Data Protection Measures For Businesses & The Coronavirus

A number of UK businesses are seeking guidance in relation to how they handle their employee and customer data in accordance with data protection legislation due to the coronavirus outbreak. We have answered some of these concerns below.

Data protection measures for businesses due to the coronavirus pandemic

An employee has tested positive for the coronavirus, can I inform other workers?

The main issue of concern for organisations is where an employee has contracted the virus and, as a result, what information can then be passed onto their work colleagues (e.g. the name of the person who has contracted the coronavirus).

Under current data protection legislation, it is fine for organisations to inform members of staff that another employee has tested positive for the virus, as this is ‘managing people’s vital interests’ and the employer has a legal obligation to keep all of their employees safe.

Additionally, a business may need to inform their workforce of the name of the person who has contracted the virus, as colleagues will need to work out whether they have had contact with that person and could therefore have been exposed to the illness. However, the ICO advises organisations:

“should not provide more information than necessary”.

Can we temperature test employees?

Some employers have been considering whether to implement a programme of testing employees’ temperatures.

Whilst businesses should take all reasonable efforts to safeguard their employees’ health, we are advising against this course of action, as it is not necessary in the circumstances and these type of tests should be left to health care professionals.

However, employers are being recommended to obtain information from employees if:

• They display any symptoms of the coronavirus;
• Have come into contact with anyone displaying the symptoms; or
• Have visited a country or region which has been heavily impacted by the virus outbreak.

This information could be collated through systematic data collection processes, such as employee questionnaires or requesting that workers report any coronavirus symptoms they display, any potential exposure to the virus or their travel plans to affected countries. These measures are listed under Articles 6 and 9 of the General Data Protection Regulations (GDPR).

Should my business put in place data sharing measures for self-isolating employees or workers who are having to work from home?

Working from home or in self-isolation can often pose data sharing issues for businesses as it can often be tricky for them to know when and how a data breach has taken place.

Employers are advised to review their current networks and how they share data to ensure they are protected. In particular, a data protection impact assessment is a useful tool for an employer to understand the full data processing activities undertaken and any potential risk area(s).

Here are a couple of steps which businesses could put in place or review to combat data breaches when working in self-isolation or from home:

• Create or review an existing data protection policy for employees to operate by when working remotely. The policy should include what to do when a problem crops up. Employees should then receive training in order to comply with the policy.
• Create or review homeworking policies so that they deal with processing data remotely and set out requirements for work done remotely.
• Placing an auto locking function on a laptop or PC’s screen after a specified amount of time of non-use (e.g. one minute).
• For devices which use cloud or VPN services, the device could be monitored through geo mapping, checks on devices (e.g. USB sticks) being used or by preventing information being saved from the cloud to a local PC drive.
• Additionally, information could be encrypted so that if a device is lost, then the data cannot be opened.