I’m the director of a company. What should I think about before accepting any of the funding that has recently become available?

The change in the law has the potential to place much greater financial risks on suppliers, making it more difficult to exit a contract with a customer of doubtful solvency.  This will place increased emphasis on appropriate financial due diligence and credit checking before entering into supply contracts.

In addition to the obvious issues around financial risk, suppliers will also need to think carefully about how their contracts are drafted.  For example, any form of right that is drafted so as to be triggered on customer insolvency will clearly be problematic.  These could include:

• Retention of Title provisions, which are commonly drafted so that the right to enter premises and retake possession of the goods is triggered on insolvency;
• Provisions for brand protection, which seek to control how goods are dealt with on termination of the contract.

This is potentially a very significant development for many businesses.  We would strongly recommend specialist advice be obtained so that:

• businesses understand the potential increased risks faced; and
• where possible, contracts are updated so that appropriate protections are maintained.

The changes will not apply to end users who are a small company. If you meet two out the following 3 conditions, you will meet the small company definition and are therefore exempt from the changes to IR35:

1. Annual turnover is no more than £10.2 million
2. Balance sheet total is no more than £5.1 million
3. No more than 50 employees

Companies will always be classified as small in their first financial year. Public companies will always be considered to be medium or large businesses and cannot fall under this exemption.

For a group company to be a small company its parent company must also meet the small company definition.

The Home Office has not stated when it will end these temporary measures, albeit it has stated that it will provide a warning. Where employers have carried out checks using the temporary measures, the Home Office has confirmed that it will require employers to carry out retrospective checks on any of the following:

• Employees who started working for you when the temporary measures were in place
• Employees who required a follow up check during the temporary measures (for example because their previous leave was coming to an end).

It is not explicit from the guidance but these retrospective checks must require you to have in your possession the physical ID in its original form. When carrying out the retrospective check, employers must record this using the following wording “the individual’s contract commenced on [insert date]. The prescribed right to work check was undertaken on [insert date] due to Covid-19.”

These further checks must be made within eight weeks of the temporary measures ending, and employers must keep records of both checks undertaken. Where the employer discovers that the employee does not have the right to work during the retrospective check they should stop employing them.

Employers will be collecting and sharing health information. Health information is sensitive and higher data protection standards apply. Here are a few key pointers.

• Update privacy notices to cover the new collection and sharing of employees’ information and provide these to the workforce. Be transparent and fair.
• Identify the legal basis and condition for use of this information and put any required paperwork in place. The ICO guidance will help. For some conditions such as the employment condition, an Appropriate Policy Document (APD) will be required. The ICO has an APD template.
• Only use the information for the purpose of managing the workforce during the pandemic.
• Only collect or share information if it’s necessary – if it’s a targeted and proportionate way of achieving your purpose.
• Make sure any health information collected and shared is accurate – there may be serious consequences if it’s not.
• Work out how long the information must be kept for. Keep a record of that period and act on it at the appropriate time.
• Security is very important – there may be malicious actors trying to trick employers and employees. Make sure employees know how to identify a genuine NHS Test and Trace contact. Keep the information secure. Use the ICO’s data sharing checklists** and keep a record of the disclosures made and why. Control external disclosures – only certain authorised members of staff should make them.
• Make sure individuals can still exercise their data protection rights – that’s also very important. Keep data protection records up-to-date and ensure any exports of personal information outside the UK are compliant.
• Before introducing employer-led testing like taking temperatures, thermal imaging or other potentially intrusive tests, work out if a data protection impact assessment (DPIA) is required. It will be if the intended processing is ‘high risk’. If it is, then carry out a full DPIA. It will help address the issues systematically and mitigate risks.
• All this demonstrates ‘accountability’ – it shows affected individuals and the ICO that the employer is complying with data protection requirements.

If you need further help, please visit the ICO’s data protection and coronavirus information hub or ask our data protection team.

** Please note that this link is to the ICO’s existing checklists and data sharing code of practice. We will update the link to the ICO’s new checklists after they are published.

All employers have a duty to prevent illegal working, and carrying out proper Right to Work checks are a fundamental part of this. In light of Covid-19, the Home Office has brought in some temporary measures for employers to use to carry out the requisite Right to Work checks. Failure to follow these could lead to enforcement action and penalties.