If there is an outbreak of coronavirus in a workplace – will it be RIDDOR reportable?
The reporting requirements relating to cases of, or deaths from, COVID-19 under RIDDOR apply only to occupational exposure, that is, as a result of a person’s work.
You should only make a report under RIDDOR when one of the following circumstances applies:
- an accident or incident at work has, or could have, led to the release or escape of coronavirus (SARS-CoV-2). This must be reported as a dangerous occurrence
- a person at work (a worker) has been diagnosed as having COVID-19 attributed to an occupational exposure to coronavirus. This must be reported as a case of disease
- a worker dies as a result of occupational exposure to coronavirus. This must be reported as a work-related death due to exposure to a biological agent
Related FAQs
The Government introduced shielding in the peak of the pandemic. Current advice is that shielding is not required. However, those who have been shielding are likely to be the most vulnerable and will likely be nervous about a return to work. They may also be disabled under the Equality Act 2010. You should therefore consider any concerns that are expressed and take action to mitigate any risks. For example, it may be possible to keep these employees on furlough until the scheme runs out or they may be able to work from home. If you would like to discuss any specific scenarios then please contact one of the team.
Lenders implementing the Scheme can assist in a number of ways, including:
- Term loans
- Overdrafts
- Invoice finance
- Asset finance facilities
The maximum value available under the scheme is £5m, with repayment terms of up to six years for term loans and asset finance. Overdrafts and invoice finance facilities will be available for up to three years.
Yes, however holiday pay during furlough must remain at the normal rate of pay and not the reduced furloughed rate. You can still claim for this period under the scheme but you will be responsible for any amounts beyond the maximum you can claim. Employers have flexibility to restrict when leave can be taken both during and after period of furlough in the normal way.
If an employee usually works bank holidays then the employer can agree that this is included in the grant payment. If the employee usually takes the bank holiday as leave then you would either have to top up their usual holiday pay, or give the employee a day of holiday in lieu.
Where an apprentice is made redundant the training provider should support the apprentice in seeking alternative employment within a 12 week period. ESFA will support this process. Where an apprentice is placed on unpaid leave or the nature of their employment no longer supports their apprenticeship, it should be considered whether a break in learning would be appropriate.
An employer who wishes to make an apprentice redundant should seek advice on the process to be followed for this.
You also need to consider other aspects of data protection.
Be proportionate – only gather and use Covid-19 data where you need to.
Keep data to a minimum – you shouldn’t gather more data than you need. You need to know someone has Covid-19 but you don’t need to know all their symptoms. Data minimisation also applies to who gets access to the data. It’s unlikely that a spreadsheet, accessible to everyone updating them on the health status of all employees, would be appropriate. Data should be shared on a need to know basis. You need to balance the privacy of individuals against your duty of care to be responsible with regards to the data of your employees, visitors, customers and suppliers.
Keep it up to date – make sure you update data. People’s health status will change and if you keep a record of this, you need to make sure it is accurate and up to date (although this doesn’t mean you should batter individuals with constant requests for updates on health status. Again, be proportionate).
Identify individuals only when you need to – although you will need to know who has Covid-19, that doesn’t mean you need to tell everyone in the organisation. As soon as you can, you should remove personal data from any information you gather. For example, you might want to update employees on the health status of their fellow employees but you probably don’t need to name individuals and even if you feel it is necessary, you should keep the information you provide to a minimum. Removing personal identifiers in a document is also a good data security technique.
Keep the Covid-19 health data secure – Covid-19 data will be special category data and deemed high risk. This means that if you have a breach of this data you will need to notify it to the ICO. A breach could happen by someone losing a print-out of the names of Covid-19 employees, customers or visitors. It could also happen if you set access rights to lists of Covid-19 sufferers open to more people than need to know the information. The risk of ICO enforcement action increases with the potential harm the disclosure could cause. Although the ICO has indicated that it will be understanding about the impact of Covid-19 on normal operations, this doesn’t mean that they will not prosecute you if the breach is sufficiently serious.
Destroy the data once you don’t need it – Finally, of course, make sure that you delete data at the end of your needs. This might last longer than the pandemic, for example if you have an insurance claim or ongoing litigation. If you do need to keep it, consider whether or not you can delete some of the data to minimise what you hold.