Employment News

News added on 26.05.2020


Coronavirus - data protection

Workplace testing during the coronavirus pandemic

The Information Commissioner’s Office (ICO) has published guidance for employers on workplace testing during the coronavirus pandemic, covering the extent to which you can carry out tests on your employees on their return to the workplace so as to ascertain if they have coronavirus. What is the data protection position on workplace testing?

If you want to carry out tests to check whether your staff have symptoms of coronavirus or the virus itself, this involves processing their personal data and so the workplace testing guidance for employers makes clear that you would need to comply with the GDPR and the Data Protection Act 2018. This means that you need to think about:

  • your lawful basis for testing employees - the ICO suggests that “legitimate interests” is likely be the most relevant lawful ground for processing for private employers, i.e. it’s in your legitimate interests to provide a safe workplace. In addition, as health data constitutes special category personal data, you also need to identify a relevant condition for processing and the ICO suggests that the relevant condition will be that the processing is necessary for the purposes of carrying out your obligations under employment law, i.e. your health and safety legal obligations
  • accountability and demonstrating compliance, including conducting a data protection impact assessment on the proposed testing process prior to any implementation and keeping records to demonstrate your compliance
  • complying with the GDPR data protection principles, including processing the data lawfully, fairly and transparently and ensuring that the data is accurate, adequate to fulfil your stated purpose, relevant to that purpose and limited to what’s necessary for that purpose
  • data sharing - when sharing the fact that someone has tested positive with other staff, you should avoid naming individuals if possible and not provide more information than is strictly necessary.

In relation to using on-site temperature checks (such as non-contact digital thermometers to take readings on entry and exit) or thermal cameras for testing and monitoring staff, the ICO guidance again stresses the need for transparency and for any monitoring to be both proportionate and necessary, i.e. it’s important to consider whether there are other less intrusive means that could be used to achieve the same results.

Finally, data protection considerations aside, you can’t physically force an employee to have a coronavirus mouth or nose swab test against their will as that would be an assault.

Workplace testing is possible under data protection laws in appropriate circumstances but you must take key compliance steps first, including carrying out a data protection impact assessment, making sure you have a lawful basis for processing and ensuring that any testing programme follows the basic data protection principles of transparency, accuracy, necessity, proportionality and data minimisation. For swab tests, also get the employee’s consent first.

© Indicator - FL Memo Ltd • Telephone: (01233) 653500 • Fax: (01233) 647100 • customer.services@indicator-flm.co.uk • www.indicator-flm.co.uk
Calgarth House, 39-41 Bank Street, Ashford, Kent TN23 1DQ • VAT GB 726 598 394 • Registered in England • Company Registration No. 3599719