Kelly Fraser: What RSLs need to know about coronavirus and data protection
All organisations across the world are facing challenges as a result of the coronavirus (COVID-19) pandemic and Kelly Fraser says many Registered Social Landlords (RSLs) will be concerned about what this means for their day-to-day operations.
While data protection is often a term that we want to avoid thinking about, the current situation will have implications on how RSLs use personal data.
Information Commissioner’s Office guidance
The Information Commissioner’s Office (the ICO) recently issued guidance for organisations on the challenges faced during this time:
The guidance sets out the ICO’s position regarding enforcement of data protection compliance during this time and so while there will be no extension of applicable statutory deadlines (for example, the deadline for responding the data subject requests), the ICO has confirmed its intention not to penalise organisations for failing to meet such deadlines as a result of COVID-19 measures.
Data Protection impact for RSLs
RSLs will need to think about how COVID-19 will affect your operations, particularly in relation to staff and tenants.
As we see it, COVID-19 may have the following implications for data protection compliance:
- Increased homeworking: RSLs should consider what security measures are appropriate to allow staff to work from home where required to do so, either as a result of self-isolation or Government guidance; and
- Collecting health data: while RSLs will have obligations to protect employees’ health, this does not mean that large amounts of health data should be collected where this is unnecessary. It is still important to ensure that you only collect the personal data that you need for specified purposes. This will also apply to volunteers, tenants and other service users; and
- Communication of cases: if your RSL does have cases of COVID-19, you may need to share this information with anyone who interacts with your RSL. Identifying individuals should be avoided, where necessary, but you should consider if identification is necessary to protect others. There are potentially risks from a data protection perspective here where you are not operating under a duty of confidentiality but we would hope that wider public health concerns are taken into account in order to mitigate these risks.
Notification of changes to use of personal data
It is still important to consider transparency regarding how RSLs use personal data during this challenging time in order to ensure that individuals understand how RSLs may need to use additional personal data, particularly relating to health which is a special category of personal data.
If an RSL is putting in place additional measures to protect its employees or those that it regularly engages with, we would recommend that a short notification is issued in order to confirm how this may change the way in which the RSL uses personal data as this will likely go beyond what is currently covered by your privacy notices.
Get in touch
If you have any particular concerns regarding data protection compliance during this time, please contact a member of our team.