Insights

The ICO has published updated guidance in relation to data protection now that covid-19 measures are relaxing across the UK. The guidance does not put in place new or additional rules, but it is a useful prompt for companies to check over their data protection policies and procedures, especially where these were altered to cope with the changes brought about by the covid-19 pandemic.

The guidance encourages organisations to review in particular whether certain personal data they had begun gathering is still necessary for the purpose it was previously being collected; whether information collected during the covid-19 pandemic is still required to be retained; and whether the desired results could be achieved without collecting the personal data.

Companies will want to review data such as PCR test results and vaccination status that they may have collected in relation to employees over the course of the pandemic, and consider whether they still require to collect such information, whether existing information requires to be obtained, and whether there are other means of achieving the same aim going forward.

When making this assessment, it is important to consider what obligations the company has under health and safety laws and contractual obligations with clients and customers, as well as the contractual relationship with its own employees. Employers should always remember that information must be collected for one or more of the purposes listed in the legislation, and that they must only use information collected for the purpose or purposes that the data was originally collected for. Once that purpose or purposes has been achieved, the data must be deleted. 

As restrictions ease, it may be a good time to refresh policies and data privacy impact assessments to see what is required going forward.