Does GDPR stop me sharing information about the health of citizens and staff?
No. Data protection law does not stop information being shared about individuals – in emergency situations, it enables it. But we can only share information when it is lawful to do so, and where the information is relevant.
Can the Council collect health data about employees in relation to COVID-19?
Yes. The Council has a duty to ensure the health and safety of employees, as well as a general duty of care to them. Collecting and monitoring health data helps fulfil this duty. Data is being collected to help understand the impact of COVID-19 on employees and service delivery and to assist in arranging testing for relevant employees.
Can I tell staff that a colleague may have potentially contracted COVID-19?
Yes. Depending on the circumstances, you may need to inform staff, but you shouldn't provide any more information than necessary. It's unlikely that you will need to name the person.
As a general rule, you should only tell staff that someone has tested positive if that person was in the workplace up to 72 hours prior to their symptoms developing - this information is to be shared to inform others in case they begin to develop symptoms. Staff will only need to self-isolate if advised to do so by the NHS Test and Protect team or if they develop symptoms.
Can I share employees' or service users' names, contact details and health information with other public authorities for public health purposes?
Yes. As well as statistical data, we may be asked to share personal data about particular individuals with health organisations for the purposes of contact-tracing or other public health reasons. We can do this under GDPR if we have a legal obligation to do so (for example under public health or civil contingencies legislation) and/or where it is necessary to protect the vital interests of individuals.
Where can I get further information?
Please have a look at the Information Commissioner's data protection and coronavirus information hub.
For further advice please contact the Information Governance Manager or email email@example.com.