Can I be investigated or prosecuted by HSE if one of my workers contracts Covid-19?

If changed circumstances mean that a business wants to exit from a contractual arrangement, then before trying to terminate it, a careful review should be carried out to see whether a right to terminate actually exists. For example:

• Not every contract for the sale of goods contains the right for the buyer to terminate in circumstances where the supplier hasn’t done anything wrong. If a business has entered into a contract on the supplier’s standard terms, it is unlikely to contain any such provision
• A contract for the provision of services is unlikely, if drafted by the customer, to contain a provision that allows the supplier to walk away from the arrangement at short notice, or perhaps at all

If a party tries to terminate a contract when it doesn’t have the right to do so, the other party will likely claim breach of contract and could sue for damages. In the case of a long term or high-value contract, this could amount to a very significant liability.

Even if the right to terminate the contract does exist, there might be particular rules about the following:

• How much notice has to be given
• How such notice has to be served (for example, it might have to be in writing to a particular address)
• When the notice can be served (perhaps on an anniversary of the start of the contract)
• How much a party has to pay if it cancels (for example, for raw materials, for work done to date, or even the whole contract price)

All of these factors must be taken into account, and any contractual processes for termination are followed.

One of the key legislative requirements of EMI is that the employee satisfies the working time requirement, which is that they work at least 25 hours per week in the company or, if less, 75% of the employee’s total working time. If the working time requirement ceases to be met, then there is a “disqualifying event”. That means that the tax benefits of EMI ceases. It may also mean that the option lapses, but that depends on the specific terms of the option.

An employee who has been furloughed is by definition no longer working 25 hours/week and therefore on the face of it, there is a disqualifying event. However, the Government has tabled an amendment to the Finance Bill currently going through Parliament providing in effect that time not worked because an employee has been furloughed counts as working time, both for determining whether the working time requirement is met initially and whether there is a disqualifying event. Provided this amendment is enacted, this should address the issue.

The definition of a relevant establishment is a question of fact for an Employment Tribunal. Guidance from case law says that ‘establishment’ should be interpreted very broadly (so as to avoid employers escaping the need to collectively consult), and may consist of:

• A distinct entity
• With a certain degree of permanence and stability
• Which is assigned to perform one or more tasks
• Which has a workforce, technical means and a certain organisational structure to allow it to do so

However, there is no need for it to have the following:

• Legal, economic, financial, administrative or technological autonomy
• A management which can independently effect collective redundancies
• Geographical separation from the other units and facilities of the undertaking

In the event that the contractor is displaying one or more of the above signs, then it is worth considering the following actions to protect the employer’s position as far as possible:

• Closely monitor the financial and on-site performance of the contractor in order to assess the likelihood and timing of potential insolvency
• Ensure all bonds, guarantees and collateral warranties have been obtained under the building contract, and if not take steps to obtain them immediately
• Consider the terms of any guarantees to ensure that the guarantor’s obligations are not inadvertently discharged
• Bonds may require adjudication to have been commenced (or even completed) prior to insolvency so as not to be stayed pursuant to insolvency laws
• Carry out an audit of the on-site plant, equipment and materials, and evidence this (for example with photographs and written records)
• Ensure that copies of all relevant documentation have been obtained, for example drawings, specifications and anything required to comply with CDM requirements. If not, take steps to obtain these
• Review the payment position under the building contract, including whether any over payments have been made to the contractor which should be reclaimed, what retention is held or has been released, whether any payment notices may be necessary, and whether there are rights of set-off which should be exercised
• Check whether the involvement of any third party is required, for example funders, landlords, tenants or purchasers who may have rights in relation to the building contract and how it is administered
• Review the terms of the building contract relating to contractor insolvency – hopefully the parties will be fully aware of the building contract terms and have been administering it correctly to date, but if it has been hiding in a draw then now would be a good time to dust it off and ensure familiarity with the relevant provisions!

In general. there is often a stick or twist decision.  If the employer chooses to financially support the contractor (for example by agreeing different payment arrangements), this may help to keep the contractor solvent and more likely to complete the project, but it also exposes the employer to greater risk if the approach is not successful.  Conversely, withholding payments  from the contractor may make insolvency a self-fulfilling prophecy.  The precise advantages and disadvantages of the approach will be dependent on the specific circumstances of each case.

You also need to consider other aspects of data protection.

Be proportionate – only gather and use Covid-19 data where you need to.

Keep data to a minimum – you shouldn’t gather more data than you need. You need to know someone has Covid-19 but you don’t need to know all their symptoms. Data minimisation also applies to who gets access to the data. It’s unlikely that a spreadsheet, accessible to everyone updating them on the health status of all employees, would be appropriate. Data should be shared on a need to know basis. You need to balance the privacy of individuals against your duty of care to be responsible with regards to the data of your employees, visitors, customers and suppliers.

Keep it up to date – make sure you update data. People’s health status will change and if you keep a record of this, you need to  make sure it is accurate and up to date (although this doesn’t mean you should batter individuals with constant requests for updates on health status. Again, be proportionate).

Identify individuals only when you need to – although you will need to know who has Covid-19, that doesn’t mean you need to tell everyone in the organisation. As soon as you can, you should remove personal data from any information you gather. For example, you might want to update employees on the health status of their fellow employees but you probably don’t need to name individuals and even if you feel it is necessary, you should keep the information you provide to a minimum. Removing personal identifiers in a document is also a good data security technique.

Keep the Covid-19 health data secure – Covid-19 data will be special category data and deemed high risk. This means that if you have a breach of this data you will need to notify it to the ICO. A breach could happen by someone losing a print-out of the names of Covid-19 employees, customers or visitors. It could also happen if you set access rights to lists of Covid-19 sufferers open to more people than need to know the information. The risk of ICO enforcement action increases with the potential harm the disclosure could cause. Although the ICO has indicated that it will be understanding about the impact of Covid-19 on normal operations, this doesn’t mean that they will not prosecute you if the breach is sufficiently serious.

Destroy the data once you don’t need it – Finally, of course, make sure that you delete data at the end of your needs. This might last longer than the pandemic, for example if you have an insurance claim or ongoing litigation. If you do need to keep it, consider whether or not you can delete some of the data to minimise what you hold.