Posted on

Data Protection and Contact Tracing – How do Businesses Ensure Cross Compliance?

COVID-19 has seen unprecedented change across all sectors in which everyone has had to adapt and change at a speed.

The government has provided guidance in relation to contact tracing in which they state that organisations in certain sectors should collect details and maintain details of staff, customers and visitors on their premises. Test and Trace is run by the NHS and is a key part of the country’s ongoing COVID-19 response. NHS Test and Trace includes contact tracing staff working to contact everyone that has been potentially exposed to COVID-19 which will assist in eliminating the spread and controlling COVID-19. This scheme is entirely voluntary and the accuracy of the information provided is solely the responsibility of the individual who provides that data. There is no requirement for business to verify an individual’s identity for NHS Test and Trace purposes.

Therefore you may be faced with the situation of collecting personal data, but ensuring you handle it lawfully.

The Information Commissioner’s office, the regulator for data protection, has issued some guidance to organisations regarding protecting customer and visitor details. This can be summarised as follows:

  • Ask for only what’s needed.
  • Be transparent with customers.
  • Carefully store the data.
  • Don’t use it for other purposes.
  • Erase it in line with government guidance.

There are some important key points to be aware of above. In particular, it may be tempting to include individuals personal data on any marketing and mailing lists. However, it is clear that this personal information cannot be used for his purpose where the collection of the data is as a result of contact tracing in line with government guidance.

Although the retention of data for the purpose of track and trace cannot be retained for marketing purposes, you may wish to consider whether you ask express permission for this ability and ensure it is separate and not a requirement of individuals providing their details for the purposes of track and trace. You will need to consider your privacy policy and have clear processes to ensure personal data is collected lawfully.

Another important point is that of retention. The government guidelines currently specify that personal details should be kept for 21 days, which reflects the incubation period for COVID-19 and an additional 7 days. The personal data that is collected for the purpose of contact tracing must be deleted after this time. Please note that records which are made and kept for other business purposes do not need to be disposed of, and this only relates to that of contact tracing.

Now may be the time to look at your organisations privacy policy and also ensure that customers are aware of the collection of their personal data in line with an organisation following government guidance in relation to contact tracing. With the rapid changes we have experienced recently the law in a variety of areas has changed or been relaxed. In some areas it could be said the law conflicts on certain topics. Sadly it is your burden to reconcile how it impacts all your organisation and steer a lawful course through it all!

If you have any questions or are not sure about your requirements of data protection, Covid-19 or any other regulatory matter, then please contact the regulatory team at Woods Whur and we would be happy to discuss the guidelines with you in accordance with GDPR and your wider obligations. If you would like to contact us, please email james@woodswhur.co.uk or sfrow@woodswhur.co.uk or call us on 0113 234 3055.

Posted on

What a difference a week makes

Last Friday I had a meeting in Manchester followed by a client lunch where we were pre-occupied with discussing how our businesses were going to cope with the Coronavirus outbreak. None of us realised that a week later, the leisure and gambling industries would be so badly affected or by the pace of change. I didn’t anticipate then that I would have asked all of my staff to start working from home and put us into almost isolation. Technology is a wonderful thing and it is amazing that we can keep our business going through remote access to our systems. This doesn’t come anywhere near to the social interaction that we have through the workplace.

A usual Friday morning in the office, in dress down clothing and with a fantastic breakfast sandwich from Nosh, is one of the best days of the working week.

So much has changed at such speed.

On Monday and Tuesday of this week, all of our outstanding hearings at licensing authorities around the Country were stood down. These were some review hearings and some premises licence applications that had valid representations. In all of those cases we have been told that the likelihood is that these will not be relisted until after May. This is obviously going to put breaks on the development plans of a number of companies. We also have a number of applications which are currently running through their notice periods and if they receive valid representations, it is in doubt a hearing on those particular will be listed.

I did notice last night that Wandsworth Council held a remote hearing where technology was used to get everybody to remotely log into the hearing.

I have had this previously where I was permitted to dial into a summary review interim steps hearing even though I was away on holiday. It just shows that there is the ability and technology to set this up should we enter a prolonged period of isolation. Gary Grant, the Licensing Specialist Barrister from FTB Chambers, wrote an excellent article entitled ‘Licensing hearings during the Coronvirus crisis.’ This article set out the fact that there is an ability for remote hearings to take place. He highlights that there is no legal bar to holding a Licensing Sub-Committee using remote technology. This will be practically very difficult, albeit legally possible, in that most authority areas have started to send their staff home to work remotely as well. This is to continue and the likelihood is that applications will be adjourned rather than more remote hearings.

There are clearly significant operational issues that come about whilst premises are still open. It is critical that the licensing objectives are promoted by operators who choose to stay open and conditions on premises licences will need to be complied with. If anyone has any confusion of where we are on this then please contact us directly by mobile number or email.

In addition, the Business Crime Hub from the Metropolitan Police Service have sent out a very helpful note in relation to their position moving through unprecedented times.

Our colleagues in Scotland have been grappling with the issues as well and Glasgow City Council have sent out a very clear “advice and guidance for current licence holders and new applicants on changes to our licensing service.” This is to last for the period of Covid-19 outbreak.

This highlights that there are to be no face to face appointments. All planned meetings with the licensing and regulatory committee and the City of Glasgow Licensing Board have been postponed.

In addition, they are asking that only the most essential applications are submitted and if they are submitted, they should be sent by electronic means rather than paper work.

Glasgow have moved very quickly to set out a very clear guidance document which can be found at the following link – http://www.sllp.co.uk/TWLinks/C19.pdf.  We understand that most other Scottish Licensing Boards are offering similar advice to clients.

The Gambling Commission is sending out regular notifications as to their expectations during these testing times.

In the most recent email sent yesterday, the Commission highlighted that they are following Public Health England’s Guidance and have told all staff to work from home until further notice. They have set out that the Commission has set out a well-practiced and comprehensive business continuity plan that they have invoked with the intention of minimising the impact on their regulatory and advice services.

The Gambling Commission have highlighted that whilst these current circumstances create unprecedented changes to daily life, that these changes will also increase the risks to some individuals which mean that despite the fact that these are changing times, customers must be protected by operators.

They set out “first and foremost we expect all our licensees to follow the applicable Public Health guidance, which I am confident you will already be doing. Where facilities for Gambling are being offered, we expect all our licensees to ensure that they have sufficient management, staffing and an oversight in place to maintain compliance with the LCCP that apply to their licences.

The social distancing measures that are being put in place will mean that more people will be at home and we would like to remind online operators that they must continue to act responsibly, especially in regard to individual customer affordability and increase social responsibility interactions.” – Neil McArthur. This is a clear message that the Gambling Commission expects licensed operators to be increasing their social responsibility principles during this period. In addition, the Gambling Commission have written to us directly to ask that we do not send any documents by post. All documents to be received are expected to be scanned and sent electronically.

They are currently deciding how to proceed with personal licences, usually they require an original identification to be provided but are going to be determining how to deal with this during the currency of the outbreak.

It is clear that the Gambling Commission is seeking to provide a service as close to normal working life as possible.

The taxi licensing sector is going to be seriously affected through the Covid-19 outbreak.

The Government guidance is that no driver should be working if they have a new continuous cough and/or high fever and should obviously at that point self-isolate.

Drivers of Hackney Carriage or private hire vehicles, Hackney Carriage and private hire proprietors and private hire operators have responsibilities under the Health and Safety at Work Act 1974 to both themselves and those who are likely to come into contact with their business.

We would hope to see that taxi licensees are frequently cleaning and disinfecting objects and surfaces that are touched regularly.

They will have been reminded of the following document – http://r20.rs6.net/tn.jsp?f=001ORzch4VgR_8_4jtHWPrUhWWXUFEwPk1_yOx0G_BvwCVE3JgV7KFDkHPQLVdB6-mnHKtXBIf9D1jSjJ734LV2TMR1XtsIMLvnHr9xulnjGD30DGLmenz_JiAMNHnev78MjVN8LtMIFJ0dgvo3_cwki5eaFxCXB7J0IRcX4z7jb90l5Q_bpeiomNoX5NFdfxuU2zTS8JXMfav1GTWBRLaxHyArFqnXeanjwAiOWwOeItGPSPaEYk044ST_yHdsvMDrCGNbEvLJz_2Dn14ayhV5vPYxQ46JOAmwQOE0Y7l0K5Wj6JEQsl3AMNcnumKAjhM4EXaLUrIFGzUSIs-e3jhnTfqOTjxvuvOUcxOMbI8jQJI=&c=8o17pjsQEdLRrknxnpRasOps3Ta5IG1AoK62O9nwvRAR5wEMVqqstw==&ch=BlkNCzs5PWMCwu2JegPktSao_dEXzv_JXLr8B99FSikLegMQ4yKqRQ.

We are certain that taxi’s will continue to play a vital role in the movement of people through these difficult times.

It is now becoming clear that we are going to be in a protracted period of different working practices. We hope that everyone will look to make the licensing process and regulatory remit as user-friendly as possible during this period. I have had a significant number of messages from operators asking how our team is and the element of interaction has been high. This is at a time when their own businesses are closing for public safety reasons.

Having being in the leisure sector for over 30 years, I can attest to the fact that they are a resilient bunch. It’s now imperative that the Government give significant financial support so that these businesses, viable until the outbreak of the Coronavirus, have the ability to come through the other side and provide the much needed distractions that we will all be looking forward to by then. The measures so far announced don’t go far enough and it is hoped that the Councillor will be making more practical announcements later today which can come into effect very quickly. A significant number of my clients have been posting that they are now closing voluntarily until we are through the worse of the virus. These are fabulous responsible operators, viable businesses, who deserve to be supported by central Government.

Paddy

Posted on

Business as Usual?

Our departure from the EU slipped by at 11pm last Friday without any noticeable change to our daily lives!

In fact, a number of government organisations were very quick to tell me by email on Saturday morning that definitely nothing had changed in terms of regulatory compliance!

The Health and Safety Executive, Environment Agency and a clutch of other government departments/agencies have been busy telling me this and I’m sure any hopes and dreams of us leaving behind any dreaded EU directives and regulations are a little premature!

The duties that you have to discharge from a regulatory view point created by EU directives & regulations are still unaltered and are still requiring your attention and compliance.

Of course, over this year we will see the fruit or not of the government’s negotiations with the EU and the position may change.

That said, I would be prepared that the status quo will remain and where EU law has been adopted into domestic legislation –  don’t expect a bonfire of EU legislation.

Where I see a divergence from EU legislation will be achieved a little more subtly and over a longer period of time. We now have the possible advantage to choose what pieces of EU legislation from a regulatory view point are appropriate and potentially adopt them into UK legislation or discard them and adopt our solutions to particular regulatory issues.

For me, this is a welcome potential development. The ability for us to choose legislation which is relevant in particular to the situation prevailing at the time in the UK, rather than trying to adopt EU legislation which may be particularly specific and easy to comply with in some countries in the EU, but not necessarily the UK.

I am currently concluding a lengthy and time consuming case for a client who has been objecting to complying with some environmental legislation adopted from Europe, which is wholly inappropriate in the context of the client’s operations in the UK.

In an ideal future, I would like to think that Parliament would have created legislation which is tailored to our needs in the UK and prevent the costs and wasted time in trying to adopt legislation designed to generically apply to all the member states rather than specifically to one.

Unfortunately, only time will tell if we ultimately end up with regulatory systems which do this – fingers crossed that we do!

Posted on

Data Day is Dawning…

You are no doubt aware about it, received various emails from online retailers regarding it and been asked to update your social media profiles concerning it, but what exactly are the new General Data Protection Regulations (GDPR) about?

James Thompson, Woods Whur’s Head of Regulatory, looks at the key aspects of the GDPR on the dawn of its implementation on 25 May 2018.

In short, the GDPR applies to both “data controllers” and “data processors”, the former terms retain their same broad definitions adopted from the Data Protection Act 1998 (DPA), and relates to “personal data” and “sensitive personal data”. The DPA too will be replaced by a new Data Protection Act which is currently passing through parliament.

In order to process personal data, the processing action must be a lawful act, and the issue of consent to process personal data is an important consideration.

Under GDPR, where consent is required, it must be “be given, specific, informed and an unambiguous indication of the individual’s wishes” in other words a clear intention of the party to affirm the agreement to consent to their personal information being used. Consent cannot be implied, inferred from silence or relied on from a pre ticked box on a form. However, don’t panic, consent is not required on all occasions. Data controllers do not require consent if the action relates to other lawful activities, such as where the processing is required to comply with a legal obligation or to take steps to enter/perform a contract.

What is also significant is the increase in the penalties that can be handed out to non-compliant organisations. It is vital to comply with the GDPR to avoid a fine of €20 million (circa £17.5 million) or 4% of the company’s global annual turnover of the previous financial year, whichever is higher.

In addition to the above, the GDPR has made other key changes to individual’s rights under data protection laws, it has increased accountability placed on the data controller and given individuals a greater say in how their personal data is used.

If you are reading this and you have not yet updated your policies to comply with the GDPR or would like advice on the GDPR and how it could affect you or your business, then please get in contact with us and we will be happy to assist.

James@woodswhur.co.uk

0113 234 3055