Should companies protect the identity of those who have tested positive for Covid-19?

Concerns over data protection laws should not hamper safety protocols, but there are some rules to follow, says Jessica Foster.

 

The problem

 

Should we be concerned about protecting an employee’s privacy if they notify us of a positive Covid-19 result?

 

The law

 

Employers have a vital role in encouraging workers to heed notifications to self-isolate and must support them in isolation. Businesses should consider how they will keep staff informed of any positive results, but they are not required to name individuals.

 

Expert advice

 

If an employee is displaying symptoms, they should be separated from other colleagues and customers and asked to take a test.

 

The individual will be asked by NHS Test and Trace to provide details of anyone they have been in recent close contact with. This may not cover all colleagues, but will include those with whom they have had skin-to-skin contact, been within one metre of for one minute, been within two metres of for more than 15 minutes or with whom they have travelled in a small or large vehicle or plane.

 

Employers should ensure that employees know to inform them as soon as they start to develop symptoms. You should discuss who they have been in close contact with during the 48 hours prior to the onset of symptoms, alert those individuals and take necessary precautions.

 

You should discuss how you will notify their colleagues and whether they wish to be named. There is no legal requirement for close contact colleagues to self-isolate at this stage if they are not displaying symptoms, but you should risk-assess their roles until you receive the individual’s test results.

 

If a positive result is received, NHS Test and Trace will instruct those close contacts to self-isolate. It will not disclose the person’s identity.

 

When it comes to data protection laws and communicating with your workforce, the Information Commissioner’s Office has acknowledged the need for businesses to act quickly and adapt in light of the pandemic and says that data protection will not stop this. However, proportionality is key.

 

You should have in place a process for notifying colleagues of a positive test result so that appropriate measures can be taken. It is important to consider how much information you need to provide. The person’s name is not usually necessary information.

 

If they are not happy to be named, this should not prohibit you from notifying colleagues of a positive result, undertaking necessary risk assessments and deep cleaning, and reminding staff of your policies and where to find them.

 

My co-panellist at The Caterer’s People Summit, Steve Rockey, people director at Lime Wood and Home Grown Hotels, raised the point that privacy can be trickier if people are living in staff accommodation and sharing rooms. These people are likely to be the same household and notified by NHS Test and Trace if they are required to self-isolate. The person’s identity will be more obvious in these circumstances – the best thing is to discuss as a household the steps needed to minimise risk.

 

Privacy can be trickier if people are living in staff accommodation and sharing rooms

 

To-do checklist

• Have a clear policy that explains the rules, what’s required and procedures to follow in the event of symptoms or a positive result. This should be easily accessible, clearly communicated and kept up to date.
• Undertake a Covid risk assessment, communicate this to staff, make sure it’s easily accessible and keep it up to date.
• If an employee displays symptoms or has a positive result, undertake a deep clean and consider any other necessary measures.
• Have a process in place to notify staff of a positive result. Ensure you have up-to-date contact details, including for absent workers and agency staff.
• Encourage employees to do the right thing and acknowledge it when they do.

 

Beware

 

It is a legal requirement for employers to not knowingly allow an employee who has been told to self-isolate to come into work or work anywhere other than their own home for the duration of their self-isolation period. Failure to do so could result in a fine between £1,000 and £10,000.

 

Contact

 

Jessica Foster is legal director at law firm TLT

 

jessica.foster@tltsolicitors.com

 

Photo: Shutterstock