Covid-19 Privacy Notice
Introduction
What this Privacy Notice covers
How we obtain your personal information
How we use your personal information
How we share your personal information
How we protect your personal information
How long we keep your personal information
Personal information from children
Your rights regarding your personal information
Modifications to the Privacy Notice
Contact us
Introduction
In light of the COVID-19 pandemic, Mindhouse Productions Ltd (hereinafter, “Production Company”) has implemented important safety and health measures. This includes a COVID-19 prevention protocol for individuals regularly onsite at Production Company premises across the globe, including Production Company employees, loan-outs, contractors, crew, cast, background performers, minor guardians, musicians, IT technicians, producers, production company or studio executives, or any others who work at or visit Production Company premises (collectively, “Individuals”). Our success depends on our collective participation to adapt to and adopt new ways of collaborating and interacting within our work community. The health, safety and wellness principles and practices described in our COVID-19 prevention protocol are designed to prevent infection and transmission in our current work environment. Our ability to protect ourselves rests on our ability to protect each other. In doing so, Production Company not only satisfies legal obligations but also takes significant steps to limit the spread of COVID-19. It is in Production Company’s interest to take steps to protect its business, its reputation, its staff and those it works with, from the adverse consequences that may flow from a COVID-19 outbreak, which is consistent with the wider public interest in limiting the spread of COVID-19.
This Privacy Notice describes what information Production Company uses and collects in relation to its COVID-19 prevention protocol, and how we will use, share, and protect that information.
We know that you care how we use information about you and we appreciate your trust in us to process personal information carefully and sensibly. This Privacy Notice supplements our internal privacy policies, which still apply to other processing of your information by Production Company. The internal privacy policy is accessible on www.mindhouse.co.uk/privacy-policy, and you can request a copy from your production management or by emailing sophie@mindhouse.co.uk .
What this Privacy Notice covers
This Privacy Notice sets out how and why personal information of Individuals will be collected, used and shared in connection with Production Company’s COVID-19 response strategy, including:
· SARS-CoV-2 (COVID-19) testing, including pre-hire, during employment, where on-site presence is required, and/or relating to travel;
· Daily declaration, return-to-work, and other screening questionnaires, that Individuals may be required to answer before entering Production Company facilities and sites, including relating to travel and known COVID-19 symptom and exposure history;
· Proximity tracking devices or mobile applications that Individuals may be invited to use or to wear at Production Company sites or facilities, and/or manually tracked location logs, each to help protect the health and safety of our personnel and others in our facilities, including by tracking location on production worksites and interactions of Individuals on production worksites;
· Temperature screening;
· Other COVID-19 activities that are intended to protect the health and safety of our personnel, partners, vendors and visitors, and others, as will be disclosed to you.
Not all referenced activities are occurring in every jurisdiction or site in which Production Company operates. Production Company will comply with applicable laws and work agreements where applicable, and where required, consult with unions and work counsels before engaging in these activities.
This Notice applies to Production Company and its wholly owned subsidiaries and affiliates. The Production Company that employs or engages you, or that you otherwise visit, is responsible for the use of the personal information collected. For the purposes of applicable data privacy laws, Production Company is the data controller, and will treat personal information in accordance with this Privacy Notice.
In connection with the COVID-19 prevention protocol activities described above, Production Company will collect, use, and share, in accordance with this Privacy Notice, your:
personal contact information (full name, home address, personal contact number, and personal email);
personal information related to your employment (title, worksite location and dates present);
Production Company identifying information (if available, including your employee ID, badge ID, site ID and location, worker type and manager ID);
location information (including particular locations at the production site and/or Bluetooth-technology ascribed locations or proximities to other devices while you are on-site) collected through a device/application, or manually;
device information (specifically, the device ID), including nearby registered device contact logs;
testing information (specifically, whether your test result is positive or negative);
work status or clearance to be on-site (i.e., clearance to come to work or worksite granted by a health care professional or following a temperature screening);
daily declaration, health survey/questionnaire responses, including relating to travel history, whether you have tested positive for SARS-CoV-2 in the prior 10 days, and history or present display of known COVID-19 symptoms (e.g., fever, cough, shortness of breath, and if so, the dates of onset, whether you sought medical attention).
The following information will be collected by a third party health care professional through the channels described in this Privacy Notice (see the “How we obtain your personal information” section below):
testing sample information (including your swab and nasal or saliva deposit, and the randomly-generated identifier that is affixed to your physical test kit which is linked to your employee ID);
testing information (specifically, whether your test result is positive, negative, or if there has been an error with your test);
history or present display of known COVID-19 symptoms (e.g., fever, cough, shortness of breath); and
information required by public health bodies only in relation to a positive test result (such as your full name, email address or phone number, and the site where the SARS-CoV-2 (COVID-19) test took place, as well as other information such as your date of birth and gender (if we already have this other information)).
The health care professional acts as an independent data controller for personal information related to your health and will treat it in accordance with professional confidentiality and applicable laws.
How we obtain your personal information
The following provides additional information regarding the main channels through which Production Company and/or a health care professional collect(s) personal information and the personal information collected through those main channels:
COVID-19 Testing by a third party health care professional
As part of preventing infection and transmission in our current work environment, Individuals (except the ones working alone at home or working just one non-consecutive day) must undergo COVID-19 testing administered by a third party health care professional. Based on the results of your test, you will either be approved or not approved to enter Production Company sites, if it is permitted by applicable law.
The third party health care professional will inform the Production Company of your ability to work or be present on-site. As noted above, in certain cases, including pursuant to your separate consent and authorization with the third party health care professional, we may receive your COVID-19 test result from the third party health care professional. We immediately delete this information, and only retain whether you are cleared to work or be present on-site.
Your Covid Compliance Officer (CCO), production management, and/or your supervisor, may need to inform others of your COVID-19 test result and ability to work or be on-site, including your employer, if it is not Production Company. Production Company’s policy is that it will do so without revealing your identity unless exceptional circumstances require it, and if it is permitted by applicable law.
Daily Pre-Screening Questionnaires
In some jurisdictions and at certain sites, you will be asked to answer a daily questionnaire on topics such as travel activities, exposure to the virus, known SARS-CoV-2 symptoms you are experiencing, whether you have tested positive for a SARS-CoV-2 infection in the past 10 days, whether you have been in close contact with someone who has experienced COVID-19 symptoms or tested positive for COVID-19 in the past 14 days, and certain other questions, before allowing access to Production Company facilities, if it is permitted by applicable law. You may be required to complete the questionnaire online or via an application, e.g., the Certify SnapXT application, on a daily basis. The information related to your ability to work or be on-site will be used by site personnel, production payroll department and the COVID-19 Compliance Officer to help us to determine who is available to report to work or be on-site, process your absence, and help Production Company limit the spread of COVID-19.
Depending on your responses to the questionnaire, the Certify SnapXT application or CCO may communicate your inability to work to Production Company so that we may collect personal information, including your employee ID, name, and facility site, in order to assist in processing your absence. This information will be used only by the COVID-19 Compliance Officer, or production management, as needed to process your absence.
Where you are using the Certify SnapXT for daily questionnaire screening via email or smartphone app, the information relating to (i) your responses to the questionnaire, (ii) whether you are cleared for work or to be on-site based on your responses, and (iii) any referral to the COVID-19 Compliance Officer for clarification or instruction is stored for 14 days.
We may, in connection with the questionnaire or otherwise, collect and retain your confirmation that you have been following practices outlined in the Company’s COVID-19 workplace safety protocols.
Temperature Reading Equipment
Production Company requires everyone entering its sites to undergo a temperature screening prior to entry as permitted by law. This screening may be performed by you or others at the discretion of the COVID-19 Compliance Officer.
At certain facilities, Production Company is using thermal cameras as permitted by law. At others, we may use hand-held temperature devices or other temperature readers such as stick-on forehead thermometers. The Certify SnapXT application may also manage the thermal scanners checking temperatures at the worksite points of entry. In doing so, Production Company is processing temperature readings of Individuals before entry to the site to detect a fever and to prevent entry if a fever is detected. In the case of thermal cameras, Production Company is also processing thermal images – scans of faces to autofocus the camera on the tear duct area to obtain an accurate temperature readings. No thermal or other images, facial scans, video, or temperature readings are retained for any purpose. The only data related to temperature screening that will be stored, for no more than 14 days, is whether you are able to work or be on-site.
Where permitted by applicable laws, Production Company may retain the name, and employee ID of Individuals identified as not able to work in order to appropriately control re-entry to the facility. This information will only be accessed on a need-to-know basis by those with responsibility for entry to the facility, and where necessary shared with production management and the COVID-19 Compliance Officer.
Proximity Devices / Applications
In some facilities and where Individuals have given their consent, Individuals may be provided with social distancing devices or functionality on the Certify SnapXT application (“Device”) that help assist Production Company in ensuring social distancing from other personnel who are also assigned a device or using the mobile application, and to assist with contact tracing.
The following information is collected by Production Company and associated with the Individual assigned to the Device: Device proximity information (including proximity to other registered Devices, and the length of time), and Devices involved in the location/proximity information, and the name of the site at which the Device is used. Proximity information is collected using Bluetooth technology, and information is stored for 14 days on the Individual’s Device, and in Production Company’s dashboard. Following the 14 days, the information will be purged. This Device, application, or information will not be used to manage or to monitor the performance of personnel.
Device proximity information will be used for the Purposes described in this Privacy Notice. Access to the personal information generated by these Devices is restricted to production management and the COVID-19 Compliance Officer who need to review the data for contact tracing purposes, and who may also create aggregated / anonymous reports to understand trends in social distancing. Supervisors will not have access to data that identifies a specific person. Supervisors may have access to aggregated/anonymous reports to ensure social distancing is maximized and clustering is minimized during operations.
In the event that an Individual assigned to a Device is diagnosed with COVID-19 (or is otherwise identified by medical as higher risk for COVID-19), historical Device proximity information may be accessed by production management, and/or the COVID-19 Compliance Officer to identify Individuals at higher risk of having come into contact with COVID-19. We will keep your personal information confidential and only share it as is necessary for us to achieve the Purposes described in this Privacy Notice. Production Company management / the COVID-19 Compliance Officer may need to inform other persons of your ability to work or be on-site, including your employer, if it is not Production Company. Production Company’s policy is that it will, where possible, do so without revealing your identity unless production management determines that exceptional circumstances require it, and if it is permitted by applicable law.
Check-Ins, Check-Outs, and Contact Tracing Logs
All Individuals must check-in and check-out of all facilities or use the Certify SnapXT application for each site’s entries and exits. Where check-ins/check-outs are manually logged, logging will be recorded using your identification badges. Where done electronically, point-of-entry QR codes will be collected and retained for 14 days. In the event that an Individual is not cleared to work or be on-site (because of questionnaire answers, temperature checks, or a COVID-19 positive test result as assessed by a third party health care professional), your device will be pinged via the application for proximity contacts. Production Company will keep check-in/check-out logs to conduct contact tracing if and when necessary.
How we use your personal information
Production Company collects personal information from Individuals to: assist Production Company in managing the COVID-19 outbreak; help ensure that we take all necessary measures and precautions to protect the health and safety of our personnel, others, and our workplaces; satisfy legal obligations including public safety and employment requirements; and enable us to take steps to limit the spread of COVID-19, and business purposes such as providing building access (collectively, “Purposes”).
For each channel, the legal bases may vary depending on your jurisdiction:
SARS-CoV-2 (COVID-19) testing: we rely on your consent, our legitimate interests or a legal obligation to which Production Company is subject;
Daily declaration, return-to-work, and other screening questionnaires: we rely on our legitimate interests or a legal obligation to which Production Company is subject;
Temperature screening: we rely on our legitimate interests or a legal obligation to which Production Company is subject;
Proximity tracking devices or mobile applications: we rely on your consent.
Where the processing is based on your consent, please note that you can withdraw such consent at any time (without affecting the lawfulness of processing based thereon before its withdrawal).
Where the processing relies on our legitimate interest, the latter consists in Production Company’s interest to take steps to protect its business, its reputation, its staff and those it works with, from the adverse consequences that may flow from a COVID-19 outbreak, which is consistent with the wider public interest in limiting the spread of COVID-19. Please note that you have the right to be informed about how we have assessed that it is in our legitimate interest to collect your personal information for this purposes by sending a request at the contact details set out below (see “Contact us” section).
Where possible, we will use and store aggregated or de-identified information, rather than retaining personal information, including for project planning and analysis purposes.
How we share your personal information
Your information will be processed primarily by limited members of production management and/or the COVID-19 Compliance Officer, which may be working for a different entity, but who is providing services on behalf of Production Company for purposes of its COVID-19 protocols. Whenever we need to share your personal information beyond that internally, we will only do so on a need to know basis and with selected employees for tasks within their job responsibilities. Production Company takes appropriate steps to ensure that such personnel are bound by duties of confidentiality with respect to your personal data. For more information about who has access to personal information provided through the channels described in this Privacy Notice, please see the “How we obtain your personal information” section above. Where possible, we will provide aggregated or anonymized information. However, in certain cases, we may need to provide your identity, including for such entity’s insurance claim purposes.
We will not share personal information described in this Privacy Notice with other non-Production Company parties, except with service providers under appropriate confidentiality and, where necessary, data processing agreements , as required by law (e.g., if required to report to local health authorities); with your employer, if necessary, if you are not employed by Production Company; or where exceptional circumstances require it.
Where information is shared with a recipient located in a country that has not to date been recognized by the European Commission (or the United Kingdom Information Commissioner’s Office (the “ICO”)) as ensuring an adequate level of protection in respect of personal data, Production Company will carry out such transfer in accordance with standard contractual terms approved by the European Commission (or, where relevant, the ICO). We will provide you with a copy of such terms upon request, at the contact details set out below (see “Contact us” section). Any information shared with a recipient is shared with on the basis of strict confidentiality, and all recipients’ employees who receive the information will be subject to obligations of confidence in connection with it.
The personal information described in this Privacy Notice may also be aggregated (i.e., the personal information will be removed, so that the people whom the information describes are anonymous), and the aggregated information will be used internally by Production Company for purposes including workforce management and planning and may be reported outside of the company for purposes such as public health awareness and business status updates.
How we protect your personal information
Production Company maintains physical, electronic and procedural safeguards to protect the confidentiality, integrity and availability of your personal data. We have in particular taken appropriate security measures against unlawful or unauthorized processing of personal information, and against the accidental loss of, or damage to, personal information. For instance, your personal information will be encrypted and stored in Production Company databases behind secure Production Company firewalls. Access to your personal information will be restricted to select authorized individuals working for or on behalf of Production Company who require access to perform essential tasks and services on a “need to know” basis, and subject to password protection. Where possible, to protect your personal information, we will also use and store aggregated or de-identified information, rather than retaining personal information.
How long we keep your personal information
Your personal information will be retained for as long as necessary for the Purposes for which it was collected, in accordance with the retention policy for your legal entity, and as otherwise described below.
From a general perspective, personal information related to testing will be kept by the health care professional as long as deemed necessary for health purposes. All medical samples (e.g. the swabs and saliva deposits contained in your test kit) are destroyed safely after the sample is analysed in accordance with normal laboratory practices under the responsibility of the health care professional.
All the information collected through the channels described in this Privacy Notice will be kept by Production Company for 14 days. The account data application will be kept for as long as you are using the application. We will delete your account data 6 months after you stop using the application.
We may store your information for longer if required by law or by reference to any relevant statutory limitation period in which a claim may be brought, and for the duration of any dispute.
Finally, if you are an employee of the Production Company, the other personal information related to your employment will be kept in accordance with the Production Company’s internal privacy policies, which still apply to other processing of your information by Production Company. If you are not an employee of the Production Company, the other personal information related to the performance of your contract will be kept in accordance with the Production Company’s external privacy policy.
Personal information from children
We may collect, use and share the personal information described above about children under 18 years when they are at our sites. We recognize the need to provide further privacy protections with respect to personal information we may collect from children. When we intend to collect personal information from children, we take additional steps to protect children’s privacy as required by law, including:
Notifying parents about our information practices with regard to children, including the types of personal information we may collect from children, the uses to which we may put that information, and whether and with whom we may share that information;
Limiting our collection of personal information from children to no more than is reasonably necessary;
Giving parents access or the ability to request access to personal information we have collected from their children and the ability to request that the personal information be changed or deleted; and
In accordance with applicable law, and our practices, obtaining consent from parents for the collection of personal information from their children.
Your rights regarding your personal information
You have certain rights under applicable local law in relation to your personal information.
You have the right under local law to access, delete and correct personal information related to you. You are also entitled to receive your personal information provided to us in an interoperable format (data portability). In addition, you have the right to object to or request restriction of the processing of your personal information. Please note that we may require additional information from you in order to honour your requests.
If you would like to exercise your rights, or if you have a concern about the processing of your data, please let us know by using the details set out below (see “Contact us” section). You also have a right to complain to a responsible supervisory authority in the appropriate local jurisdiction.
Modifications to the Privacy Notice
We reserve the right to change this Privacy Notice at any time. In case there is a substantial change, we will notify you in this respect. If such change to the Privacy Notice requires your consent, you will have the choice to consent as to whether or not we may use your information in a different manner.
Contact us
If you would like to exercise your rights or if you have a question about how your personal information is being used, you may send a request to:
Sophie Ardern - Head of Production
sophie@mindhouse.co.uk
Date revised: 17th February 2021