UK: COVID-19 – New Data Protection Guidance

Authors: Robert Hill and Sophie Jackson

The guidance provides a brief overview of the relevant issues now that the COVID-19 rules have been relaxed. The ICO’s recommendations for employers include:

• Practices put in place during the pandemic: Reviewing these to assess whether, in light of the latest government guidance, the personal data they collect is still necessary – and that it is still reasonable, fair and proportionate to the current circumstances.
• Any additional personal data collected and retained during the pandemic: Ensuring that it is securely disposed of if it is no longer required.
• Vaccination information: If you are continuing to collect vaccination information – and there must be a compelling reason to do so – be clear about what you are trying to achieve and how asking people for their vaccination status helps to achieve this. Use of this data must be fair, relevant and necessary for a specific purpose.
• Positive COVID-19 cases in the workforce: Although data protection law does not prevent employers from keeping staff informed about potential or confirmed COVID-19 cases among colleagues, ensure that the information provided is limited to no more than is necessary and that individuals are not named.

Key Action Points for Human Resources and In-house Counsel

Employers should check the government guidance published for England, Northern Ireland, Scotland and Wales before deciding what steps to take around the use of personal information now that the COVID-19 rules have changed.

Data protection is only one of a number of factors to consider in relation to vaccination information, and employers should also take into account: employment law and contracts with employees, health and safety requirements, and equalities and human rights (including privacy rights).