Testing
Self-testing via lateral flow tests (LFT), is now fully available for individuals and workplaces and many workplaces, if they have good reason for doing so, i.e. on health and safety grounds to protect employees, customers and visitors, are requiring employees to test, at work, on a regular basis.
It seems pretty obvious that you should be able to do this if you wish to do so and you may perceive that it will reduce risk of COVID-19 infection within your workplace. Where an individual’s test result is positive, they should immediate self-isolate and undergo a PCR test at a testing centre (or order a test and do it home). If the PCR test is negative, they can return to work, if positive, they must continue to self-isolate. Hopefully, they will not go on to develop symptoms and will be able to return to work at the end of the self-isolation period, if not, normal sickness absence procedures apply.
As previously, our advice is that, although you may require employees to take a LFT at work, these are elf-administered and you do not keep records of the results of these, or any other COVID related tests, see our “cautionary notes” below.
Self-isolation
The rules regarding self-isolation changed on 16th August 2021 so that, provided they have been double vaccinated at least 2 weeks prior to contact, employees no longer need to self-isolate if they have been in contact with a colleague (or anyone else) who has had a positive test.
In our letter “encouraging employees to take up the vaccine” (available through our Advice Line) we set out this change and that, if they haven’t been double vaccinated, they will only be paid SSP for periods of self-isolation. Of course, this is your decision, but it may act as an incentive to take up the vaccine and provided it is applied equally across the board it is not unfair or discriminatory as the legal requirement is to pay SSP.
Additionally, we have now added a letter for you to use if you wish to communicate the 16th August 2021 self-isolation changes and you can find it in through our Advice Line Dropbox.
This letter sets out that your employees have a legal duty to self-isolate if they have coronavirus symptoms, have had a positive test result or have been a close contact of someone who has tested positive and have not had both doses of the vaccine at least 2 weeks previously; it also requires them to inform you and self-isolate if these factors apply to them. It also advises that failure to comply may result in disciplinary action up to and including termination of employment (after taking advice from us and following the full disciplinary processes of course)
Self-isolation still applies to anyone exhibiting symptoms associated with Coronavirus (even if they have been vaccinated) and they should immediately self-isolate and get a PCR test. If the PCR test is negative, they can return to work, if positive, they must continue to self-isolate. If they become unwell, normal sickness absences procedures apply.
What are you doing right now?
As you know, throughout the pandemic, we have provided advice and documentation to support you in getting people back to work and making sure that you have done everything possible to ensure a safe workplace for your teams; this should of course be reviewed regularly and adapted if appropriate and/or the situation changes.
We’re sure you’ve already put in place COVID-19 risk assessments and appropriate procedures for your employees, that you have communicated this fully and continuously check that all employees are complying with the measures you have put in place; is everyone still washing their hands on arrival for at least 20 seconds for example? We have already advised that employees who refuse to follow the procedures you put in place may, if corrective coaching hasn’t been effective, face disciplinary action, following your company disciplinary procedures.
With the prevalence of the virus and new strains taking hold, it is vital to keep your procedures under review to maintain a safe working environment.
Some cautionary notes from us about workplace testing:
The UK General Data Protection Regulation (UK GDPR) imposes strict requirements on organisations around the security of, and transparency about, the personal data that they process, you will need to fully familiarise yourself with these requirements and ensure that you comply.
Testing and the results will be health data and as such “special category data” requiring adherence to very strict data processing and protection.
We suggest that, before you go any further, you check out the ICO website to fully understand what your obligations are https://ico.org.uk/global/data-protection-and-coronavirus-information-hub/coronavirus-recovery-data-protection-advice-for-organisations/testing/
The Government has also issued guidance for employers on workplace testing and you can check it out here https://www.gov.uk/government/publications/coronavirus-covid-19-testing-guidance-for-employers/coronavirus-covid-19-testing-guidance-for-employers-and-third-party-healthcare-providers
Implementing testing
If you haven’t already done so, read the Government’s guidance, check out the Data Protection and GDPR implications and then decide if workplace testing is for you.
Next, put in place all of the appropriate polices and safeguards and source appropriate testing kits, now available free to all businesses.
The key to successfully implementing this testing regime will be communication and conversation with your employees; talk to them, listen to and address, any concerns they may have. If someone has genuine and reasonable grounds for not taking the test and you agree, you may decide to exempt them.
In certain circumstances, using your existing disciplinary policy and procedure, you may be able to take appropriate disciplinary action against an employee who refuses a test, but this would depend on factors such as the nature of the employee’s work and any evidence on the necessity of testing in the particular environment; we’re here to help so maybe a call to us before you do so would be helpful as these can be challenging conversations.
Other options
Of course, you may, once you’ve looked into all of this, decide that workplace testing isn’t for you and rely on general population testing and encourage employees to participate in that, which is certainly a less onerous choice in our view; tests are available free to anyone. You would need to make it clear to your employees that if their LFT result is positive they must immediately self-isolate and get a PRC test. If the PCR test is negative, they can return to work, if positive they must self-isolate. If they become ill, normal sickness absence procedure will apply.
And a footnote on foreign travel
The rules relating to entering the UK are constantly being updated by the Government and we suggest that you keep yourself abreast of these changes in relation to your employees and their foreign travel.
Full details are available here https://www.gov.uk/government/news/mandatory-covid-19-testing-introduced-to-bolster-border-measures
We put in place a policy to support you in this and suggest that you make all employees aware of your approach to foreign travel. The policy is in the Dropbox folder available through our Advice Line.
In summary, from Monday 16 August 2021, employees who have been double vaccinated (or are aged 18 and under) will be able to continue to go into their workplaces even if they have been in close contact with someone who has tested positive for Covid-19.
The following is a very clear and useful Q&A published in Personnel Today on 16th August 2021 so we thought we’d reproduce it here for you. It is written by Jo Moseley, Senior Associate Solicitor at Irwin Mitchell.
From 16 August, do our staff still have to tell us if they’ve been identified as close contacts of anyone who has tested positive for Covid-19?
That will depend on your policy, and whether they test positive or develop symptoms themselves. If they test positive, (or are required to self-isolate because they’ve been in contact with someone who has) they will have a legal duty to self-isolate for at least 10 days unless they are exempt e.g. they have been double vaccinated.
If they have a legal duty to self-isolate, they must inform you of this unless they are working in the place where they are self-isolating (such as their home).
The Health Protection (Coronavirus Restrictions) (Self Isolation) (England) Amendment Regulations https://www.legislation.gov.uk/uksi/2021/851/regulation/2/made
provide that, from 16 August anyone aged 18 or under, or who has been double vaccinated, won’t have to self-isolate after being identified as a close contact of someone who has tested positive, unless they also test positive.
Anyone who isn’t exempt will still have to self-isolate as currently.
In terms of vaccination status, in order to qualify, the individual must have had their second Covid-19 jab at least two weeks before they came into close contact with the positive case. So, for example, if your employee had their second vaccination on 10 August, they would still have to self-isolate until 24 August if they are identified as a close contact of someone with the virus during that period.
NHS Test and Trace will continue to notify people if they’ve been in close contact with anyone who has tested positive and will recommend that they take a PCR test to find out if they also have the virus. If they test negative, they don’t have to take any further PCR tests unless they develop symptoms. NHS Test and Trace will also inform them that they must self-isolate unless they are exempt under the new rules.
Note: close contacts don’t have a legal duty to take a PCR test and, if they choose not to be tested, you won’t know that they’ve been contacted (and could be asymptomatic) unless you ask them to notify you if they are identified as a contact of someone with the virus.
Does someone who is self-isolating before 16 August 2021 need to continue to self-isolate beyond that date?
That depends on their individual circumstances.
Anyone who is exempt under the rules can stop self-isolating from midnight on Sunday 15 August. But, if they aren’t exempt, they have to continue to self-isolate for the full 10 days.
Do these new rules also apply to people who are ‘pinged’ via the Test and Trace app?
No. Currently, anyone who is ‘pinged’ is advised to self-isolate for 10 days, but they are not legally required to do so.
We assume that the government will change the wording of these notifications to make it clear that anyone who is pinged doesn’t have to self-isolate if they are under 18 or have been double vaccinated. That would bring the advice in line with the new legal rules.
Do we need to check that our staff are exempt from the duty to self-isolate?
To some extent, that will depend on the nature of your business, how much direct contact individual staff members have with others and whether they work with people who are clinically vulnerable or extremely vulnerable. Please see the answer to the question “Can we ask our staff if they’ve been vaccinated?” below for information about the GDPR and data protection issues you need to consider.
Legally, you aren’t under a positive duty to check your staff are exempt, as the duty to self-isolate rests with the individual. But you do commit an offence if you knowingly allow someone who ought to be self-isolating to attend the workplace. Individual company directors and managers also commit an offence if the employer’s breach is found to have been committed with their consent or connivance or through their negligence.
We, therefore, recommend that you clearly communicate how you expect your staff to behave once they have been identified as a close contact of someone with the virus.
There’s still some confusion about the new rules (particularly regarding the need to have received a second vaccination a full two weeks before you can rely on the exemption to avoid self-isolating) so it’s helpful to communicate this clearly to your workforce. This point is particularly important if your organisation engages younger people, who were the last in the queue for vaccinations, as many won’t have had their second jabs yet.
Make it clear to your staff that if they come into work after receiving a notice to self-isolate, they are confirming that they are legally exempt from the duty to self-isolate and have taken a PCR test which is negative. And, if they do come into work when they should be self-isolating, you will treat it as a serious disciplinary offence, which may result in their dismissal.
Can we compel staff to come into work if they are exempted from the requirement to self-isolate?
Yes. If they fall within one of the exemptions, they do not legally have to self-isolate unless they test positive.
Although fully vaccinated people are much less likely to catch the virus than those who are partially vaccinated or unvaccinated, if they can work from home, you may wish to allow them to do so. This will reduce the risk that they may develop Covid-19 and spread it around your workplace.
Can we ask our staff if they’ve been vaccinated?
Yes, potentially, but you would be collecting personal data and, as it is health data, it is also special category data (which gets even more protection). There are therefore data protection issues to consider.
The ICO has published guidance on ‘Vaccination and Covid Status Checks’
which states that: “before you decide to check people’s Covid status, you should be clear about what you are trying to achieve, and how asking people for their Covid status helps to achieve this”. In addition, “your reason for checking or recording people’s Covid status must be clear, necessary and transparent. If you cannot specify a use for this information and are recording it on a ‘just in case’ basis, or if you can achieve your goal without collecting this data, you are unlikely to be able to justify collecting it”.
In the context of the changes to the law coming into force on 16 August, the reason for collecting this information is clear where you have staff on site: you will need to ensure that your staff are legally able to come into work after being in contact with someone who tests positive. In addition, you may need this information to protect other staff on site.
But, as is so often the case with data protection, it is very context driven and the current ICO guidance suggests that you consider “the sector you operate in, the kind of work your staff do and the health and safety risks in your setting’”
What this will mean is that if your staff are working from home, it is unlikely that you will have a reason to collect the information as you don’t need to check whether they can come on site and they won’t be a health and safety risk.
One point to bear in mind is that the ICO guidance hasn’t been updated to reflect the new rules on self-isolation. We therefore recommend that you keep checking the guidance and take action if the ICO’s advice changes.
What evidence can we rely on to check our employees’ Covid vaccination status?
You can rely on the official NHS Covid Pass Verifier app,
the existing online Covid Pass service
or by checking an individual’s NHS Covid Pass letter.
In addition, unless you are legally required to check the vaccination status of your staff, you can also view their NHS vaccination appointment card.
What legal basis can we rely on to process this information and how long can we retain it?
UK GDPR applies to the ‘processing’ of personal data. If you are only conducting a visual check of Covid Passes (either a hard-copy document or a pass held on a digital device) and do not retain any personal data from it, this won’t constitute ‘processing’. The activity would therefore fall outside of the UK GDPR’s scope.
However, if you are conducting checks digitally (for example, by scanning the QR code displayed on the pass), this would constitute processing of personal data – even if you do not keep a record of it. The UK GDPR would therefore apply. Similarly if you note the information on the employee’s HR file or some other record then you will be processing personal data and the UK GDPR would apply.
UK GDPR requires that your use of this data must be lawful, fair and transparent. It should also be limited to that which is relevant and necessary for a specific purpose
and comply with GDPR and data protection laws.
The first hoop to jump through is to consider whether the use is lawful i.e. do you have a legal basis to process the personal data? This will involve both an assessment of the usual bases under Article 6 such as legitimate interests or compliance with laws and, also, an assessment of the additional conditions in Article 9. The reason Article 9 is in play is because vaccination status is health data.
The most relevant Article 9 conditions in this context are:
The employment condition (Article 9(2)(b)) where processing is necessary to ensure the health safety and welfare of employees; or
Legal claims (Art 9(2)(f)) where processing is necessary for the establishment, exercise or defence of legal claims. This would include retaining the information to defend any claim that your organisation (or individual directors) allowed staff who were legally required to self-isolate to come into work in breach of Covid regulations. Similarly, you may also be able to rely on this condition if you are concerned that other employees or members of the public coming into contact with them at work, might be sue you for personal injury if they caught Covid-19 as a direct result of that contact.
In both cases, you would only be able to rely on these conditions if you are collecting the vaccination status of people who are on site and coming into contact with others. As mentioned above, you won’t have a legal basis you can rely on to obtain information about employees who work from home, or those who work alone.
You also can’t rely on consent for GDPR purposes. It is difficult to rely on consent in the employment context generally and the ICO has said that it should not be used here.
Are there any other data protection issues we need to consider?
Yes. You must minimise the data you collect and only record what you actually need. You can’t collect personal data ‘just in case’. So, in the context of someone’s vaccination status, you will only need to capture whether they have been fully vaccinated (probably via recording ‘yes’ or ‘no’) and indicate whether their second vaccination took place at least two weeks before you recorded that information. You don’t need to know what type of vaccine they received, or the reasons why they chose not to be vaccinated.
Similarly, to avoid the allegation that you have collected the data ‘just in case’,. Instead you should collect it when you need it e.g. when someone calls in to ask whether they can come into work or whether they need to self-isolate. Whilst there is some complexity around whether you can ask for vaccination status, what is clear is that you can require your staff to tell you when they are required to self-isolate. You can then ask them about vaccination status if they tell you that they are required to self-isolate.
As with all personal data you need to make sure that the information is recorded accurately and kept up to date. You shouldn’t keep it for longer than necessary. This will be judged by reference to the reason you collected it in the first place.
Finally, you will need to be transparent about how you are using the personal data and either issue an update to your employee privacy notice or issue a standalone explanation of how the data will be used.
Our Support and Advice
Please do talk to us if we can help in any way, we are here to support you.
Guidance and support
We are constantly updating and adding to our Coronavirus Dropbox, available via our Advice Line service.
Please note, this briefing is accurate at the time of writing and intended as guidance, it is subject to change as the COVID-19 and Government advice changes; it is not intended to replace advice so please do call us if you have any queries.
