Cherington HR is now part of HR Solutions ...but it's business as usual! Visit to find out more.

ICO guidance updated following relaxation of Covid 19 Measures

With Covid-19 measures having been significantly relaxed and/or removed, the Information Commissioner's Office (ICO) has set out some key questions organisations need to consider around the collecting and storing of personal data. You may have been collecting Covid-specific data in relation to your employees and visitors, so you now need to review what you have been doing to see whether there are still justifications and make sure they are securely stored.

There is more detail on the ICO website, but the questions businesses need to ask themselves are:

1. Is it still necessary to collect and process additional personal data?
Any emergency practices should be reviewed to decide if the information that has been, or is being, collected is still necessary. Consideration should be given to: (a) how will the collection of extra personal information help keep the workplace safe? (b) is the information previously collected still needed? and (c) could the desired result be achieved without collecting personal information?

2. Should information collected during the pandemic be retained?
In compliance with government guidance, additional personal data might have been gathered and retained e.g. to facilitate test and trace. The ICO recommends that organisations assess any additional information collected and retained and ensure that any information that is no longer required is securely disposed of.

3. Can organisations still collect vaccination information?
If organisations are continuing to collect vaccination information, they must have a compelling and lawful reason, which is both necessary and transparent. Use of legal obligation as a basis for processing this data is unlikely to still be valid, so another lawful basis must be established. Organisations must be clear about what they are trying to achieve and how asking people for their vaccination status helps them to achieve this. Use of this vaccination data must be fair, relevant and necessary for a specific purpose and organisations should check the appropriate government guidance. If the use of vaccination data is likely to result in a high risk to individuals (e.g. denial of employment opportunities or services) a data protection impact assessment should be completed.

4. How will positive cases in the workforce be managed?
Data protection law doesn't prevent an employer from keeping staff informed about potential or confirmed Covid-19 cases among their colleagues but wherever possible employers should avoid naming individuals and not provide more information than is necessary.

You can find more information on the ICO website here:
Posted on 19 Apr 2022
< back
Cherington HR is now part of HR Solutions, giving you access to more benefits and tools to support your workforce.
Cherington HR Limited is registered in England and Wales Company No. 5780092. VAT No. 288 1519 70. Registered Office: HR Solutions, Unit 6, Brooklands Court, Kettering Venture Park, Kettering, United Kingdom, NN15 6FD

The cheringtonhr® name and logo are UK registered trade marks owned by Cherington HR Limited.