ICO Coronavirus Statement

The ICO has released some brief guidance for organisations around some of the main issues relating to coronavirus and the use or sharing of personal data. Our quick summary of the issues that need to be taken into account:

  • Always consider whether identifiable information actually needs to be shared – there are likely to be many circumstances where an individual does not need to be identified.
  • Always consider the purpose for which you would be sharing information – is it to send a general message to all staff informing them of remote working arrangements or do you want to share a message with specific members of a team?
  • Ensure you have a relevant lawful basis to be able to use or share the information, bearing in mind such information will constitute special category data (relating to an individual’s health). Some potential lawful bases, depending on the circumstances, are:


– The consent of the individual concerned – it may be reasonable to ask for consent if the individual is not severely ill.

– Where it is necessary to protect the vital interests of the data subject or of another person where the data subject is physically or legally incapable of giving consent – so this is where consent cannot be given, but it is still necessary to share information to potentially protect someone’s life.

– Where it is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment – this refers to where there is another piece of legislation (the Health and Safety at Work Act, for example) that requires the use of personal data to meet a specific obligation in ensuring the wellbeing of staff .

– In limited circumstances (depending on the nature of the organisation), where use of personal data is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and service.

If you have any queries relating to the use of personal data in the current circumstances, please just let us know and we can advise.

Contact us here…