The Information Commissioners’s Office (ICO) has published guidance highlighting specific issues organisations and employers should consider in light of the relaxation of the Government’s Covid-19 policy.

The guidance suggests any emergency practices that were introduced as a result of the pandemic should now be reviewed. An organisation’s approach to information collection should also be reasonable, fair and proportionate.

The guidance recommends organisations ask themselves the following questions to form a view on whether their current practices should now be revised:

  • How will continuing to collect this extra personal information help keep the workplace safe?
  • Do you still need the information previously collected?
  • Could you achieve your desired result without collecting personal information?

It is necessary to establish what the organisation is trying to achieve, and how collecting this data helps the organisation achieve the identified aim. Organisations who wish to collect this data must use it in a way that is fair, relevant and necessary for a specific purpose.

The guidance also confirms organisations will need to identify a lawful basis for collecting this information since ‘legal obligation’ is no longer available as a lawful basis for collecting vaccination information. It is also important to remember health data is ‘special category data’ and so attracts extra protection.

The ICO also recommends avoiding naming individuals when informing staff about potential or confirmed Covid-19 cases.

We recommend reading the guidance in full to ensure your organisation is doing everything it can to remain compliant.