The Department of Health and Social Care has published guidance for employers on coronavirus testing. This sets out the legal obligations and best practice for employers to follow if they are considering implementing, or are already running, a testing programme.
Employers may offer alternative private provision in accordance with this guidance (for example, for individuals with symptoms who cannot easily access an NHS test and/or for those who do not have symptoms) but there is no obligation on employers to provide a testing programme.
Some employers may consider running a testing programme to give confidence to employees and customers in the workplace and to help protect business continuity. The guidance covers issues that employers will need to consider before introducing testing. These include how the programme will work in practice, the types of testing available, how they will procure the testing and what employers can and cannot do with the test results. Here, we look at the key considerations and legal obligations for employers in running a testing programme.
What the testing programme will look like
Before deciding on a testing programme, employers are advised to consider a number of factors such as the scope of the testing programme (for example, whether the focus of the programme is staff with symptoms or without symptoms, whether it would cover all individuals working onsite), the frequency of testing, arrangements for individuals who refuse to be tested, how test results will be used and whether the programme is compatible with the employer's legal responsibilities (including health and safety, data protection and discrimination laws).
Communicating with staff
The guidance advises employers that any communications should be transparent and should set out how the testing programme will operate in practice, including the purpose of testing, whether it is mandatory, the consequence of refusing to take a test or share the result and the support staff will be given through the process. Employers are also "strongly advised" to consult with staff associations or unions before implementing a policy.
Contact tracing staff
Employers may want to introduce an internal tracing system alongside their testing programme.
Individuals identified as contacts by an internal tracing system who do not have Covid-19 symptoms and have not had a positive test result do not have to self-isolate unless they are contacted by NHS Test and Trace, but they should avoid contact with people at "high increased risk" of severe illness from Covid-19.
An individual who has been identified as a contact by an internal tracing system, but not by the NHS Test and Trace service, will not qualify for Statutory Sick Pay. The guidance advises that if employers decide that such an employee should not be in the workplace, and it is not possible for them to work from home, they may remain entitled to full pay unless their employment contract provides otherwise.
Communicating test results
There is information about how to communicate test results and to whom. While the guidance encourages employers to keep staff informed about potential and confirmed Covid-19 cases, they should avoid naming individuals if possible and should not provide more information than is necessary.
Data protection issues
Information about employees' health, including whether or not they have tested positive for Covid-19 or have particular symptoms, is special category data under the GDPR. Employers should only test employees if they can comply with their GDPR obligations relating to the processing of such data.
The Information Commissioner's Office has published advice for organisations carrying out testing. This says that employers can rely on their health and safety duties as a ground for processing special category data in these circumstances, but that they should carry out a data protection impact assessment, focusing on the new areas of risk, before introducing testing.
Employers should process employees' health data only if this is necessary and proportionate, and should collect the minimum data necessary and ensure that it is kept secure. Employees must be provided with information about the processing of this data, including what health data will be collected, what it will be used for, who it will be shared with and for how long it will be kept.
Implications for employers
In addition to implementing a robust testing policy before introducing a testing programme, employers should ensure they have complied with their data protection obligations and have updated their sickness, disciplinary and data protection policies.
If employees refuse to take a test, they cannot be forced to do so. That said, it may be open to employers to take disciplinary action against such an employee - but this will depend on the particular circumstances, including the nature of their work and why the testing is necessary.
This guidance applies to England only; "equivalent guidance" will be published for Scotland, Wales and Northern Ireland.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
