The Information Commissioner has published Q+A guidance (https://ico.org.uk/global/data-protection-and-coronavirus-information-hub/data-protection-and-coronavirus/workplace-testing-guidance-for-employers/) from a data protection perspective on workplace coronavirus testing. It considers:
- The lawful basis for processing personal data about testing, setting out that it may flow from article 6(1)(e)/(f) GDPR depending on the nature of the employer, read with the 'employment' condition for processing special category data Article 9(2)(b) GDPR (and Sch 1 para 1 of the Data Protection Act 2018 - however, the guidance does not mention the need for an employer to have an Appropriate Policy Document in place as part of the requirements of that condition);
- Sharing information about employees who have tested positive;
- The guidance also flags the importance of having conducted a Data Protection Impact Assessment as part of moving towards testing, including the use of the Surveillance Camera Commissioner's template for testing which involves surveillance technology, such as thermal cameras (https://www.gov.uk/government/news/updated-data-protection-impact-assessment-template-and-guidance-launched).
Beyond data protection issues there are, of course, employment law and health and safety related implications around testing staff. For advice on these issues please let us know.