Who is liable to pay the fine for not wearing a face mask at work, the employer or the employee?

Under CBILS, for the purposes of calculating the applicant’s annual turnover, approved lenders have been aggregating turnover across the whole of the private equity investor’s portfolio meaning they failed to qualify for the scheme as they were deemed to exceed the £45 million threshold.

For private equity-backed businesses, the removal of the upper limit on annual turnover criteria for CLBILS seemingly avoids the issue of turnover aggregation across investment portfolios seen with the CBILS, potentially enabling more private equity sponsor portfolio companies to be able to access the CLBILS funding.

To qualify for a grant under the scheme you must pay your furloughed staff the wages you are claiming for. Failure to do so may result in a HMRC investigation and/or claims from furloughed staff for unlawful deductions from wages and possibly constructive dismissal claims.

Normal benefits including non-monetary benefits should continue during furlough unless the individual has agreed in writing to reduce or remove a benefit during this time.

Employers are expected to apply for one or more of the financial support schemes available to be able to continue to pay staff.

Employers will be collecting and sharing health information. Health information is sensitive and higher data protection standards apply. Here are a few key pointers.

• Update privacy notices to cover the new collection and sharing of employees’ information and provide these to the workforce. Be transparent and fair.
• Identify the legal basis and condition for use of this information and put any required paperwork in place. The ICO guidance will help. For some conditions such as the employment condition, an Appropriate Policy Document (APD) will be required. The ICO has an APD template.
• Only use the information for the purpose of managing the workforce during the pandemic.
• Only collect or share information if it’s necessary – if it’s a targeted and proportionate way of achieving your purpose.
• Make sure any health information collected and shared is accurate – there may be serious consequences if it’s not.
• Work out how long the information must be kept for. Keep a record of that period and act on it at the appropriate time.
• Security is very important – there may be malicious actors trying to trick employers and employees. Make sure employees know how to identify a genuine NHS Test and Trace contact. Keep the information secure. Use the ICO’s data sharing checklists** and keep a record of the disclosures made and why. Control external disclosures – only certain authorised members of staff should make them.
• Make sure individuals can still exercise their data protection rights – that’s also very important. Keep data protection records up-to-date and ensure any exports of personal information outside the UK are compliant.
• Before introducing employer-led testing like taking temperatures, thermal imaging or other potentially intrusive tests, work out if a data protection impact assessment (DPIA) is required. It will be if the intended processing is ‘high risk’. If it is, then carry out a full DPIA. It will help address the issues systematically and mitigate risks.
• All this demonstrates ‘accountability’ – it shows affected individuals and the ICO that the employer is complying with data protection requirements.

If you need further help, please visit the ICO’s data protection and coronavirus information hub or ask our data protection team.

** Please note that this link is to the ICO’s existing checklists and data sharing code of practice. We will update the link to the ICO’s new checklists after they are published.

There has been a significant amount of press coverage talking about institutional racism within the NHS not only in terms of the treatment of patients but also in terms of the low representation of ethnic minority staff in management positions. Whilst tackling that issue is beyond the brief here, it is important to recognise that sub conscious bias can, regrettably, play a part in decision making processes. An Employment Tribunal will explore a alleged discriminator’s conscious and sub conscious decision making and working in an environment which has not set out sufficient controls to avoid such sub conscious stereotyping places someone at a greater risk of being discriminated against.

In the context of the issues we are addressing here, i.e. risk assessments around BAME staff, as we have stated above, it is essential that BAME staff are represented at all levels in the discussion. Trusts need to be mindful that BAME are underrepresented in management positions.

BAME staff need to be included in the dialogue and need to have a safe place where they can challenge decisions that are being made in relation to them. There needs to be accountability in the processes applied. Meaningful conversations need to happen and concerns should not be dismissed.

Obtaining an employee’s Covid-19 test result will amount to processing personal data for the purposes of the General Data Protection Regulation 2016/679 (GDPR) and information about an employee’s health is a special category of data (sensitive personal data under the Data Processing Act 2018 (DPA)).

In accordance with the GDPR and DPA, there must be lawful grounds for processing such information. Most employers rely on employees’ consent to obtain medical information and process sensitive personal data and if the employee is unwilling to give consent, you will not normally be entitled to the information.

Special category data can be processed lawfully if it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller. Employers may be able to require an employee to disclose their Covid-19 test if there is a substantial public interest, such as ensuring that the employee self-isolate if they have a positive test. However, there is a risk that this measure could be considered disproportionate particularly if it is enforced on all employees as a blanket measure.