What are the data protection implications of holding Covid-19 health data?
The ICO is providing new guidance to organisations regarding data protection and coronavirus, which can be accessed here: https://ico.org.uk/for-organisations/data-protection-and-coronavirus/
Information about the Covid-19 health status of individuals is special category data under the GDPR. This means it is high risk which has implications for how you use it, store it and keep it secure.
You will already hold health data about your employees as this is necessary to provide a safe, accessible place to work and to make reasonable adjustments to the workplace. You now need to make sure that the information you gather about your employees, visitors to your sites, customers and suppliers about Covid-19 is processed in accordance with data protection laws.
Related FAQs
The GMC recognises the challenges the doctors may face as the situation continues to develop. This includes concerns about the risks to the health of the doctors when treating patients with coronavirus. Doctors should follow the current public health advice including self-isolating if they know or suspect that they are infected or are at a higher risk of infection.
Finally, all necessary steps should be taken to ensure that doctors have access to protective equipment and minimise the risk of transmission when treating patients. It is imperative that a record is kept of all decisions made and how any safety or health concerns have been handled.
The GMC continues to work with NHS England and UK’s Chief Medical Officers to provide updates and advice to all doctors as the situation develops. Click here for more information.
The Cabinet Office has published a useful Procurement Policy Note (“PPN”) on relief available to suppliers due to Covid-19 (available here). In brief, you should not be penalised by a public sector body, if, in the current circumstances, you are unable to comply (fully or partly) with your contractual obligations. Public sector bodies are expected to work with suppliers and, if appropriate, provide relief against current contractual terms. This is in order to maintain business and service continuity and avoid claims being accepted for other forms of contractual relief, such as the occurrence of a force majeure event.
The types of relief that may be available to suppliers to the public sector will depend on the existing contracts in place. Some contracts may have a payments by result mechanism, whereas others may be based on certain key performance indicators (KPIs) being met. Other contracts may not include any such mechanisms and therefore it will be a matter for discussion between suppliers and the public sector body.
The PPN provides that, rather than a supplier seeking to invoke a clause that would permit the supplier to suspend performance of its obligations (such as a force majeure clause), public sector bodies should first work with the supplier to amend or vary the contract. Any changes should be limited to the particular circumstances and considered on a case-by-case basis. Changes could include:
- Amending the contract requirements
- Varying timings of deliveries
- Relaxing KPIs or service levels
- Extending time for performance (e.g. revising a contract delivery plan), and/or
- Preventing the public sector from exercising any rights or remedies against the supplier for non-performance (e.g. liquidated damages or termination rights).
These should only be temporary variations and the contract should return to the original terms once the impact of the Covid-19 outbreak on the contract has ended. Discussions with the public sector body about any changes that are agreed should be documented, in a variation signed by both parties.
A public sector may also need to take account of regulation 72 of the Public Contract Regulations 2015, to ensure that any changes to a contract (even of a temporary nature) do not trigger a requirement to conduct a new tender process. Whilst this may be unlikely to be the case with temporary variations, suppliers should still bear this in mind when discussing any changes to a contract with a public sector body.
If you are a supplier to a public sector body and you are currently struggling to meet your contractual obligations, we recommend that you take legal advice as to whether it might be possible to take advantage of the flexible approach that the PPN requires public sector bodies to adopt – it could be that you can avoid service credits or other financial deductions, or the need to serve formal notices such as “force majeure” or other relief notices.
The fee payer that pays the fee to the contractor’s PSC for the services (end user client or agency) will be responsible for operating PAYE and deducting NIC’s. The fee payer must also pay employer NIC’s and where applicable the apprenticeship levy so there will be additional costs involved in the event of a change to employed status for tax purposes.
If the assessment concludes that the contractor is self-employed, the PSC can continue to be paid gross.
Whilst many employees may now have the resources and equipment to work from home, an employee may struggle to effectively work from home for a number of reasons. For example, an employee may not have a suitable working environment where they can work without being disturbed or alternatively, working from home for prolonged periods of time may be having a detrimental impact on the employee’s mental well-being.
In circumstances such as these, employers must carry out a careful assessment. Unfortunately, there is not any specific guidance as to when an individual cannot ‘reasonably’ work from home – it is likely that each case will be fact specific.
In relation to employees who are struggling with their mental well-being, employers owe their employees a duty of care. It is crucial that procedures are in place which will enable an employer to recognise the signs of stress as early as possible. In the circumstances, it may be appropriate to allow an employee to attend their place of work if this would help alleviate work-related stress or to prevent mental health issues.
The Office of the Public Guardian is continuing to accept applications to register Lasting Powers of Attorney but their usual estimated timescale of eight to ten weeks is likely to be affected by the current situation.
Consequently, an alternative or interim measure if you need something quickly is to execute a General Power of Attorney to authorise someone to act as your Attorney to undertake day to day financial transactions for you. The General Power of Appointment only needs to be executed by you in the presence of a witness (not the Attorney) to be valid and does not need to be registered with the Court of Protection. However, the Power of Attorney would cease to have effect if you become incapable of managing your affairs. It should be seen as a stop-gap only.