If there is an outbreak of coronavirus in a workplace – will it be RIDDOR reportable?
The reporting requirements relating to cases of, or deaths from, COVID-19 under RIDDOR apply only to occupational exposure, that is, as a result of a person’s work.
You should only make a report under RIDDOR when one of the following circumstances applies:
- an accident or incident at work has, or could have, led to the release or escape of coronavirus (SARS-CoV-2). This must be reported as a dangerous occurrence
- a person at work (a worker) has been diagnosed as having COVID-19 attributed to an occupational exposure to coronavirus. This must be reported as a case of disease
- a worker dies as a result of occupational exposure to coronavirus. This must be reported as a work-related death due to exposure to a biological agent
Related FAQs
Many policies will only provide business interruption cover if it arises from property damage. The FCA has acknowledged that insurers are entitled to reject claims in relation to such policies, notwithstanding the success of the FCA’s test case in the Supreme Court, and which was generally favourable to policyholders [Insert a link here to our update on the test case]. In other cases the policy wording will be less clear and businesses may legitimately feel that their insurer is wrongly withholding payment.
One route of challenge to an insurer’s decision is via one of the well-publicised class actions. Another route of challenge is by a complaint to the Financial Ombudsman Service (FOS). This service is open to consumers and small and medium-sized businesses, ‘micro-enterprises’, charities and trusts. The service will be an attractive option for many businesses, as it is free and relatively quick (although it remains to be seen how the service keeps up with an increase in demand as a result of the pandemic). You will need to have complained to your insurer before bringing a complaint with the FOS.
Further details can be found here.
The guidance asks parties to act responsibly and fairly in performing and enforcing contracts. They are encouraged to act in a spirit of cooperation to achieve practical, just and equitable outcomes. In essence, rather than sticking strictly to the contract as agreed, they are encouraged to give each other leeway to deliver performance differently than they are required to do under the contract.
You also need to consider other aspects of data protection.
Be proportionate – only gather and use Covid-19 data where you need to.
Keep data to a minimum – you shouldn’t gather more data than you need. You need to know someone has Covid-19 but you don’t need to know all their symptoms. Data minimisation also applies to who gets access to the data. It’s unlikely that a spreadsheet, accessible to everyone updating them on the health status of all employees, would be appropriate. Data should be shared on a need to know basis. You need to balance the privacy of individuals against your duty of care to be responsible with regards to the data of your employees, visitors, customers and suppliers.
Keep it up to date – make sure you update data. People’s health status will change and if you keep a record of this, you need to make sure it is accurate and up to date (although this doesn’t mean you should batter individuals with constant requests for updates on health status. Again, be proportionate).
Identify individuals only when you need to – although you will need to know who has Covid-19, that doesn’t mean you need to tell everyone in the organisation. As soon as you can, you should remove personal data from any information you gather. For example, you might want to update employees on the health status of their fellow employees but you probably don’t need to name individuals and even if you feel it is necessary, you should keep the information you provide to a minimum. Removing personal identifiers in a document is also a good data security technique.
Keep the Covid-19 health data secure – Covid-19 data will be special category data and deemed high risk. This means that if you have a breach of this data you will need to notify it to the ICO. A breach could happen by someone losing a print-out of the names of Covid-19 employees, customers or visitors. It could also happen if you set access rights to lists of Covid-19 sufferers open to more people than need to know the information. The risk of ICO enforcement action increases with the potential harm the disclosure could cause. Although the ICO has indicated that it will be understanding about the impact of Covid-19 on normal operations, this doesn’t mean that they will not prosecute you if the breach is sufficiently serious.
Destroy the data once you don’t need it – Finally, of course, make sure that you delete data at the end of your needs. This might last longer than the pandemic, for example if you have an insurance claim or ongoing litigation. If you do need to keep it, consider whether or not you can delete some of the data to minimise what you hold.
Overall it is our experience that the Courts are quickly adapting in the context of the Coronavirus epidemic and making pragmatic decisions. The Judges seem live to the difficulties currently been faced by practitioners dealing with litigation and they are applying the new guidance.
The Courts are also mindful of pressures on NHS frontline staff and are taking steps not to put additional pressures on them at this time, including in our experience vacating an imminent Trial.
Government guidance is that public transport should be avoided wherever possible. Transport providers will be expected to follow government guidance to make their services more COVID-19 secure.