If an employee tests positive for Covid-19, they will be asked by the NHS contact tracers for personal information including:
- Name, date of birth and postcode;
- Who they live with;
- Places they visited recently; and
- Names and contact details of people they have been in contact with in the 48 hours before their symptoms started. Close contacts are people they spent 15 minutes or more with at a distance of less than 2m, or people they have had direct contact with (such as people with whom they have had face-to-face conversations at a distance of less than 1m).
No-one contacted as a result of the employee testing positive for Covid-19 will be told their identity.
Data protection law does not prevent you from taking the necessary steps to keep your staff (and the public) safe and supported during the present public health crisis and, subject to meeting certain requirements, you can ask employees to provide you with the confirmation of positive test results or contact received under the contact tracing scheme. This may enable you to put your own measures in place alongside any periods of isolation recommended by the NHS contact tracers. Of course, your employees may choose not to provide this information- they are not obliged to do so.
Data protection law does require you to be responsible with people’s personal data and ensure it is handled with care. Health data relates to an identified or identifiable individual and so you need to comply with the General Data Protection Regulations (GDPR) and the Data Protection Act 2018 (DPA). This means handling it (i) lawfully, (ii) fairly and (iii) transparently. In addition to meeting one of the standard conditions for processing, health data is “special category data” and must be protected carefully. This means you are required to identify an additional condition for processing this type of personal data. The relevant condition will be the employment condition in Article 9(2)(b) along with Schedule 1 Condition 1 of the DPA. This applies due to your health and safety obligations and the condition will cover most of what you need to do so long as you are not collecting or sharing irrelevant or unnecessary data.
Accountability is a key principle under data protection law and you can demonstrate this through a Data Protection Impact Assessment (DPIA), which should focus on the new areas of risk. Given the sensitivity of the data being processed, it is highly advisable to carry out this process. The DPIA should set out:
- The activity being proposed;
- The data protection risks;
- Whether the proposed activity is necessary and proportionate;
- The mitigating actions that can be put in place to counter the risks; and
- A plan or confirmation that mitigation has been effective.
- You should only collect the minimum amount of data necessary to fulfil your purpose ensuring always that the data is adequate, relevant and limited to what is necessary.
- You should ensure that the data processing is secure and consider any duty of confidentiality owed to your employees.
- Transparency is key and you should be open and honest with employees about how you wish to use their data. You should be clear about what decisions you will make with such information.
- You should keep staff informed about potential or confirmed Covid-19 cases but you should avoid naming individuals if possible and should not provide any more information than is necessary to ensure it does not result in any unfair or harmful treatment of employees.
The UK’s Test and Trace Scheme went live at 9am on 28 May 2020. It is currently a voluntary scheme. The government is counting on people doing their “civic duty” to comply. If too few people comply on a voluntary basis, the government has said it will consider mandatory compliance. All those who have symptoms of Covid-19 *can* be tested (note: if they choose to) and they will be told if they are positive. If they are positive, the contact tracers will ask them to share their recent contacts (as explained above) and those people will be told to self-isolate for 14 days in accordance with the rules.
Employers are being asked to support the scheme and allow as many people to self-isolate as needed and not require them to attend work. In the short-term, this is likely to be disruptive to your business (especially if it means an entire section of the workforce are asked to self-isolate) but the government’s view is that this will be less disruptive than if there is a full-blown Covid-19 outbreak at work.
Workplace test and trace guidance has been released. This asks you to:
- Continue to communicate with your workers in self-isolation and provide them with support- this includes allowing them to work from home if they remain well and if it is practicable to do so but, if they can’t work from home, this might include finding alterative work that can be completed at home during the period of self-isolation; and
- Pay sick pay to those who can’t work from home but need to self-isolate (note: new SSP regulations were produced to cover those required to self-isolate under the scheme, subject to qualifying conditions)- however, the guidance suggests that they should be given the option of using paid annual leave instead, if they prefer. Of course, if you don’t want them to use up their annual leave you can always choose to top up any SSP (currently £95.85 per week) to 100% pay.
- Will employees tell you that that they have been asked to self-isolate (especially if they know they may only receive SSP)?
- Will employees be too scared to tell you that they have to self-isolate for fear of being dismissed or disciplined?
- If people turn up to work when they have been asked to self-isolate, what will you do?
- Will you build it into your disciplinary policy that people need to self-isolate if asked to do so by the contact tracers, such that it becomes a disciplinary offence if they don’t?
- If you are able to give people some work to do at home during self-isolation but not enough to fill a day, what will you pay them?
- Do you have to pay someone company sick pay if they are told to self-isolate but aren’t ill?
The law is constantly changing and the position set out in this note may not be current. You should not rely on this note as a comprehensive statement of the law. Please contact us if you require specific legal advice on your situation.