From 29 April 2020, the eligibility criteria for who can be tested for COVID-19 have been expanded.
Here we summarise who in the workforce can now be tested and look at potential issues arising around whether employers can make employees have a test and what the data protection implications are in relation to test results.
Who can be tested?
In England, employees and workers in the following category are now eligible to be tested:-
- Anyone working on the frontline in health and social care regardless of whether they have COVID-19 symptoms or not
- Any other essential worker who has symptoms of COVID-19 – a list of ‘essential workers’ can be found here
- Any-one over 65 years old who has symptoms of COVID-19
- Anyone who goes into work because they cannot work from home and who has COVID-19 symptoms
Household members with COVID-19 symptoms who live with anyone in the above categories who has symptoms are also eligible to be tested.
The important point about the testing being done at this stage is that it will only identify whether the individual has COVID-19 at the moment; it will not say whether they have had COVID-19 already and are now recovered.
Employers can refer essential workers for testing where they are self-isolating either because they have symptoms of COVID-19 themselves or a household member does. Otherwise the application for a test will need to be made by the individual applying for a test directly. Testing will be done either by a home test, the individual attending a drive-through appointment at one of the regional testing sites that have been set up, or by one of the mobile testing units that are being brought into operation. Results should be returned within 48 – 72 hours.
Can an employer force someone to take a COVID-19 test?
The testing regime is voluntary and ultimately an employer cannot force an employee to take the test against his/her will. But the parallel scenario that employers will be familiar with is an employee who refuses to attend an appointment with Occupational Health. In the absence of a contractual right to compel the employee, the fall-back is to treat attending the appointment as a reasonable management instruction. Failure to follow that instruction is then an act of misconduct which can be taken through a disciplinary process. However the failure to attend Occupational Health would rarely be an act of gross misconduct in its own right.
The same approach could be taken where an employer wants an employee to take a COVID-19 test. This would be a reasonable management instruction. In the exceptional circumstances that we find ourselves in, there could be cases where a refusal to have a test would amount to gross misconduct but this would be highly fact-sensitive. This would also apply if the employee took the test but was unwilling to disclose the result.
However before embarking on a disciplinary process employers should consider what it would really achieve; efforts may be better directed to understanding the employee’s reluctance rather than punishing them for it.
What are the data protection issues which arise?
A test result will amount to special category personal data because it is about health. The collection, recording, storage, use and/or disclosure of that information would be processing for the purposes of the Data Protection Act 2018. There are additional conditions for processing special category personal data beyond those required for processing ‘ordinary’ personal data and they often come with additional compliance requirements.
The employer will only know the test result in the first place if the individual shares it with them. Therefore whilst consent is not normally recommended as the basis for processing personal data belonging to employees because of the imbalance in the power relationship, it may be possible to rely upon consent in this scenario. However it must be explicit consent to processing for one or more specified purposes so some sort of written record will need to be created, not only of the employee sharing the test result but to them expressly agreeing that the employer may process the data for particular purposes. Of course, consent can be withdrawn after it has been given and the employer may not be able to achieve all of those purposes before it is withdrawn.
It may therefore be better to rely upon the ground and condition that the processing is necessary because of an employment law obligation that the employer is subject to. The obvious ones in this context will be the legal duty under the Health and Safety Act 1974 to ensure, so far as is reasonably practicable, the health, safety and welfare of employees and those who may be affected by the employer’s activities, and the legal obligation to pay statutory sick pay. An appropriate policy document must be in place (one which explains the employer’s procedures for complying with the data protection principles in connection with the processing of the data and explains the employer’s policies on retention and erasure of the personal data) and the employer must retain a record of its processing activities. Since a record of processing activities is required, that requires employers to have identified that this is the condition that they will be relying upon. So it needs conscious consideration. In doing so, it would also be prudent to check that any existing privacy notice that is intended to stand as the appropriate policy document is fit for purpose – and if it isn’t to either update it or create a bespoke document for this specific situation.
HR and Data Protection teams should be working together on this.
What should employers do now?
Here are our top three tips:-
- Identify who you can request tests for and notify staff when such an application has been made so that they know to expect contact
- Provide guidance to employees so that they know when they can self-refer for a test
- Set your expectations around employees sharing their test result but quid pro quo ensure that employees are clear about what will happen to that personal data. If needs be, create a single reference document which also amounts to an appropriate policy document that can be provided to employees. If employees are reassured about how their test result will be treated then any concerns about having a test in the first place and/or sharing the result with the employer should be lessened, making it more likely that the information will be provided.
For more information, please contact Kirsty Thompson or Katie Maguire.
