Data protection and COVID-19

The Information Commissioner's Office (ICO) has created a data protection and coronavirus information hub for organisations seeking advice about using people's data during the coronavirus pandemic, which will be kept up to date with new relevant information. In particular, an article from the ICO blog on Community groups and coronavirus will be of interest.

The profound effects that the current crisis is having on many charities and community groups ways of operating may mean that it is more difficult for them to meet their usual standards of data protection practice. While the law still applies, the ICO's Q&A for organisations makes clear that they will not seek to penalise organisations having to prioritise other areas of their work in responding to the crisis.

As well as core activities, your organisation may also be creating or adapting services to meet community needs at the current time. This may involve handling sensitive health information, such as whether a person has contracted COVID-19 or has a serious underlying health issue. It is important that this data is handled responsibly and in line with the law. This ICO guide clarifies how data protection law can be applied in these sorts of situations.

In particular, you may be wondering if to assist vulnerable people you can share their personal information with authorities. The guide clarifies that it is lawful to do so where appropriate.

Your organisation has a duty of care towards employees, volunteers and participants. To protect them, you may find it necessary to inform them about cases of coronavirus in people they have come in to contact with. It should be possible to do this without having to name the affected person and sharing too much sensitive information about them.

It’s also reasonable to ask people who you, your employees and your volunteers come in to contact with to tell you if they are experiencing COVID-19 symptoms. Again, apply the data protection principles sensibly in doing so.

Staff and volunteers may be working from home. While this may be an unusual situation, information security is still an important consideration, and may be more challenging when staff are spread out and not in the office. The National Cyber Security Centre (NCSC) has useful guidance on home working.

Finally, you should also beware of false information spreading online as well as scams and cybersecurity attacks related to the pandemic.

For more general information on implementing data protection in your charitable organisation, see our Data Protection Toolkit.