Kelly Fraser

While data protection is often a term that we want to avoid thinking about, the current situation will have implications on how RSLs use personal data.

Information Commissioner’s Office guidance

The Information Commissioner’s Office (the ICO) recently issued guidance for organisations on the challenges faced during this time: 

The guidance sets out the ICO’s position regarding enforcement of data protection compliance during this time and so while there will be no extension of applicable statutory deadlines (for example, the deadline for responding the data subject requests), the ICO has confirmed its intention not to penalise organisations for failing to meet such deadlines as a result of COVID-19 measures.

Data Protection impact for RSLs

RSLs will need to think about how COVID-19 will affect your operations, particularly in relation to staff and tenants.

As we see it, COVID-19 may have the following implications for data protection compliance:

1. Increased homeworking: RSLs should consider what security measures are appropriate to allow staff to work from home where required to do so, either as a result of self-isolation or Government guidance; and
2. Collecting health data: while RSLs will have obligations to protect employees’ health, this does not mean that large amounts of health data should be collected where this is unnecessary. It is still important to ensure that you only collect the personal data that you need for specified purposes. This will also apply to volunteers, tenants and other service users; and
3. Communication of cases: if your RSL does have cases of COVID-19, you may need to share this information with anyone who interacts with your RSL. Identifying individuals should be avoided, where necessary, but you should consider if identification is necessary to protect others. There are potentially risks from a data protection perspective here where you are not operating under a duty of confidentiality but we would hope that wider public health concerns are taken into account in order to mitigate these risks.

Notification of changes to use of personal data

It is still important to consider transparency regarding how RSLs use personal data during this challenging time in order to ensure that individuals understand how RSLs may need to use additional personal data, particularly relating to health which is a special category of personal data.

If an RSL is putting in place additional measures to protect its employees or those that it regularly engages with, we would recommend that a short notification is issued in order to confirm how this may change the way in which the RSL uses personal data as this will likely go beyond what is currently covered by your privacy notices.

Get in touch

If you have any particular concerns regarding data protection compliance during this time, please contact a member of our team.

• Kelly Fraser is senior associate at Harper Macleod

• Read all of our articles relating to COVID-19 here.