What are the data protection implications of holding Covid-19 health data?
The ICO is providing new guidance to organisations regarding data protection and coronavirus, which can be accessed here: https://ico.org.uk/for-organisations/data-protection-and-coronavirus/
Information about the Covid-19 health status of individuals is special category data under the GDPR. This means it is high risk which has implications for how you use it, store it and keep it secure.
You will already hold health data about your employees as this is necessary to provide a safe, accessible place to work and to make reasonable adjustments to the workplace. You now need to make sure that the information you gather about your employees, visitors to your sites, customers and suppliers about Covid-19 is processed in accordance with data protection laws.
Related FAQs
Yes, if they are paid via PAYE. This includes agency workers engaged under umbrella companies.
The furlough should be agreed between the agency (the employer) and the worker and documented in accordance with the guidance. It is recommended that the decision to furlough is discussed with end user clients. Just like other employees, agency workers cannot perform work through or on behalf of the agency while furloughed. This includes work for the client.
For agency staff working under umbrella companies, it is for the umbrella company and the agency worker to agree on furloughing the worker.
The BBC
The national broadcaster’s collated content surrounding the Covid-19 pandemic:
https://www.bbc.co.uk/news/coronavirus
and with regards to business:
https://www.bbc.co.uk/news/business
Ultimately closing a service will be a decision that is taken at the highest level and that decision will depend on risk appetite. Often these types of higher risk are mitigated by way of insurance but that still depends on an insurer being willing to accept that risk. This decision will depend on accepting a known risk and its consequences.
This is something which is certainly on the Government’s radar as there is currently a Bill being heard in Parliament about making MHFAs a legal requirement for workplaces. It is still in the very early stages and therefore it is not clear at this stage what the outcome will be. What is clear is that this is an area which is being taken very seriously and it would not be surprising if measures were put in place regarding MHFAs in the workplace.
Conduct risk assessments! Your RA must cover every foreseeable risk arising from a return to the workplace, including the impact of reduced staff levels and any operational/administrative changes necessary to ensure social distancing.
Appropriate steps should be taken to manage and mitigate identified risks. Where this is not possible, businesses need to decide whether certain activities are necessary for the business to operate or if they can be temporarily put on hold.
Keep a close eye on the comprehensive Government guidance: https://www.gov.uk/guidance/working-safely-during-coronavirus-covid-19
In particular focus on social distancing and workplace health measures. This guidance will evolve over time and you will need to be sure that your organisation is sticking to it AND reviewing and updating its risk assessment.