13 March 2020

Over the last few days, we have seen a marked increase in the steps being taken by employers to protect their staff and clients from the impact of coronavirus. Health concerns remain paramount, but businesses also need to continue operating where possible and an inevitable part of limiting the spread of the virus and ensuring business continuity is the sharing of personal data.

The data used by businesses for these purposes may range from the circulation of home or mobile telephone numbers among staff, to notification of symptoms and infection. Most employers will already know that they do not generally require the consent of staff to process basic personal data and in fact will face difficulties in relying on consent. Instead, most employers will have a legitimate interest to process the personal data of staff. That said, it remains important to maintain transparency levels and advise staff as to how their personal data will be used.

The sharing of health data (“special category data”) presents more of a challenge but data protection law does permit the use and sharing of personal data where necessary for the purposes of carrying out specific legal obligations and rights of the employer, for example, ensuring the health and safety of workers.

Employers should continue to consider their data protection obligations to staff and ensure that data is processed in accordance with the data protection principles which should not present any departure from normal good practice.

The Information Commissioner has issued specific guidance which should provide employers with some comfort (https://ico.org.uk/for-organisations/data-protection-and-coronavirus/) and the theme is very much keep calm and carry on.

Contacts Lynn Richmond, Partner lyr@bto.co.uk T: 0131 222 2939