What is the penalty for failing to comply with the collective consultation obligations?

The Information Commissioner’s Office (ICO) announce new guidance in light of coronavirus.

The ICO is providing new guidance to organisations regarding data protection and coronavirus, which can be accessed here: https://ico.org.uk/for-organisations/data-protection-and-coronavirus/

The ICO has stated the following:

“Data protection is not a barrier to increased and different types of homeworking. During the pandemic, staff may work from home more frequently than usual and they can use their own device or communications equipment. Data protection law doesn’t prevent that, but you’ll need to consider the same kinds of security measures for homeworking that you’d use in normal circumstances.”

Whether you work from home or in the office, you still need to comply with data protection laws. While you need to process personal data with the same care you use in the office, the home working environment throws up specific data protection concerns particularly in respect of data security. You should make sure you have a home working policy which deals with data protection and these data security issues.

 Organisations must ensure that, for staff who can work from home, their obligations in respect of processing personal data are clearly communicated. Organisations may already have a home working policy – if this is the case, then this should be reviewed to ensure it remains relevant and up-to-date for practices during this pandemic.

The Home Office has not stated when it will end these temporary measures, albeit it has stated that it will provide a warning. Where employers have carried out checks using the temporary measures, the Home Office has confirmed that it will require employers to carry out retrospective checks on any of the following:

• Employees who started working for you when the temporary measures were in place
• Employees who required a follow up check during the temporary measures (for example because their previous leave was coming to an end).

It is not explicit from the guidance but these retrospective checks must require you to have in your possession the physical ID in its original form. When carrying out the retrospective check, employers must record this using the following wording “the individual’s contract commenced on [insert date]. The prescribed right to work check was undertaken on [insert date] due to Covid-19.”

These further checks must be made within eight weeks of the temporary measures ending, and employers must keep records of both checks undertaken. Where the employer discovers that the employee does not have the right to work during the retrospective check they should stop employing them.

It is the individual assessment by an organisation of its Covid-19 risk in its workplace that will be central. There may be common features across sites or areas of a site but every workplace will have a different risk profile depending on the service it offers and the workers who deliver those services.  No one size fits all.

The context of managing Covid-19 risk is the need to tie in with UK government guidance and HSE advice – which despite being a lot more comprehensive than it was, is not a panacea and will continue to evolve.  The difficulty we have with this in the context of the known increased risk to BAME employees from Covid-19 is that our understanding of the risk is, we would suggest, at a pretty early stage which makes it more difficult to address. However we know the increased risk exists and we owe our BAME workers a duty to manage that risk and keep them safe.

We also have a duty to consult employees.  This is critical in managing this risk – ensuring BAME workers have a loud voice in the assessment process will be very important.

Where an individual has a particular characteristic, for instance they’re pregnant, they have physical or mental disabilities etc, the law requires us to look at that individual or, where it is a group, that group of individuals and assess the risk to them and take any reasonably practicable steps to control the risk to them.

Risk control hierarchy is key. In “normal” businesses we reduce our Covid-19 risk by keeping people away from the workplace – “avoid, eliminate and substitute” then changing work practices (e.g. social distancing measures) before we arrive at PPE. In a healthcare context, we arrive at PPE a lot more quickly.

We need to ensure our people are given sufficient information, instruction and training so they can do their jobs safely and we must consult workers and involve them in workplace safety – this is going to be critical in the context of Covid-19.

The parties to litigation should still take the steps they have been ordered to take and comply with any Orders made by the court. If for any reason it looks as if a direction cannot be complied with because of the Covid-19 virus then an extension of time can be agreed with the other party (up to 28 days) or through the court. We are aware that Orders have been made extending the time for certain steps to be taken by 56 days.

You must only make a report under RIDDOR (The Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013) when:

• An unintended incident at work has led to someone’s possible or actual exposure to coronavirus. This must be reported as a dangerous occurrence
• A worker has been diagnosed as having COVID 19 and there is reasonable evidence that it was caused by exposure at work. This must be reported as a case of disease
• A worker dies as a result of occupational exposure to coronavirus.