Workplace Testing – ICO Publishes Guidance For Employers

The Information Commissioners Office (ICO) has released guidance for employers on carrying out workplace testing.

Each organisation, whether public or private, should be able to process health data about COVID-19 providing there is a good reason for doing so and that they satisfy the relevant conditions for processing.

Employers should ensure that they comply with the General Data Protection Regulation 2018 and the Data Protection Act 2018 and handle their staff’s personal data with care, focusing on collecting adequate and relevant data that is limited to what is necessary.

Personal data that relates to health is more sensitive and is classed as special category data therefore it should be protected with even more care. Employers should be transparent with their employees from the beginning about:

• How and why this data is being used;
• What decisions will be made with that information; and
• Who it will be shared with.

It is an employer’s duty to ensure the health and safety of its employees, therefore, employers should keep staff informed about potential or confirmed COVID-19 cases amongst colleagues but avoid naming individuals if possible.

Employers can also keep lists of employees who either have symptoms or have been tested positive, ensuring that the data processing is secure and that due consideration of any duty of confidentiality has been given. Employers should be careful that such lists do not result in any unfair or harmful treatment of employees.

The ICO guidance also deals with employers who consider instigating temperature checks, using thermal cameras or other medical testing in light of the pandemic. It doesn’t rule these out but says employers with need to think carefully about these “more intrusive technologies”.  Their use needs to be necessary and proportionate and in-keeping with employees’ reasonable expectations. Employers should also consider whether they can achieve the same results through less intrusive means.