What is the NICE guidance around Service organisation?

Employers will be collecting and sharing health information. Health information is sensitive and higher data protection standards apply. Here are a few key pointers.

• Update privacy notices to cover the new collection and sharing of employees’ information and provide these to the workforce. Be transparent and fair.
• Identify the legal basis and condition for use of this information and put any required paperwork in place. The ICO guidance will help. For some conditions such as the employment condition, an Appropriate Policy Document (APD) will be required. The ICO has an APD template.
• Only use the information for the purpose of managing the workforce during the pandemic.
• Only collect or share information if it’s necessary – if it’s a targeted and proportionate way of achieving your purpose.
• Make sure any health information collected and shared is accurate – there may be serious consequences if it’s not.
• Work out how long the information must be kept for. Keep a record of that period and act on it at the appropriate time.
• Security is very important – there may be malicious actors trying to trick employers and employees. Make sure employees know how to identify a genuine NHS Test and Trace contact. Keep the information secure. Use the ICO’s data sharing checklists** and keep a record of the disclosures made and why. Control external disclosures – only certain authorised members of staff should make them.
• Make sure individuals can still exercise their data protection rights – that’s also very important. Keep data protection records up-to-date and ensure any exports of personal information outside the UK are compliant.
• Before introducing employer-led testing like taking temperatures, thermal imaging or other potentially intrusive tests, work out if a data protection impact assessment (DPIA) is required. It will be if the intended processing is ‘high risk’. If it is, then carry out a full DPIA. It will help address the issues systematically and mitigate risks.
• All this demonstrates ‘accountability’ – it shows affected individuals and the ICO that the employer is complying with data protection requirements.

If you need further help, please visit the ICO’s data protection and coronavirus information hub or ask our data protection team.

** Please note that this link is to the ICO’s existing checklists and data sharing code of practice. We will update the link to the ICO’s new checklists after they are published.

• Yes, and this includes furloughed employees under the Coronavirus Job Retention Scheme.
• Employers must continue to assess their new employees or newly eligible existing employees and enrol them where required, but can make use of the statutory postponement procedure which allows them to delay for up to three months the assessment of new employees for the purpose of enrolment (see further details here on the Pensions Regulator’s website). Declarations of compliance for new employers must still be completed in the normal way.
• Postponement cannot be used for re-enrolment. The Regulator recommends employers use the re-enrolment date tool on the Regulator’s website to choose a date up to three months after the third anniversary of enrolment to assess staff for re-enrolment. Further information about employers’ obligations about reenrolment from the Pensions Regulator can be found here. Re-declarations of compliance for new employers must still be completed in the normal way.

An amendment to the Civil Procedure Rules’ Practice Directions has been approved by the Master of the Rolls and the Lord Chancellor on 1 April 2020, and is now Practice Direction 51ZA. This has the effect of allowing the parties to extend by prior written agreement up to a maximum of 56 days (rather than the usual 28 days detailed at CPR 3.8(4)) any rule, practice direction or order provided that any extension does not put at risk any hearing date. This Practice Direction will cease to have effect on 30 October 2020.

Additionally each regions’ Designated Civil Judge (DCJ) has issued a Covid-19 Protocol. There are some minor variations between the regions, but overall the guidance is very similar.

In Northumbria, Durham and Teesside the DCJ guidance for multi-track cases provides that “The parties are at liberty to extend, by consent, any step in the timetable up to a maximum of 90 days (as opposed to the present limit of 28 days)” and the Court does not need to be notified if the Trial date is not effected. Where Trial windows are likely to be impacted due to Covid-19 and the parties are in agreement to extending this, a letter can be sent to the Court with a draft order proposing a new timetable, including a new trial window and agreed availability within the trial window.

The same guidance also confirms that an electronic signature on all documents including witness statements and disclosure statements will suffice.

On 18 April 2020, it was announced that an exception to the current stay in possession proceedings and ban on all evictions has been made to allow possession orders to be made against trespassers.

This means land owners can take action to remove unauthorised persons occupying their land. Trespassers include: squatters; travellers; failed successors of secure tenancies; and licensees whose licences have been terminated.

Further, the automatic stay to possession proceedings currently imposed no longer applies to applications for interim possession orders meaning any persons found to be “squatting” on land without permission may again be subject to an order requiring them to leave your premises within 24 hours of service of that order.

Obtaining an employee’s Covid-19 test result will amount to processing personal data for the purposes of the General Data Protection Regulation 2016/679 (GDPR) and information about an employee’s health is a special category of data (sensitive personal data under the Data Processing Act 2018 (DPA)).

In accordance with the GDPR and DPA, there must be lawful grounds for processing such information. Most employers rely on employees’ consent to obtain medical information and process sensitive personal data and if the employee is unwilling to give consent, you will not normally be entitled to the information.

Special category data can be processed lawfully if it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller. Employers may be able to require an employee to disclose their Covid-19 test if there is a substantial public interest, such as ensuring that the employee self-isolate if they have a positive test. However, there is a risk that this measure could be considered disproportionate particularly if it is enforced on all employees as a blanket measure.