08.04.2021
The Government is encouraging employers to operate workplace testing as a way to identify asymptomatic Covid-19 cases and reduce the spread of the virus. Employers who wish to use the scheme should register online by 12 April to be supplied with free lateral flow (LFD) tests. These can be used for testing on-site and, where this is not possible, for testing at home. In this blog, we look at some of the issues you need to consider if you are planning to introduce a testing programme.
Can we take part?
All employers can register online here to take part in the Government’s rapid workplace testing scheme. Interested employers should register by 12 April and the Government has committed to providing tests until the end of June.
How does testing at the workplace operate?
You can either organise your own on-site testing or you can use the services of a third party provider to run the testing on your behalf. If you wish to partner with a third party to organise your workplace testing, a list of approved third party providers is available here.
Before launching your testing programme, you will need to identify a dedicated space in which to conduct testing with appropriate privacy and sufficient social distancing. When you register to take part in the rapid workplace testing scheme, you are provided with guidance as to what is required. In addition, useful information about the practicalities, such as on procuring and transporting test kits can be found in online Government guidance and further information on how LFD testing works is available here.
When an employee arrives to be tested, the normal process would be to ask them to register their details and the details of their test on the NHS Results Logging Website, either on their own device or your device. This includes scanning the QR code of the test kit and identifying the test centre i.e. the employer’s workplace. The employee then self-swabs under supervision by a trained operative. The Government guidance envisages that the trained operative (who may be one of your employees if you are organising your own testing, or an individual from the third party provider) then processes the swab and logs the result on the NHS Results Logging Website. The employee then receives an email or text from NHS Test and Trace with the result and, if they use the NHS Covid 19 app, they may get the result via that too. Once a positive test is logged on the NHS Results Logging Website, it is automatically referred on to NHS Test and Trace. Employers will not receive employees’ test results automatically, but employees will be obliged to inform you if they test positive and the operative will usually also make some form of record of who has been tested and of the result – see ‘What personal data will you hold relating to Covid-19 testing?’ below.
What if we don’t have the facilities or available staff to carry out Covid-19 testing at the workplace?
If it is not possible for testing to be carried out on site, businesses can provide tests to their employees and ask them to carry out tests at home. Test kits for home use are provided by the Government to employers that have registered for the workplace testing scheme but are unable to operate testing at the workplace. Instead of using operatives, individuals are asked to log their own tests on the NHS Results Logging Website.
If you provide your employees with tests to conduct at home, your employees will be obliged to inform you if they test positive – in the same way as they are required to tell you if they test positive for Covid-19 outside the context of workplace testing. However, employers will have less visibility as to whether employees have carried out the tests in the first place. While employers cannot force employees to test themselves for Covid-19 at home, they can encourage it and provide information on the importance of regular testing to help prevent the spread of the virus.
Alternatively, you could ask employees to access free LFD tests for themselves to use twice a week. The Government announced on 5 April 2021 that everyone in England will be able to take a free rapid coronavirus test twice a week. They will be able to do this via a home ordering service, community testing which is offered by all local authorities or by collecting tests from a local PCR test site during specific test collection time windows. A new ‘Pharmacy Collect’ service is also launching which will provide an additional route to regular testing. People aged over 18 without symptoms will be able to visit a participating local pharmacy and collect a box of 7 rapid tests to use twice a week at home. Individuals with symptoms should continue to access PCR testing in the usual way.
Does an individual have to self-isolate if they get a positive result from an LFD test?
Yes. A positive result from an LFD test legally confirms the diagnosis of coronavirus and any employee who tests positive after an LFD test is legally obliged to self-isolate.
Employees are obliged to inform their employer if they test positive. However, if an individual then takes a PCR test within 2 days and that test is negative, the individual may stop self-isolating.
Contact tracing is triggered by a positive LFD test result in assisted settings, but will be stopped automatically after receipt of a negative confirmatory PCR test, if the PCR test was taken within the 2 days following the positive LFD result. NHS Test and Trace will automatically inform anyone self-isolating from a positive LFD test and their contacts to stop self-isolating if the confirmatory PCR test is taken within two days and is negative.
How much do the tests cost?
While the tests are free, you will still need to cover the staffing costs of setting up your workplace testing operation and the charges of any third party providers. There may still be some additional staff costs involved in providing tests via the Government scheme for home testing.
How does testing impact on your other health and safety measures?
Government guidance emphasises that employers must continue to follow the ‘working safely’ measures, even if employees have received a recent negative test result. Testing employees for Covid-19 on a periodic basis cannot be viewed as a substitute for other necessary health and safety measures, such as social distancing, to reduce the risk of Covid-19 in your workplace. See our Coronavirus FAQS on Health and Safety measures for more details.
Can we make testing mandatory?
In short, it is possible make workplace testing mandatory, but doing so carries a degree of risk. You should consider these risks when deciding whether a voluntary route accompanied by good communication is preferable.
An LFD test is an invasive test. From an employment law perspective, an employer would usually only be able to require an employee to undergo any form of medical test if there is an express provision within the employee's contract (or a contractual sickness absence or other policy) providing for this.
In the event that an employee refuses to be tested, we would recommend that the employer has a constructive discussion with the employee, explaining why testing is considered necessary and seeking to understand the employee’s reasons for refusal. If you have made testing mandatory, there may potentially be grounds for disciplinary action in such a case, but we would recommend that employers seek advice before acting. If an employee were to be dismissed for refusing to comply with an employer’s instruction to undergo mandatory testing, and claim unfair dismissal, the Employment Tribunal would need to assess the reasonableness of the employer’s decision to dismiss. In the unprecedented circumstances of the Covid-19 pandemic, requesting that all staff undergo testing on a periodic basis may potentially be deemed reasonable to help the employer to protect the health and safety of all employees, even if such testing is not provided for in contractual documentation. However, the Employment Tribunal would also take into account the fact that testing employees for Covid-19 on a periodic basis cannot be viewed as a substitute for other necessary health and safety measures to reduce the risk of Covid-19 in your workplace.
In practice, employees may be reassured that the employer is taking steps to protect their health in the workplace and many are likely to accept that such testing may be a necessary precaution in current circumstances.
It is also important to bear in mind the data protection issues associated with mandatory testing. For example, the employer would need to establish in their data protection impact assessment (DPIA) that they could not achieve their purpose with a less intrusive approach, such as voluntary testing – see “What data protection safeguards do you need to put into place?” below.
What should you consider when deciding whether to introduce workplace testing?
The Government guidance includes a checklist for employers that are considering introducing a workplace testing programme. It advises employers to first be clear on:
- who the testing will cover – for example, will it be limited to directly employed staff, or will it also extend to other individuals working on the employer’s premises, such as contractors;
- the fact that the focus of workplace testing is on identifying cases among asymptomatic employees;
- the frequency with which tests will be carried out (as noted above, the recommendation is that employees should have access to a minimum of 2 LFD tests each week);
- what facilities are needed to carry out the tests;
- what type of test will be used;
- what the arrangements will be for any individual who does not wish to be tested;
- how the employer will use test results, including its policies on matters such as processing health data, managing absence, self-isolation, diversity and non-discrimination;
- how it will ensure compliance with its legal obligations to employees including under health and safety, equalities, data protection and employment law;
- how it will comply with the legal duty to report test results to Public Health England; and
- the affordability of implementing a testing programme.
The guidance also includes a checklist for staff communications, which flags the importance for employers establishing an internal testing programme of communicating to their employees clear information on:
- why they are setting up a testing programme,;
- whether the programme is voluntary or mandatory and what the consequences are for employees who decline to take part in the testing programme
- where employees can seek advice on their rights throughout the process;
- whether employees will have the opportunity to discuss the collection of such data if they have any concerns; and
- next steps for employees after they receive their test result, including the requirement to self-isolate for 10 days if they test positive and to notify the employer if they test positive and are due to work during the period they would have to self-isolate.
The guidance also recommends that employers consult with relevant staff forums or unions ahead of implementing any testing policy.
In addition, you should consider what steps you need to take to comply with your data protection obligations in relation to personal data collected during the testing process – see “What data protection safeguards do you need to put into place?” below.
What personal data will you hold relating to Covid-19 testing?
The type of personal data you keep relating to Covid-19 testing will vary depending on the way in which you implement the testing process.
If you carry out Covid-19 testing at the workplace, you may choose to keep a ‘register’ of who attended testing on which date. Equally, if you provide tests for use at home, you might decide to ask employees to confirm to you when they have carried out a test.
In all cases, whether testing at the workplace, providing tests for employees to carry out at home, or asking employees to access and administer tests themselves, you will hold a record of any positive test results as employees are obliged to inform you if they test positive. This will usually be kept on the employee’s sickness absence record, but you may also keep aggregated information about the number of positive tests to track outbreaks and assess the effectiveness of your testing programme.
Where testing takes place at the workplace, you are likely to ask the operatives who log the results on the NHS Results Logging Website (who may be your own employees or staff from a third party provider) to inform you immediately of any positive test results. In addition, it is possible that they may also record negative results. You will become a controller of the test result data recorded in this way.
Do you have a legal basis for keeping this personal data?
The ICO guidance on workplace testing confirms that employers can process Covid-19 testing information, provided that the necessary safeguards are in place.
The most relevant ordinary legal bases for processing will be that the processing is necessary in your legitimate interests. Since test results will be health data, and therefore special category data, you will also need an additional legal basis for processing. The most relevant additional legal basis will be the legal obligation in relation to employment, namely your duties under health and safety law, or the public health condition. Consent is not an appropriate legal basis for processing, given the imbalance of power between employer and employee, even though consent in the ordinary sense of the word will be needed in order for an employee to undergo testing. If a third party is administering tests, they may ask the individual for their consent to testing.
What data protection safeguards do you need to put into place?
If you are collecting data other than positive test results, you will need to carry out a DPIA before you begin the testing programme. The ICO’s guidance on workplace testing sets out some of the issues that employers should consider when carrying out a DPIA. If you are only collecting positive test results, then you could argue that a DPIA is not needed, as it this is arguably the same as collecting other health data about individuals who are off sick with other conditions or illnesses. However, it may be beneficial to carry out a DPIA in any event, to help you identify and mitigate any data protection risks.
Before testing begins, you should provide privacy notice information to employees informing them what data you will collect, what will it be used for (i.e. what decisions might be made with it), who it will be shared with and how long it will be kept for. Remember, you cannot use test results for any purpose that employees were not told about in advance or would not reasonably expect.
You must also check that your ‘appropriate policy document’ is drafted broadly enough to encompass this type of processing.
If you are using a third party provider, you should carry out due diligence on any third party provider you use to conduct testing and put in place agreements about how they will process the data.
You should also minimise the personal data you collect by only collecting data that you need for the stated purpose and not retaining it for longer than you need. You should hold data securely and only share it with those who need to see it. Finally, don’t forget about the requirement for data to be accurate; since test results can only identify the employee’s Covid status at the time the test was taken, employers will need to record the date of the test alongside the result.
How can we help?
Our upcoming webinar, GDPR in 2021: key issues for HR, will cover the data protection issues that arise from processing Covid-19 testing data and other Covid-19 health data, including vaccination status, in more detail. It will also update you on the impact of the UK’s exit from the EU following the end of the transition period and address key issues such as recent ICO guidance on subject access requests (SARs) and handling personal data securely in the context of remote/home-working. The webinar will take place on the morning of 21 April 2021.
For more information and to book your place, click here.
Make UK have produced a set of Essential GDPR Templates for HR, which contains the HR ‘must have’ documents required for GDPR compliance, including template employee and job applicant privacy notices, a data protection policy, employee data retention process and more. These documents have just been updated to reflect issues around Covid-19 including testing and vaccination, as well as the end of the Brexit transition period and various recent changes to ICO guidance. For further information and to purchase the template documents, please click here.
If you are a Make UK member and you would like further details of managing Covid-19 testing in the workplace or if you need more general support in relation to Covid-19, please contact your adviser. If you are not a Make UK member, please call 0808 168 5874 or email us [email protected]. Our experienced Legal, HR and Health & Safety teams are here for you.
The Coronavirus FAQs on our website are also updated regularly and provide detailed guidance on issues relating to Covid-19.