Sunday, 8 October 2017
Tuesday, 3 October 2017
The Government has published the Data Protection Bill, which will supplement the General Data Protection Regulation (GDPR) in the UK.
More data protection resourcesHow to start preparing for the GDPR
What is the GDPR?
What happens if an employer fails to comply with the GDPR when it comes into effect?
It incorporates the highly publicised fine regime, under which organisations can be fined up to €20 million or 4% of total worldwide annual turnover.
However, the Bill makes a number of changes for employers to process special categories of personal data (such as health data and data on ethnic origin, political opinion, religious beliefs, union membership and sexual orientation) and data relating to criminal convictions.
To process special categories of personal data, also known as sensitive personal data, employers have to meet strict conditions under the GDPR, such as obtaining explicit consent.
Under the Bill, employers will be able to process special categories of personal data to fulfil obligations or exercise rights in employment law if it has a policy document in place that meets additional requirements.
Under the GDPR, employers can process data on criminal convictions only if this is specifically permitted by law.
The Bill will allow processing of criminal conviction data if it meets the same requirements as processing special categories of personal data.
This means that employers will be able to process criminal conviction data with consent, or to exercise rights or obligations provided that they have a policy in place that meets the additional requirements.
The Bill also reproduces certain exemptions from the Data Protection Act 1998 relating to subject access requests.
In particular, employers will not have to include information in their privacy notices or disclose information to employees in response to subject access requests for:
- information that is covered by legal professional privilege;
- information used for management planning by the employer;
- information about the employer’s intentions during negotiations with the employee; and
- confidential references given (but not those received) by the employer.
Culture secretary, Karen Bradley said: “The Data Protection Bill will give people more control over their data, support businesses in their use of data, and prepare Britain for Brexit.
“In the digital world strong cyber security and data protection go hand in hand. This Bill is a key component of our work to secure personal information online.”
The Bill will repeal the Data Protection Act 1998 when it comes into effect. In addition to implementing the GDPR, the Bill deals with personal data processed by law enforcement and national security.
The GDPR will come into effect directly in the EU, including in the UK, on 25 May 2018. When the UK leaves the EU, the GDPR will be incorporated into UK law by the European Union (Withdrawal) Bill.
Vicarious liability, where employers may be liable to pay damages for an employee’s or others’ actions, can result in high levels of compensation. Akshay Choudhry, an associate at independent law firm Burges Salmon, considers recent cases and how employers can manage this risk.
What is the risk?Vicarious liability is where employers may be liable to pay damages where someone who works for them causes personal injury or other losses to another person through their actions while at work. It puts employers in a vulnerable situation, not least because the extent of the liability can be far-reaching.
For example, in the recent case of Various Claimants v Barclays Bank, the High Court ruled that Barclays Bank was liable for sexual assaults committed by a doctor engaged by the bank to carry out medical examinations of prospective employees.
Similarly, last year, the courts found a supermarket chain was liable when one of its petrol station attendants racially abused a customer, followed him onto the forecourt and subjected him to a severe physical attack (Mohamud v WM Morrison Supermarkets plc).
In neither case had the employer endorsed or encouraged the assaults in any sense. Indeed, the assailants had acted in gross abuse of their positions. Yet, because the courts found that the assaults were so closely connected to the jobs that the assailants were engaged to do, the businesses were ultimately liable.
These cases illustrate how a business can be liable for the actions of its employees or workers even though, in reality, it would have been almost impossible for the businesses in question to have prevented those actions, and despite the fact that the actions of those concerned were well outside the scope of their expected conduct.
Is vicarious liability limited to employees?The Barclays Bank case also illustrates another challenging aspect of vicarious liability. The doctor involved was engaged as an independent contractor, rather than as an employee. However, because he was carrying out activities (i.e. the medical examination) on behalf of the bank and that responsibility had been assigned to him and was controlled by the bank, the bank was still liable for his misdeeds.
In fact, vicarious liability can even extend to situations where there is no commercial activity or wage bargain involved at all. For example, the Ministry of Justice (MoJ) was held liable for the negligence of a prisoner who dropped a sack of rice on a prison employee’s back (Cox v Ministry of Justice).
In establishing the MoJ’s liability for the injury caused, it was sufficient that the prisoner had been carrying out activities which were an integral part of the prison’s activities and were for the prison’s benefit.
What should businesses do to reduce their risk?Where a claimant is trying to establish vicarious liability for discriminatory acts in the employment tribunal, it is open to an employer to avoid liability by showing that it has taken all reasonable steps to prevent the discrimination from occurring.
However, no such employer defence is available in standalone personal injury claims. Businesses should, therefore, focus on preventing wrongdoings from arising in the first place.
For example, businesses should:
- Ensure all relevant policies are up-to-date and followed as a matter of course. Typically this would mean having in place policies covering expected levels of conduct, health and safety, equal opportunities, bullying, grievances, whistle-blowing and disciplinary matters;
- Make sure that all relevant individuals understand the expected workplace standards. Your workforce should be aware of and trained on the relevant policies, practices and procedures. If they understand the standards of behaviour expected of them, they may be less likely to act out of line;
- Carefully consider which of these policies should apply to non-employees working for, or on the premises of, the business;
- Carefully define the scope of individual job roles; and
- Ensure appropriate management and supervision is in place.
To prepare for such an eventuality, employers should ensure that they have appropriate mechanisms in place to deal with any financial liability.
For instance, businesses should:
- Consider whether the scope of cover in any relevant insurance policies (such as public liability or employer’s liability insurance policies) covers all losses for which a business may be vicariously liable, and whether there are any specific risks to address given the nature of the business; and
- Include suitable indemnities in contracts with suppliers.
Changes to how the Insolvency Service Calculates Holiday PayThe Insolvency Service pays holiday pay (along with notice pay and redundancy pay, all subject to various caps) to employees whose employers are insolvent.
It has announced that it will be changing the way it calculates holiday pay to include contractual-based commission. Its decision has retrospective effect, ie will benefit everyone who has ever applied for and received holiday pay from it. If someone applied for holiday pay from the Insolvency Service on or after 1 August 2011 (whether or not they've been paid it), the Insolvency Service will contact them directly to seek evidence of what extra payments they might be entitled to.
If someone applied for holiday pay from the Insolvency Service earlier than August 2011, then they need to contact the Insolvency Service.
But these extra payments will only be made if the employee indicated at the time on their form that they were entitled to contractual commission. If they did not, they cannot raise a claim now.
See the Insolvency Service website for more details.
MY Comment: Seemed to me to be a fair and balanced idea, then you read the last paragraph! what are the chances ?
What does the Supreme Court decision declaring tribunal fees unlawful mean for employers on a practical level? Camille Renaudon, a partner at Hibberts Solicitors, looks at the implications.
The Supreme Court decision on 26 July 2017 to declare employment tribunal and Employment
Firstly, businesses should consider the potential benefit of auditing their records to identify examples of “high-risk” dismissals while fees were payable.
Businesses should assess the potential numbers of historic claims that could now be brought by claimants, and their records should indicate whether those are claims that were referred to the Acas early conciliation scheme, or not.
If they were, some commentators suggest those claims are more likely to now be revived, for a number of reasons.
One key aspect employers should consider is how strong a position they will be in to defend such claims, should they materialise.
Do you have access to evidence, have you retained records and documents? Are the relevant witnesses still employed by you or able to assist with the case? If not, did such witnesses leave in amicable circumstances and are they contactable?
Such considerations will inevitably affect the willingness of an employer who faces a belated claim to engage in the early conciliation process or choose to defend the claim at tribunal.
Out of time claimsAt the moment we still do not know the Government’s stance in relation to those potential claimants who were deterred between July 2013 and July 2017 from bringing a claim or lodging an appeal due to fees.
It is unclear whether they may be allowed to submit a claim out of time but it is anticipated that they will.
Should that be the case, significant numbers of claims may be brought long after the event; hence the preparatory steps that employers should take now.
Until we have a test case or guidance from the higher courts on the issue, claims will be considered on a case-by-case basis, and the financial circumstances of each individual claimant will need to be considered and taken into account by a tribunal when deciding whether they will be allowed to submit a claim late.
Recovering feesAnother practical step for employers will be to recover sums owed to them.
It is certainly anticipated that those respondents who were ordered to repay fees to a claimant (and actually did so) will be eligible to be reimbursed for those employment tribunal and Employment Appeal Tribunal fees, just as claimants will be.
In some cases employers will have paid other fees themselves, such as in the case of judicial mediation, and these too will be recoverable.
To prepare, employers should calculate the value of sums subject to reimbursement. Having done that, if proportionate to do so, they should identify an individual or department with responsibility for tracking developments and dealing with any applications for reimbursement.
An announcement regarding the reimbursement process is imminent, so this is certainly something to keep an eye on.
It is also likely there will be a need to increase resources to HR and personnel departments moving forward as it is certainly anticipated that the numbers of new claims will increase significantly.
A report of a seven-fold increase since the decision in one tribunal seems to be a blip, but many anticipate that we will see far greater numbers of tribunal claims being lodged now that fees are no longer payable.
Increased trainingEmployers now need to consider whether staff need additional training in dealing with tribunal claims, particularly if their exposure to them has been limited because of the vastly reduced numbers of claims seen over the last few years.
They should also consider their insurance policies and see what cover they currently have in relation to tribunal litigation, both for costs and awards made, as this may need to be reviewed.
Finally, for the overwhelming majority of claims, early conciliation via Acas is compulsory and employers may need to reconsider their approach to this.
It may pay to be more receptive to the idea of early conciliation, as potential claimants are now inevitably more likely to issue claims if conciliation is unsuccessful.
Statistics from 2015/16 indicate that 80% of those who contacted Acas did not go on to bring a tribunal claim and for a significant number of those, the fees were the off-putting factor.
Acas research published in 2015 indicated that more than two-thirds of claimants who had been deterred from bringing a claim due to fees said they could not afford them, whereas others stated the fee was more than they were prepared to pay, or that the value of the fee equalled the money they were owed.
Moving forward, a claimant may be less inclined to settle at the early conciliation stage whereas previously they may not have gone on to submit claims in any event.
This may have been where their type of claim could not lead to a monetary award (such as claims for a written statement of particulars of employment) or the value of the claim would have been disproportionate to the fee payable.
Many claimants will also have taken into account that even if successful, they would have had no guarantee of their award actually being paid by a respondent.
They will still face that same risk but some may opt to take their chances in tribunal rather than settle at the early conciliation stage.
Respondents, on the other hand, are now likely to have more to gain by engaging in conciliation in circumstances when previously, when fees were payable, they may not have done.
My Comment: I have opined that the fees regime was flawed from the outset, but if this idea materialises, it will be a step too far, and certainly plunge the Tribunal system into chaos !
Monitoring workers' emailsRemember the 2016 ECHR decision in Barbulescu v Romania, which said that a Romanian employer acted lawfully when it monitored an employee's Yahoo messenger account?
Something unusual has happened. There has been an appeal from the Chamber of the ECHR (7 judges, who take most of the decisions) to the Grand Chamber (17 judges, the final tier and unusual). And the Grand Chamber has come down more in favour of the right to privacy and reversed the decision.
It's a complicated and nuanced judgment. But the main point is that workers have a right to respect for privacy in the workplace, and if an employer is going to monitor their emails and messages, the employer should (exceptional reasons aside) tell the worker that their communications might be monitored. Here, although the employee knew it was forbidden to use work computers for personal purposes, he had not been told that the employer was monitoring his communications.
Accordingly the ECHR held that the Romanian court's decision was wrong, and that Romanian law failed to strike a fair balance between the employer's and the employee's interests. Accordingly there was a breach of Article 8 and the employee was entitled to compensation.
My Comment: So, we pay vast sums of investment on our IT, actually pay salaries to employees to "work", whilst they are at work, and we tell them they mustn't use the internet for personal use, and they ignore all this, and we are STILL in the wrong !!