What do we need to do?
Privacy policy – You must make sure the relevant privacy policies deal with how you will process Covid-19 data. You should have an employee privacy policy and this may already deal with health data (if it doesn’t, it should). You might also need to look at privacy policies for customers, visitors and suppliers. This ensures that processing is lawful, fair and transparent.
Lawful processing conditions – You will need to consider which processing conditions you are relying on (remembering that you need both an Article 6 condition and an Article 9 condition – this is the part of the GDPR which deals with special category data). As a lot of the data you collect will be about employees, you can’t use consent so you will have to find another lawful reason under GDPR which allows you to process the data.
Appropriate policy document – When you are considering your Article 9 processing conditions, remember you must also have an “appropriate policy document” in place.
Processing record – Finally make sure your processing record is up to date with information on what data you collect and use.
Related FAQs
Employees are generally permitted to take holidays during furlough. However, Government guidance has been updated to state that “Employees should not be placed on furlough for a period simply because they are on holiday for that period.” If a period of furlough happens to coincide with an employee’s holiday then you should ensure that there are business grounds to support furlough being used in that instance so that it isn’t just being used as a means to fund holiday utilisation.
“Switching” is where you can transfer from one visa category to another without leaving the UK. However, in many instances where an individual wants to change from one visa category to another, they have to leave the UK and apply from the country they normally reside in.
There are currently limited concessions in place due to the pandemic where you are able to switch visas from within the UK instead of applying from overseas. These are regularly updated and so please contact us for further information.
The financial implications of having to repay all deposits and advance payments could be very serious for some businesses. As an alternative to a refund, many are offering customers the opportunity to re-book at a later date, or a voucher that can be redeemed against a subsequent booking.
The CMA’s view on this practice is that consumers can in many situations be offered alternatives of this type, but they should not be “misled or pressured” into accepting this. Their view is that a refund should be an option that is just as clearly and easily available. The CMA also points out that any restrictions that apply to credits, vouchers, re-booking or re-scheduling, such as the period in which credits must be used or services re-booked, must also be fair and made clear to consumers.
The full CMA guidance re “The Coronavirus (Covid-19) pandemic, consumer contracts, cancellation and refunds” can be found here.
A claim for indirect discrimination is the most likely risk here. The first point to make is that the decision to review duties is being made based on the growing amount of medical evidence that the BAME community is being disproportionately adversely affected by the COVID 19 pandemic compared to other ethnic groups. The key is to ensure that blanket policy decisions are not taken, nor should assumptions be made about the risk to each individual concerned. Decisions should only be made on an individual basis with an open dialogue with the individual concerned. You as their employer, need to ensure that the individual feels listened to and heard; that this is not just a tick box exercise.
Consider having a working group which has an overview of the policy decisions being made. That working group should contain representatives from across the staff groups including staff side, but importantly, representatives from different ethnic backgrounds to ensure the important voices are heard. Accountability should be built into that group. This group should also be a safe environment for staff to raise concerns about their health and safety and safe systems at work.
Employers will be collecting and sharing health information. Health information is sensitive and higher data protection standards apply. Here are a few key pointers.
- Update privacy notices to cover the new collection and sharing of employees’ information and provide these to the workforce. Be transparent and fair.
- Identify the legal basis and condition for use of this information and put any required paperwork in place. The ICO guidance will help. For some conditions such as the employment condition, an Appropriate Policy Document (APD) will be required. The ICO has an APD template.
- Only use the information for the purpose of managing the workforce during the pandemic.
- Only collect or share information if it’s necessary – if it’s a targeted and proportionate way of achieving your purpose.
- Make sure any health information collected and shared is accurate – there may be serious consequences if it’s not.
- Work out how long the information must be kept for. Keep a record of that period and act on it at the appropriate time.
- Security is very important – there may be malicious actors trying to trick employers and employees. Make sure employees know how to identify a genuine NHS Test and Trace contact. Keep the information secure. Use the ICO’s data sharing checklists** and keep a record of the disclosures made and why. Control external disclosures – only certain authorised members of staff should make them.
- Make sure individuals can still exercise their data protection rights – that’s also very important. Keep data protection records up-to-date and ensure any exports of personal information outside the UK are compliant.
- Before introducing employer-led testing like taking temperatures, thermal imaging or other potentially intrusive tests, work out if a data protection impact assessment (DPIA) is required. It will be if the intended processing is ‘high risk’. If it is, then carry out a full DPIA. It will help address the issues systematically and mitigate risks.
- All this demonstrates ‘accountability’ – it shows affected individuals and the ICO that the employer is complying with data protection requirements.
If you need further help, please visit the ICO’s data protection and coronavirus information hub or ask our data protection team.
** Please note that this link is to the ICO’s existing checklists and data sharing code of practice. We will update the link to the ICO’s new checklists after they are published.