The Government’s recently-issued ‘Return to Work’ protocol marks the beginning of a new phase of dealing with the Covid-19 crisis, as we attempt to return to some form of ‘normality’ while acknowledging that the danger has not gone away and that new procedures are needed to keep our colleagues, our clients and ourselves safe.
In addition to the understandable desire to provide a safe working environment for all those returning to the office or workplace, we must also ensure that the measures we put in place (technical, organisational or procedural) are appropriate, proportional and compliant.
The Return to Work (RTW) guidance is effectively divided into three phases or areas of focus:
- Preparation for the return of staff and customers
- Management of day-to-day activity within the shop, office or premises
- Appropriate responses to Covid-19 related incidents or illness at work
All three phases have GDPR implications and we will outline them in a series of three blog posts as part of our Returning to Work (RTW) and GDPR Considerations eBook for consideration.
In this, the third of three blog posts we will look at appropriate responses to Covid-19 related incidents or illness at work.
The Protocol requires and expects staff to make their employer aware as soon as they fall ill from the virus. The announcement by a staff member that they have developed Covid-19 symptoms or have been diagnosed as Covid-19 positive differs from a ‘regular’ notification of illness in a number of ways, raising privacy and GDPR concerns for the company.
At a minimum, the contagion and risk of infection associated with the virus means that anyone with whom this staff member or contractor has been in significant contact in the previous 14 days (the acknowledged incubation period for the virus) must be considered at risk of infection. There is, therefore, a responsibility and duty of care on the part of the employer to make other staff aware, where they may have been in contact with this individual in the 14 days prior to diagnosis.
As above, any such disclosure should be proportionate and sensitive to the privacy of the staff member concerned. For example, it should not always be necessary to disclose the identity of the individual who has fallen ill, but merely to inform those others that, due to new information, there may be a risk that they have been exposed to infection and need to take appropriate precautions, such as self-isolation, testing, etc.
Equally, the employer should consider the appropriate updating of the staff member’s HR and health records, the provision of timely advice and occupational health care in managing their welfare and the welfare of their team members and colleagues as well as their family members or associates.
This may require the employer to notify staff of other organisations, such as contractors who have visited the site for a substantial period of time (remember the HSE parameters – closer than 2m for over a 15-minute period of time). It would also be appropriate to notify the employer of those staff, not least because they experienced the ‘contact event’ while on assignment from their work. However, as we have seen from recent news reports, it would not be appropriate to contact the third-party employer before the employee is informed, other than in exceptional circumstances.
The Protocol requires organisations to prepare a ‘defined response structure’ to manage any case of a colleague or visitor falling ill at work. This should really be no different to the standard approach adopted by employers when a staff member falls ill, other than the associated contact tracing and notification protocols which should be triggered. The reaction of management and colleagues should be discrete, calm and controlled, avoiding unnecessary disclosure of information or unhelpful commentary around the office.
The Government’s RTW Protocol provides sufficient guidance on the appropriate procedures to follow, so we will not repeat that here. However, we caution employers to remain mindful of their GDPR obligations when dealing with such a case, particularly in terms of protecting the privacy of the staff member, notifying their family or next of kin, and where appropriate, notifying another employer where one of their contractors has fallen ill while on-site at a client location. While it is our view that guidance in the Protocol is more suited to larger working environments and premises, (e.g. guidance on one-way systems of access and egress, dedicated space for isolation of a member of staff who is unwell, substantial distancing of workplaces, canteen tables and desks, etc.) We acknowledge that not every office has the luxury of being able to consider such measures. However, the GDPR principles outlined here remain the same in all instances and for all sizes of organisation.
If you would like to learn more about GDPR principles which apply to appropriate responses to Covid-19 related incidents or illness at work and guidance for employers on key questions being raised, you can download a free copy of our Returning to Work (RTW) and GDPR Considerations eBook by clicking on the link below or you can call us on +353 (0) 1 513 6301 to find out how we can support you and your organisation as you run through the specific challenges of your site or circumstances.
DOWNLOAD EBOOK
