Employment Update Series: COVID-19 workplace testing: navigating the legal risks

Jane Fielding: Hello, good morning. I am Jane Fielding, Head of the Employment Labour and Equalities team here at Gowling WLG and I am pleased to welcome you to this second webinar in our series of four which we are doing this week and next to replace our usual in-person annual update seminar.

We really hoped by now we would be able to welcome you back into the offices in person but sadly that is not the case so we are now pinning our hopes on being able to do that in June for our mid-year review.

But today the topic is COVID-19 testing at work. We are beginning to get questions from clients about this subject as people look to how best they can get back into the workplace and get their businesses running as normal again with minimum disruption. So we thought it was a timely opportunity to pull together the key issues we have been looking at for clients in this presentation.

I would ask you though to bear in mind this is a single element testing of a constantly evolving picture as the science evolves and the government policy across various departments evolves to respond to that. So, this is how it is today. In the future, it may be a little bit different in the factors you need to consider and the balance you give to those. But Alice Loughney, who is a senior associate in our team, is going to be covering all the employment law aspects of COVID testing in the workplace.

There is an inevitable overlap to some extent with health and safety and so she will touch briefly on that, but the pure health and safety aspects and the public health obligations of testing are outside the scope of this morning's talk.

Alice is going to present for about 25 minutes. We have left time at the end of that for some questions. If you do want to ask a question then please use the Q&A function. You should find it in the middle at the bottom of your Zoom screen. You can also use that if you have any technical problems and Lucy Strong, who is helping us on the tech side of things today, will hopefully be able to sort you out. Hopefully, it will all run smoothly though and nobody will need to use that.

Before I hand over to Alice though we thought it would be interesting to do a quick poll to see who is already using testing for their employees and workers and particularly in what sectors that might be happening. Lucy is going to open the poll now and it will not take you very long to fill it in, there are only three questions and possibly only one depending on what your answer to the first one is. She will leave that running for a few minutes before she closes it and before we go onto the questions at the end of Alice's presentation we will come back to it, have a look at the results and share those with you.

I will now hand over to Alice for her presentation.

Alice Loughney: Thank you, Jane, and good morning everyone. Thank you very much for joining this webinar on COVID-19 workplace testing. I am really looking forward to seeing the results of the poll later on and I am conscious that amongst this group we are likely to have organisations at a whole range of stages. From those who might be weighing whether to do COVID testing at all through to those who already have a system in place and want to check what they are doing is legally compliant, or might be here to pick up some tips for dealing with tricky issues that have come up so far.

Bearing that in mind I have tried to include something for everyone. So for the next half an hour or so we will cover:

Firstly, should you introduce testing at all and what are the legal constraints? For those with a testing system already in place, this might be relevant if you are thinking of expanding testing to cover different groups or if you are thinking about whether to make testing compulsory rather than voluntary.

Next, if you do introduce testing, how can you keep your legal risk to a minimum? I will share five key questions all employers should be thinking about.

Thirdly, what are your obligations as an employer when the test results come in and last a bonus section on vaccines? So can you make employees tell you if they have had a COVID vaccine or even go one step further and require employees or maybe job applicants to be vaccinated?

So should you introduce testing at all? Well, there has been plenty of publicity around the limitations of COVID testing, particularly the rapid result, lateral flow tests that many employers are considering using. Testing is also expensive and if you get lots of employees testing positive you might have issues with gaps in the workforce as people have to self-isolate. But there are some big names, a few of whom are on the slide there, who have invested significant sums in building their own testing facilities and more and more are either partnering with the government's asymptomatic testing pilots or procuring their own private test to use on employees.

So why are those employers doing it? I have put some of the most common reasons on the slides. It will often come down to wanting to protect employees' health and safety but that will not be the same for every organisation or even every part of the workforce. It sounds obvious but it is really important to stand back and give this some proper thought before introducing or expanding any testing programme. Not least because that question will be core to the analysis of many of the legal risks we will discuss today.

My first recommendation of the day is to really scrutinise any proposal to introduce testing. What will it actually achieve given the nature of your workforce, the other protective measures you have and how accurate the tests are you are looking to use?

Moving onto the potential legal constraints on testing. We will focus on data protection first and then move on to look at unfair dismissal and discrimination as we consider mandatory testing. It is key to have data protection in mind from the outset as this is the one legal constraint that could stop you from doing testing at all, even on a voluntary basis. Information about whether an individual has COVID-19 is obviously health data, so it is unlawful to process it unless:

1. You have lawful basis;
2. You meet an extra condition under the GDPR in recognition of the fact that that data is particularly sensitive; and
3. You have the right documents in place.

If you do not comply with these requirements the Information Commissioners Office, or ICO, can take enforcement action including issuing fines. So how do you comply?

Well, taking the lawful basis first, the three most likely to apply along with their GDPR references are on the slide. The ICO has published some guidance for employers considering doing testing and they stated for most employers the relevant basis for processing testing information will be legitimate interests. But for some public sector bodies, carrying out their public functions, they can rely on their own specific condition.

It is also possible though that processing could be justified on the basis of compliance with a legal obligation if you are carrying out testing in order to meet your legal obligations towards employees' health and safety. Interestingly, the ICO has not referred to this on in their online guidance, but the guidance is subject to updates and the ICO has said organisations need to make their own assessments, not just blindly rely on what is on the website, and this should be based on individual circumstances. So, I do not think you can discount this when you are thinking about this one.

So, just delving a little more deeply into the legitimate interest condition. If you are relying on this you need to go through a three-step process. This type of analysis will be familiar to many of you as HR professionals who may have had to consider the justification defence for potential indirect discrimination claims. The stages are:

1. What is the legitimate interest - this is where your assessment of why you are actually doing COVID testing is key;
2. Processing the data -so, carrying out testing or looking at the results necessary to achieve that; and
3. Is processing still justified when balanced against the intrusion on the individual's rights and freedoms?

Assuming you have a lawful basis for processing, the next step is to identify which of the special category conditions applies. Again, the ICO has helpfully published guidance on the two conditions it considers are most likely to apply here.

Firstly, the employment condition, which should apply to most employers who are carrying out testing to protect the health and safety of their staff. But it is unlikely to apply where testing is introduced more in order to provide customer or employee reassurance rather than protecting safety as such.

There is also the public health condition which might apply in the case of an employer who is looking to support efforts to stem the spread of the virus in general by testing and reporting results to public health authorities.

So taking a couple of examples. In the case of employees working in a busy manufacturing environment, the nature of the work might mean they cannot work from home and there will inevitably be some close contact between employees, despite social distancing measures.

In that case, the employer is likely to have a lawful basis for carrying out regular testing to identify asymptomatic cases, either on the basis of a legal obligation (i.e. discharging their duty to protect the health and safety of staff by reducing workplace transmission) or on the basis that testing is necessary for the legitimate interest of safeguarding employees' health and safety and there is no less privacy intrusive way to do this as the other COVID secure measures do not go far enough given the nature of the workplace.

Similarly, testing in this scenario is likely to be in compliance with the organisation's employer health and safety obligations, therefore, meeting the employment special category condition. The intrusion on the individual's privacy can be minimised by limiting access to the test results to those who need to know and storing the results for no longer than is necessary.

In contrast though, in a professional services environment, an employer might want to introduce day one testing as a way to persuade employees to come back to the office where they have been working remotely through the lockdown. Besides the likely employee relations backlash and employment issues with requiring people to come into work when they could work from home, I think at the moment it would be very difficult to justify testing on this basis under data protection law.

It is hard to say that a one-off test would discharge an employer's health and safety duties and it is unlikely to be legitimate to use testing in these circumstances when the far less privacy intrusive approach is to allow employees to allow working from home if the office is not COVID secure. I think we are quite a long way off seeing the balance tip but it is potentially one to come back to as we hopefully start to see cases decrease and more workplaces opening up.

Just to round off on data protection then. In order to comply with your data protection obligations, you will need to provide employees with a privacy notice. This could be a standalone privacy notice for testing provided to the employees before the test takes place or it could be your standard existing employee privacy notice has been updated to cover this specifically. It is also recommended to use the ICO's template impact assessment and the legitimate interest assessment too if you are relying on that as your lawful basis for processing. Both of these will help to show you reasoning in the event of a challenge.

So, moving on. If you are considering mandatory testing there are additional considerations to take into account in terms of legal risk. I would flag, at this point, that mandatory testing is relatively unusual. Even for those working in clinical roles in the NHS, for example, testing is voluntary unless you have symptoms. If you do want to make testing mandatory you will need to consider, firstly, discrimination.

So, are there are any groups that would be adversely affected by the requirement to undergo COVID testing? Disability is the one that immediately springs to mind, taking into account those with physical disabilities that make taking the sample difficult or more painful, for example, but also those with mental health conditions that amount to disabilities for whom this might, for example, cause heightened anxiety. Those individuals will be entitled to reasonable adjustments to the testing policy and a blanket policy with no flexibility at all is highly unlikely to be justified as a proportionate measure given the potential alternative safety measures available and the limitations of testing I have already mentioned.

Also, do not forget unfair dismissal rights for employees with more than two years of service. In some circumstances it might be reasonable to instruct employees to submit to a COVID test may be, for example, if they are dealing with vulnerable people as part of their role and you have assessed this is a critical part of your health and safety measures.

But to go as far as implementing a disciplinary sanction or a dismissal for a refusal to take a test should only be taken in the most extreme circumstances and I would say, in general, there is a really high risk of a successful unfair dismissal claim due to the number of reasons people might be reluctant to undertake tests and the range of other measures employers can and should be taking to protect the health and safety of staff and members of the public in any event.

For both of these risks, I think the key is going to be to listen carefully to employees who express concerns, or who refuse to undertake tests, so you can make a balanced decision. It is likely to be much more effective to concentrate on engaging with employees and unions and getting them on board with voluntary testing, rather than looking to impose a mandatory approach.

In terms of how you do that, in some circumstances, a consultation will be compulsory prior to introducing a testing programme. For example, if this is covered by a recognition agreement you have in place at the trade union. But, in any case, the government guidance on employer run testing programmes is it is strongly advised to consult before introducing COVID testing and I would echo that. Not least because it will help you to get staff on board and spot any potential logistical issues before they arise.

In terms of the reaction you are likely to get during the consultation, the TUC position on workplace testing is that it is a valuable tool in protecting workers' safety so it is probably quite likely to be welcomed. But during the consultation, and when advising their members, I think unions are likely to be particularly interested in some of the issues we are about to come on to including pay, time off and ensuring testing is not used to dilute other COVID secure measures employers should have in place.

There is a summary on the slide, there, and we are now going to move on to how to successfully implement a testing programme. There are five key questions all employers should think about when designing their policy:

Firstly, who will be taking the samples and analysing and processing the results? Will this be outsourced in full to third party provider or will any element of it be carried out by your own staff or the employees themselves? If staff are going to take their own samples, or read their own results, there are a few specific considerations to have in mind.

Firstly, results might be less accurate so that needs to factor into your risk assessment and balancing exercise. Does this undermine your reason for doing testing at all?

Secondly, staff with certain disabilities may find it more difficult to take their own sample and might require an adjusted process or extra support; and

Thirdly, perhaps cynically, do you trust employees to provide you with accurate results or do you want to build in a review by an objective person? This might be the case, for example, if you have a history of people coming in to work when they should be self-isolating and it will also tie into the topic of whether you will pay employees for the self-isolation period over and above any entitlement to statutory sick pay.

So that is who, not what type of test are you going to use?

The key considerations to take into account are:

1. Cost;
2. Speed of results- so if you want to use the results on point of entry to the workplace it is not going to be particularly helpful to have to wait 12 or 24 hours for lab results to be returned;
3. Specificity or number of false positives - so a high number of false positives will lead to more employees unnecessarily self-isolating; and
4. The flip side, the number of false negatives or sensitivity because a high number of false negatives could lead to less asymptomatic cases being captured and potentially a greater spread of COVID in the workplace. So you might require more frequent testing in order for this to be an effective strategy.

The effectiveness of the test for your particular purpose is a key factor in whether collecting test results is justified under data protection and discrimination law. So you need to do your research into this and ensure you can justify the decision. For example, if your stated reason is the protection of health and safety of staff but you are planning to just do a one-off test with a low sensitivity rate on the return to the workplace, will this really add anything over and above your other COVID secure measures? The evidence on effectiveness is constantly evolving, as are the options in terms of cost and speed so this will really need to be an ongoing analysis.

So we have covered who and what, now where will testing to place?

With the rise of self-administered rapid results tests more employers are doing tests on-site rather than sending employees off to specific testing labs. Have you thought, though, about how you will manage the practical aspects of this? Like, social distancing amongst staff waiting for a test. How you will address any accessibility issues with the site to avoid placing disabled workers at a disadvantage and whether you may need to stagger start times.

That leads us on to when will testing take place and will employees be paid for that time?

If testing is going to take place outside of work hours, for example, if employees are going to have to turn up for a shift an hour early, have you thought about the impact on employees with childcare responsibilities or who would otherwise find it difficult to amend their hours. Is there a less discriminatory way of doing this? If you were on a witness stand in an employment tribunal could you really put your hand on your heart and say there was no way you could have done testing in work hours?

The time taken in waiting and having the test is also likely to amount to working time for the purposes of national minimum wage and working time regulations. So, employees who are paid on or close to national minimum wage must be paid for the testing and waiting time and also needs to be factored into daily and weekly rest calculations to avoid inadvertently breaching the working time regulations.

In terms of those who are on a higher hourly rate, or an annual salary, who are not in national minimum wage territory there is no obligation to pay for testing time unless your contract says so and it would be worth just double-checking what the time off for medical appoints clause if you have one, says. But refusing to pay, in any event, is likely to make it much more difficult to get employees on board with voluntary testing, particularly if this is a regular thing. So you need to weigh this up really carefully.

So, that is who, what, where, when and, now, how frequently will testing be carried out.

Well, it is a bit like a DBS check in that a COVID test is out of date as soon as you have taken it and there is not yet a clinically defined number of times an individual should be tested within any given timeframe. Some high-risk places are doing daily testing but it is more common to see testing done two or three times a week and is the model used in the government asymptomatic testing pilot.

The government guidance for employers on workplace testing suggests taking advice from the testing provider on this and, bearing in mind the principles on the slide, how prevalent has the virus been amongst your employees? Does the workplace setting in itself provide a particular risk of transmission?

The risk profile of those in the workplace and, now, the government mentions older people or people with underlying health conditions, although I would take that with a slight pinch of salt as the evidence on high-risk groups is constantly evolving and we now know it is not just those two groups that are thought to be at higher risk. Finally, the sensitivity of the test you are using, i.e. the likelihood of false negatives as we have already mentioned.

So, we have talked about the pros and cons of introducing a testing system, some key points to consider when planning the implementation and now let us look at what happens when the results come in.

Whilst waiting for testing results there is no obligation on the employee to self-isolate unless they have symptoms. Once the results come in, if they are negative, you will need to ensure you clearly communicate to the employee what that means. It is still possible they could have COVID so they should immediately self-isolate and book an NHS test if they get symptoms and, in the meantime, they need to continue following all of your COVID secure protocols.

Then in terms of data protection. You will need to make sure the results are not shared any more widely than necessary, they are only used for your stated purpose and you only hold on to them for as long as is necessary for that purpose to make sure you do not undermine all of the good work you have done on data protection. So, in terms of how long to hold onto the test results, that might just be until the next time the employee has a COVID test if you are doing regular testing.

What if the results are positive?

First and foremost the employee must start self-isolating and will be entitled to statutory sick pay and contractual sick pay subject to the usual eligibility requirements. You should inform any of your employees who have been in close contact with that individual that a colleague has had a positive test. But you normally will not need to, and should not, disclose the name of the employee.

Some employers have been doing confirmatory lab-based test results if the initial test was with one of the lateral flow devices to confirm the result given the risk of false positives and employees unnecessarily self-isolating. If you do choose to do that obviously there is an extra cost to weigh in, but the employee must continue to self-isolate until the result of the second test is returned. If it does come back negative they can stop self-isolating at that point.

Finally, the light at the end of the tunnel - COVID vaccines.

We only have a few minutes left and I wanted to just get you thinking about two of the topics that have been coming up for us recently and, I think, are going to be really interesting.

Firstly, can you require employees to have a COVID vaccine?

We are not talking about literally jabbing people's arms against their will, but what about instructing employees to get the vaccine and treating it as a disciplinary event if they do not. Or, could you make it a condition of employment for new starters or a condition of working in a particular role?

Well, at the moment, our view is you would be ill-advised to try it. Not even the government has made the vaccine mandatory and it is highly unlikely to be justified for an employer to try to do so. It might be, once there is more solid evidence around the impact of the vaccine on transmissibility and once the vaccine is more widely available, it would potentially be more legitimate to look at introducing a policy on this for certain roles. But, definitely for the moment, we tend to advise strongly against this.

In terms of specific legal risks. In the case of employees with more than two years of service, as we discussed in relation to testing, you need to tread really carefully to avoid unfair dismissal or constructive dismissal claims. Given the government has not made the vaccine mandatory, it is a new vaccine and evidence is still emerging, it would be quite hard to effect a fair dismissal on the basis of a refusal to have it.

For all employees, regardless of the length of service, and for job applicants it is worth remembering some of the reasons for which employees or job applicants may refuse vaccines are linked to protected characteristics under discrimination law. So a policy requiring vaccination could indirectly discriminate against those groups. For example, whilst most of the major religions have spoken out in support of vaccination, there might be some denominations who object on religious grounds. For example, due to the ingredients of a particular vaccine. There may also be employees with physical or mental conditions that amount to disabilities and that mean the available vaccine is not suitable for them.

I think it will also be fascinating to see the extent to which employees claim an anti-vac stance is of itself a protected belief under equality legislation. My own view is it would be really difficult to meet the relevant tests on the basis of that belief but there have been some notoriously unexpected decisions in this area in the past few years. Like the decision ethic, veganism is protected but vegetarianism is not, for example. I would not be surprised at all If some employees try to run this argument and it may be something that comes across your desks.

So, what about just asking employees to tell you if they have been vaccinated.

Well, in theory, you can ask if you have a good reason for needing to know and you can comply with the data protection principles we have talked about earlier. But, what would that reason be? Will knowing whether someone has had a vaccine or not change what they are allowed to do or what COVID secure measures you are taking in relation to them.

To me, it seems really premature to start distinguishing between groups of employees in that way and I am sure many of you will have discrimination alarm bells ringing as soon as we start talking about treating the different groups in different ways, especially when the vaccine is not currently available to all. But, again, this is something I am sure lots of employers will be keeping an eye on as the evidence develops, as will we.

Finally, throughout this talk, I have referred to a couple of resources that, I think, are definitely worth a look if you are looking to implement testing. So I have put the links on the slides there but you can also find them on a search engine - it is the Information Commissioners Office Guidance on Testing and also the Government Guidance to Employers on Workplace Testing.

That brings us to the end of this section of the webinar. We will now go back to Jane for the poll results and we will pick up some of your questions.

Jane: Thanks, Alice. About just under half of you logged on so there are just over 180 dialled into the webinar - about half of you responded to the poll. Lucy, I do not know if you can share the results? But you can see immediately it is pretty much split straight down the middle of those of you that replied as to whether you are actually testing or not.

That is quite interesting particularly when you look at the sectors which we will come on to in a minute. If you look at the size it is very evenly spread up to the last two categories and, perhaps, not surprisingly the bulk of testing is going on, it looks from this poll, in very large employers.

Then sector-wise, we are obviously limited on the number of sectors we could put in and break it down. Again, it is fairly evenly spread although "Other" is the biggest by far. Perhaps that includes different types of manufacturing possibly. Perhaps not surprisingly health and care are the highest specific sector. Slightly surprisingly professional services are the second highest. That is obviously a snapshot only but interesting so many are already testing actually.

Alice, I do not know if you have any other comments on that before we go on to the questions?

Alice: Yes, definitely what I was expecting in terms of the size of the employers that are doing testing. But, I think, given the relative newness of the lateral flow devices, which are much more accessible than having to do lab-based processes, I do wonder if that proportion is going to change.

Jane: Very possibly. Well, as we both said already, it is an evolving picture all the time that you have to keep up with.

Alice: Definitely.

Jane: We have had quite a lot of questions come through, I am not sure in the time available we will get to all of them but let us give it a go and if we do not then we will do our best to follow up with you quickly afterwards.

There is one here, Alice. It says what do you suggest if an employer does not choose testing or has introduced it already and a particular employee refuses to have the test?

Alice: I think that is going to come up probably relatively frequently for lots of employers. In the case of an individual who refuses to have the test after you have assessed it is necessary for your workplace - first and foremost, I think it is finding out the reason for the refusal.

Lots of employees will welcome testing as a measure that is supposed to protect them, so is this more an issue around the logistics around whether they are getting paid time off to have the test and could be resolved with a tweak in the process. But if they are still refusing I think it is probably then about looking at alternatives that would alleviate the need for testing.

So, what was it about the risk assessment that made you decide you needed to introduce testing and could there be some amendment to the role of particular duties they are doing that would mean that need is alleviated? So you might need 99%25 of your workforce to be there in person but could you accommodate this person working from home or in a slightly lower risk or lower contact role and it is only once you have done all of that I think you are potentially in the formal process disciplinary sanction territory. As I said in the talk, that is just going to be an inherently high risk given the nature of what we are talking about so it should really be a last resort.

Jane: Thank you. The next one is if somebody has had a test through the NHS testing rather than through workplace testing can you force the employee to share their test result if you are concerned to know what it is before you let them come back to work?

Alice: With NHS testing, unlike employer asymptomatic testing, you can only get a NHS test in the first place if you have symptoms or if you have been directed by a medical professional to get a test. So, if you know an employee has gone off to get a NHS test that means they are likely to have COVID symptoms and, if that test result is positive, the employee themselves has a legal obligation to tell you about the result.

I think most employees will volunteer that information, especially when they know there is a legal obligation on them to do so and they themselves can be fined if they do not. If, for whatever reason, they are not sharing the result though I think you need to have, again, a conversation with the employee to find out why, make sure they understand their legal obligation and the implication of not sharing the result is you are not going to know whether it is safe for them to be in the workforce so you cannot let them back to work.

I think, having had that conversation most employees should be persuaded to share their results but, ultimately, as a medical record, you cannot get your hands on that information unless the employee consents to give it to you. So, it might be that that particular employee has some particular concerns around being able to afford self-isolation so there may need to be a conversation around what extra support you can give them.

Jane: There is a question which has just popped up which I think you may already have answered it actually in what you have just said but, the question is, rather than implement a workplace testing programme could it be more beneficial to use a NHS testing hub? I think that is the implication and create an internal policy to how this programme works for the employer?

Alice: I assume by 'testing hub' that means the NHS test and trace system which is only available to individuals who have Coronavirus symptoms. So, for many employers, it will be sufficient to just use that programme. That is the national programme. It is an educational piece in ensuring employees go and get those tests if they do have symptoms but you cannot just send employees to get NHS tests if they are asymptomatic and your strategy is to try to catch asymptomatic cases at an early stage.

I might be misreading that question though if it is actually about one of these asymptomatic testing pilots. The government is also part of Project Moonshot being partnering with more local authorities and big employers around providing lateral flow tests and training staff on how to manage those. In which case I think that is just a version of what we have been talking about in this talk today and before agreeing to participate in that you need to go through all of the questions I have mentioned in my talk as though you were procuring private tests.

Jane: We have time for one very quick other one. If somebody tests positive but they are asymptomatic do you still have to pay SSP?

Alice: My reading of the sick pay regulations, and I did double-check this last night, is that they just say in the list of circumstances where someone is entitled to statutory sick pay, which includes things like you have been told to self-isolate by NHS test and trace, one of the items is you have tested positive for Coronavirus. It does not say you have tested positive after a NHS test, it does not say you have tested positive after a PCR test, it just says after you have tested positive. So unless that is amended or there is some other publication that comes out saying otherwise I think that is the position you should take. They need to self-isolate and they will be entitled sick pay in the usual way.

Jane: Thanks, Alice. We are just about done for time so thank you very much, Alice, for the presentation and answering those questions. I hope for those of you that are already testing that has given you some reassurance and not too many things to go away and check, and if you are not doing it already it has given you a good framework to approach your risk assessment decision on how you do it.

We are going to be sending you a feedback form once the webinar is finished, it should pop up in your internet browser. Do please fill that in if you have a couple of minutes. We do look at the feedback forms and shape our future session around what everybody is looking for.

I hope you will be able to join us next Tuesday for our next webinar which is around conducting investigations in the workplace, again, with the COVID dynamic factored into that.

Otherwise, thank you very much for listening and I hope you enjoy the rest of your day.