to keep it, consider whether or not you can delete some of the data to minimise what you hold.
Related FAQs
The government has announced a number of measures to try to protect businesses during the current period of uncertainty. However there is no outright ban on creditors being able to take legal action to recover money they are owed, though there are temporary restrictions on some forms of legal action, like winding up petitions.
However, it is important to note that these measures only relate to winding up proceedings. Creditors will still be free to commence county court claims.
The new Corporate Insolvency and Governance Act 2020 brings in a new “moratorium” procedure. Businesses in financial difficulty that are viable and can be rescued will now be able to work with an insolvency practitioner to obtain at least 20 business days’ breathing space from creditors to allow the business to formulate a plan to deal with its financial problems.
For more information on the Corporate Insolvency and Governance Act, click here
As part of the raft of measures put forward by the government over recent months, there are also restrictions on landlords taking action to evict commercial tenants who miss rent payments. Various payment holidays and forbearance have been put in place in respect of certain tax liabilities and some business rates.
If your business is going to go into an insolvency process like administration or a company voluntary arrangement, there is the ability to obtain a freeze on creditors taking action whilst those procedures are put in place. However, these sorts of moratoriums will not be available to everyone and in any event not unless an insolvency process is being instigated.
Regardless of whether a business has formal protection from creditors or not, engagement with creditors and trying to reach agreement with them to deal with the debt is therefore vital. Much of the protection measures that the Government has introduced like curbing the ability of landlords to evict a commercial tenant, do not wipe out the debt. They simply prevent action being taken or a payment becoming due for a short time. All businesses should use that time to consider how those debts can be dealt with and engage with the relevant stakeholders sooner rather than later.
The fee payer that pays the fee to the contractor’s PSC for the services (end user client or agency) will be responsible for operating PAYE and deducting NIC’s. The fee payer must also pay employer NIC’s and where applicable the apprenticeship levy so there will be additional costs involved in the event of a change to employed status for tax purposes.
If the assessment concludes that the contractor is self-employed, the PSC can continue to be paid gross.
The guidance is non-statutory and is not binding on business. However, businesses should be aware that there might be reputational consequences if they do not follow the guidance; we have already seen in the context of taking advantage of furlough funding that not being in breach of the law is no protection against negative publicity. Further to the extent a contract expressly requires parties to act reasonably, it could be expected that this guidance is one of the factors a court would consider in determining what is reasonable.
The end user client will be responsible for assessing if the contractor is employed or self-employed for tax purposes. It is required to take reasonable care in carrying out the assessments.
When an assessment is carried out the outcome must be confirmed to the contractor with accompanying reasons in a Status Determination Statement (SDS). This SDS must be provided to the contractor before making payment to them. It must also be provided to the agency if there is one in the chain (more on this later).
The end user client must have a dispute resolution procedure to enable to the contractor or agency to appeal the assessment outcome.
No. No action need be taken in relation to the demand but we would advise against presentation of a petition based upon any Statutory Demand issued between 1 March 2020 and the end of the restrictions. As you may be aware, with Winding Up there is no requirement to issue a Statutory Demand notice before proceeding so this is unlikely to create too many issues – click here to see whether you should issue petitions on other grounds.
There is nothing to prevent statutory demands being served at this time. However, there may be limited benefit as it cannot form the basis of a future winding up petition.