Employer Update | COVID-19 (Coronavirus) & Data Protection

Can we notify our staff if a colleague or customer develops the Coronavirus?

We’ve been asked this question a number of times in recent days. Businesses and organisations are naturally keen to do everything that they can to protect their employees whilst taking steps to ensure that they do not fall foul of their legal obligations under the GDPR together with the Data Protection Act 2018.

The Data Protection Act 2018 defines information about an employee’s health as a “special category of personal data”. Special category personal data can only be processed by employers in a number of defined and restricted circumstances.

Employees clearly need to be notified of an infection risk as soon as possible. However, in light of the sensitivities and restrictions associated with an individual’s health-related personal data, we think it sensible to avoid disclosing the identity of the infected individual. In most cases employers should simply advise that an employee who has been in the workplace has been infected and that in view of this appropriate precautions (in line with current UK government guidance) should be taken.

Additionally, we note with some reassurance that the ICO recently confirmed that it will take a pragmatic approach to enforcement in light of the pandemic. The ICO has also issued specific guidance aimed at employers which confirms that employers can confirm that an employee has contracted COVID-19 provided that they do not provide more information than is necessary. As stated above, in most cases it will not be necessary to reveal the identity of the individual in question.

Please contact us if you’d like more information about the issues raised in this article and/or or to find out more about the various Data Protection related policies, procedures, guidance and training that we provide.

Disclaimer: the information set out above does not constitute legal advice and it is provided for general information purposes only. No warranty, whether express or implied is given and neither the author or Harrington Law shall be liable for any technical, editorial, typographical or other errors or omissions within the information provided.