Skip to content

What are the data protection implications of holding Covid-19 health data?

The ICO is providing new guidance to organisations regarding data protection and coronavirus, which can be accessed here: https://ico.org.uk/for-organisations/data-protection-and-coronavirus/

Information about the Covid-19 health status of individuals is special category data under the GDPR. This means it is high risk which has implications for how you use it, store it and keep it secure.

You will already hold health data about your employees as this is necessary to provide a safe, accessible place to work and to make reasonable adjustments to the workplace. You now need to make sure that the information you gather about your employees, visitors to your sites, customers and suppliers about Covid-19 is processed in accordance with data protection laws.

Related FAQs

What was the purpose of the Chancellor's economic update?

On Wednesday 8 July 2020 as part of a summer ‘mini-budget’, Rishi Sunak delivered the Government’s response to the threat to millions of jobs due to the existing furlough arrangements being wound down from August 2020 until it planned to close at the end of October 2020. In a wide-ranging speech to Parliament, the Chancellor announced a number of schemes to look to protect jobs beyond October 2020, in particular in certain sectors and for those aged 18-24. As the Government releases further information over the coming days and weeks, we will add to these FAQs.

We are conscious that asking a particular group of people, who have a protected characteristic under the Equality Act 2010, to restrict their duties, could expose the Trust to allegations of discrimination. What steps can we take to avoid someone/a group of people feel that they have been treated differently because of their protected characteristic?

A claim for indirect discrimination is the most likely risk here. The first point to make is that the decision to review duties is being made based on the growing amount of medical evidence that the BAME community is being disproportionately adversely affected by the COVID 19 pandemic compared to other ethnic groups. The key is to ensure that blanket policy decisions are not taken, nor should assumptions be made about the risk to each individual concerned. Decisions should only be made on an individual basis with an open dialogue with the individual concerned. You as their employer, need to ensure that the individual feels listened to and heard; that this is not just a tick box exercise.

Consider having a working group which has an overview of the policy decisions being made. That working group should contain representatives from across the staff groups including staff side, but importantly, representatives from different ethnic backgrounds to ensure the important voices are heard. Accountability should be built into that group. This group should also be a safe environment for staff to raise concerns about their health and safety and safe systems at work.

Can employees on Flexible Furlough work as union or non-union representatives or as pension trustees?

Employees who are union or non-union representatives may undertake duties and activities for the purpose of individual or collective representation of employees or other workers. However in doing this, they must not provide services to or generate revenue for, or on behalf of your organisation or a linked or associated organisation.

Employees who are pension scheme trustees or trustee directors of a corporate trustee may also undertake trustee duties in relation to the pension scheme. However, a professional, independent pension scheme trustee who has been furloughed by the independent trustee company cannot undertake trustee work that would provide services to or generate revenue for, or on behalf of, the independent trustee company or any organisation linked or associated with that independent trustee company during hours when they are recorded as being on furlough.

Can I collect health data in relation to Covid-19?

Yes. With respect to employees you have an obligation to protect their health so you can gather information to do that. You might gather information from your employees on who has the virus, who has had it and recovered and also who has tested negative. You might also want to know if individuals have been in contact with someone who has it or if they are in a vulnerable group. It is reasonable to want to know where individuals have travelled. In the future it may also be reasonable to know if they are planning to travel to a virus hot spot, as the impact of the virus around the world is likely to continue for some time even after the outbreak has been contained in the UK.

It is reasonable to gather some information about visitors to your site, be they customers or suppliers, as this information will also help protect your staff. However, you should keep what you gather to a minimum. For visitors, it’s unlikely that you need to know anything more than they have Covid-19, are displaying symptoms or have recently been in contact with someone who has the virus.

Do the usual publicity requirements for planning applications still apply?

The Government has introduced new regulations, which took effect on 14 May 2020, to relax the publicity requirements in respect of planning applications.

Planning applications are usually required to be publicised by way of site notices and local newspaper notices and applications are to be made available for public inspection. The Government has recognised that these actions may not always be possible in accordance with social distancing guidelines and in order that Councils do not delay applications as a result of an inability to comply with the publicity requirements, the Government has relaxed the requirements.

A Local Planning Authority is now required to “take reasonable steps” to publicise a planning application, which may be through use of online newspapers, social media, or other electronic measures. What is considered reasonable will depend upon the circumstances of an individual application and will be proportionate to the scale and impact of the development. A large development that has previously generated significant interest will require more steps to bring the application to the attention of all of those with an interest than a householder application. The guidance emphasises the role of the publicity requirements, namely to enable those with an interest to make representations and to effectively participate in the decision making process and therefore community engagement remains key. It is recommended that the officer’s report refers to the steps taken where a Council has relied upon the temporary publicity arrangements.

The requirement to make planning applications available for public inspection has also been temporarily suspended providing that the applications are available for online inspection. In reality most LPAs already provide such an online facility. Where individuals are unable to access an application online LPAs should make alternative arrangements, for example providing information over the phone or providing a hard copy set of documents by post.

The regulations however only amend the statutory publicity requirements. In addition to these, all LPAs are required to have a Statement of Community Involvement which may provide for additional publicity requirements and the LPA will be bound by these regardless of the temporary relaxation of any statutory requirements. Where a Statement of Community Involvement does go beyond the statutory requirements, the Government guidance suggests that LPAs update these to ensure that local communities can continue to be consulted in the current climate.

The regulations are currently due to expire on 31 December 2020.