The Information Commissioner\u2019s Office (ICO) is calling for views on data protection and employment practices to help them shape their upcoming guidance products which will see existing guidance replaced with \u201ca new, more user-friendly online resource with topic-specific areas\u201d.<\/p>\n
DLA Piper\u2019s employment group will be submitting a response to the ICO\u2019s call for views and our submission will be informed by responses to our employer survey which you can access here<\/a><\/strong>.\u00a0 This 5 minute survey asks you to identify the areas which businesses find tricky to manage when handling employee data and where updated or additional guidance would assist.\u00a0\u00a0 Our survey will close on 11 October\u00a02021.<\/p>\n The ICO\u2019s existing Employment Practices Code<\/a> was published in 2011 and has since been added to with supplementary guidance<\/a>\u00a0and a\u00a0quick guide<\/a>. As the ICO acknowledges, however,\u00a0 much has changed in the last decade.\u00a0\u00a0 The General Data Protection Regulation and the Data Protection Act 2018 have implemented legislative change.\u00a0\u00a0 Employee data subject access requests have become more widespread and detailed than was ever anticipated by legislators or regulators.\u00a0\u00a0 Also, the pace of technological change means that artificial intelligence and automated decision making are now regularly used as part of human resource management.<\/p>\n These changes had already created an environment in which it was onerous for employers to meet their employee data privacy obligations when the COVID-19 pandemic arrived,\u00a0 bringing with it yet further challenges.<\/p>\n Remote working, which began as an immediate response to the government\u2019s COVID-19 stay at home instructions,\u00a0 is now widespread across many sectors and looks set to remain for the long-term.\u00a0 Despite the benefits associated with remote working,\u00a0\u00a0 employers feel hampered in their ability to supervise staff and check productivity.\u00a0 As a result,\u00a0 use of technology for employee monitoring is expanding.\u00a0\u00a0 These practices are possible under UK data privacy laws,\u00a0 but there are a number of matters for an employer to consider and steps to take to ensure such activity is lawful –\u00a0 for example, data protection impact assessments as well as data privacy policies and procedures are required and employees must be informed of their employer\u2019s monitoring activities.<\/p>\n Another significant impact of COVID-19 has been a surge in employers processing employee health data, be that information on employee vaccination status or COVID test results.\u00a0 Data privacy is a significant issue here given that health information constitutes \u201cspecial category data\u201d which is subject to extensive protection under the UK data privacy regime.\u00a0\u00a0\u00a0\u00a0 As well as undertaking a health and safety assessment of the COVID-19 workplace risks to assess if, for example, testing is necessary measure, any employer wanting to access COVID-19 status data will need a data privacy impact assessment and a clear legal basis for processing employee health data.<\/p>\n Given these extensive developments, there is now a significant mismatch between the ICO employment practices guidance and the issues which employers are grappling with on the ground.\u00a0\u00a0 This makes the ICO\u2019s proposed update a welcome development,\u00a0 particularly given the indication that the guidance will be developed to meet the needs of those who use it.<\/p>\n As before, you are welcome to provide your responses to our employer survey which you can access here<\/a>\u00a0<\/strong>which we shall use (along with our knowledge of the challenges employers face generally) to inform our responses to the ICO consultation.\u00a0 Our survey will close on 11 October 2021.<\/p>\n