What do we need to do?
Privacy policy – You must make sure the relevant privacy policies deal with how you will process Covid-19 data. You should have an employee privacy policy and this may already deal with health data (if it doesn’t, it should). You might also need to look at privacy policies for customers, visitors and suppliers. This ensures that processing is lawful, fair and transparent.
Lawful processing conditions – You will need to consider which processing conditions you are relying on (remembering that you need both an Article 6 condition and an Article 9 condition – this is the part of the GDPR which deals with special category data). As a lot of the data you collect will be about employees, you can’t use consent so you will have to find another lawful reason under GDPR which allows you to process the data.
Appropriate policy document – When you are considering your Article 9 processing conditions, remember you must also have an “appropriate policy document” in place.
Processing record – Finally make sure your processing record is up to date with information on what data you collect and use.
Related FAQs
Once the collective process concludes, an employer can make the decision to proceed with the restructure. They will then have 1-on-1 meetings with employees about the impact of the restructure on them. This will include consideration of alternative employment. There is no need to consult further about the proposal, merely the effect of the restructure on the individual.
Initially, the relaxation applied to supermarkets and food suppliers. This was subsequently widened to apply to other businesses, permitting them to collaborate where necessary to respond to the crisis in the interests of consumers.
The Government has introduced legislation to expand the list of those who can register deaths to include Funeral Directors who are dealing with the funeral arrangements and who has been authorised by a relative of the deceased to register the death. Also, the medical cause of death certificate can be emailed to the Registrar’s office and arrangements made to have a telephone appointment to provide the Registrar with information to register the death. The requirement to attend the Registrar in person to sign the Register has been relaxed so that this is not necessary. It will however still be necessary to register the death within 5 days.
Ultimately closing a service will be a decision that is taken at the highest level and that decision will depend on risk appetite. Often these types of higher risk are mitigated by way of insurance but that still depends on an insurer being willing to accept that risk. This decision will depend on accepting a known risk and its consequences.
In most circumstances the answer will be no. It would be an infringement of their human rights. It could also be a criminal assault.
However where there is a high risk to employees of exposure to COVID-19, such as care homes and healthcare environments, you might be able to make it a requirement of their role to have the vaccine.
First, consider whether you need to have a blanket requirement covering all employees or whether only certain groups who work in the most high risk areas require the vaccine.
You will need to do a thorough risk assessment balancing the amount that the risk of exposure would be reduced against the interference with the employee’s human rights. Consideration will need to be given as to whether insisting on the vaccine is proportionate to the risk and whether other less invasive steps could be taken instead, such as maintaining social distancing, wearing a mask, washing hands.
Any requirement for employees to be vaccinated should be communicated clearly to employees and trade unions together with a clear explanation for why it is necessary.