Coronavirus (COVID-19): Employer Obligations and Data Protection

Notification of staff

In the unfortunate event that an employee contracts Coronavirus, or suspects they are infected, the ICO (which has responsibility for upholding data protection laws) recommends keeping staff informed without naming individuals and to avoid providing more information than is necessary.

Employer obligations during the pandemic

Employers have an obligation to protect the health, safety and welfare of their employees and other people who might be affected by their business, as well as a duty of care. General Data Protection Regulation (GDPR) guidance continues regardless of the outbreak and does not prevent this.

The ICO has stated that it is reasonable to ask employees to notify their employer if they are experiencing Coronavirus symptoms.

The temptation may be to identify other members of the workforce who could have been contaminated by requiring them to undergo medical examinations or temperature checks, and this is where particular care needs to be taken by organisations not to fall foul of data protection laws.

Obtaining employee health information

Obtaining health information about an individual is special category personal data, meaning it requires more protection by virtue of its sensitive nature. A generic form of consent in employment contracts relating to health checks is unlikely to be sufficient for data protection purposes.

In addition to meeting the usual GDPR standard  of consent (being a freely given, specific, informed, unambiguous indication of an employees wishes, by a statement or clear affirmation), the extra requirements for consent to be explicit are that it must be confirmed in a clear statement (oral or written), rather than by any other type of affirmative action, specify the nature of the special category data and be separate from any other consents.

In the absence of explicit consent, an employer can only process such data on certain grounds under the GDPR.

When is collecting health data permitted without consent?

The processing of data relating to health is permitted where it is necessary for:

• the purposes of preventative or occupational medicine;
• assessing the working capacity of an employee;
• providing a medical diagnosis or managing; and
• treating a condition.

This exception only applies to occupational health professionals who are already subject to confidentiality obligations, such as those issued by the General Medical Council regulating the conduct of medical practitioners.

The most useful ground to enable an employer to protect its workforce in relation to Coronavirus will likely be for employment, social security and social protection. This condition covers ensuring the health, safety and welfare of employees and is particularly relevant for employers maintaining statutory sick pay. It is possible that taking temperatures is necessary for the purposes of carrying out the obligations and exercising specific rights of the employer or employee.

There is, however, no authority on the point at present. It remains unclear whether an employer would be able to establish the element of necessity. It is also relevant that an employee’s temperature is not always a reliable test of whether they have contracted Coronavirus. The guidance makes it clear that, although employers will undoubtedly interact with their employees in relation to Coronavirus, this is typically more to do with information provision and assistance rather than collecting information for a pre-emptive Coronavirus strategy. Employers should be aware that reliance on the above condition requires an appropriate policy document in place if they do choose to go down this route.

In summary

When it comes to using information about employees for the purposes of dealing with the Coronavirus outbreak, the key takeaway is that the position under law has not changed. As with any use of personal information, it should be clear to the individual why the business is collecting their information, how it is being used and what their rights are in relation to the same. Employers should also ensure that medical testing is applied consistently to all, as only testing certain groups could potentially lead to discrimination claims.

*The information set out in this article is correct at the date of publication (02 April, 2020). The effect of coronavirus on businesses is a fast-changing area and so it is important to obtain legal advice to ensure you are properly protected.

Contact us

If you have any questions regarding the impact of the Coronavirus upon your business or are seeking up-to-date legal advice, contact Paula Eckton on 01202 294 566 or email [email protected].