Covid-19 is presenting unique and unprecedented challenges for employers who have to grapple with often complex HR and data protection related issues in a rapidly escalating crisis. Employers are anxious to ensure continuity of their business, the health and safety of their employees and compliance with data protection obligations where these arise. Our Employment and Data Protection teams have been advising employers on these issues for a number of weeks and have collated responses to a number of frequently asked questions to assist employers at this time.
1. What is the position where an employee cannot attend work as their child’s crèche/school has closed?
Given the announcement on Thursday (12 March 2020) by the Taoiseach that schools will shut down for at least a 2 week period until 29 March 2020, many employees may not be able to come to work during that period due to the fact they may not have alternative childcare arrangements.
It may be possible for the employee to work from home and if so they should be paid as normal. Otherwise, leave arrangements should be explored. Agreement should ideally be reached with the employee regarding the type of leave to be taken. Parental leave may be a workable option. Parents have an entitlement to take up to 22 weeks unpaid parental leave to care for each child up to 12 years of age (16 years of age in the case of a child with a disability). This leave can be taken by employees in blocks of less than 6 weeks by agreement with their employer. While there is no legal entitlement to be paid in respect of parental leave, the employee retains all other employment rights such as their annual leave entitlement.
Some parents may have the option of availing of parent’s leave, which is an entitlement to leave of two weeks for each child under 1 year of age born on or after 1 November 2019. Parents taking parent’s leave are eligible to apply for Parent’s Benefit from the Department of Employment Affairs and Social Protection.
Alternatively, an employee could use their annual leave entitlement, and therefore continue to be paid. Another possibility may be for the employee to ‘work-up’ paid time off to be taken at a future date or for the employer to simply grant the employee discretionary unpaid leave. Employers should give consideration to all viable options in this scenario, particularly in light of the Government urging employers to endeavor to continue to pay staff where reasonably practicable.
2. What leave can an employee take where they need to take care of a person diagnosed with Covid-19?
Many employers can, and do, agree compassionate leave arrangements with staff who need to take short periods of time off to care for another person. These include arrangements to enable employees to work remotely from home, to alter shift-patterns, or to “work-up” time taken.
Force majeure leave is paid leave and it is available where for urgent family reasons the immediate presence of the employee is indispensable owing to an illness of a close family member. It does not need to be approved in advance by an employer. A close family member is, generally speaking, a child, partner, parent, grandparent, brother or sister. The maximum amount of leave under statute is 3 days in any 12-month period, or 5 days in a 36 month period.
Current government guidance has stated that, in the exceptional circumstances of Covid-19, it is expected that employers will, if at all possible, facilitate people by allowing them to take the full 5 days entitlement in one block, as required.
It is of course likely the employee will need to self-isolate following any such period and it would be prudent to ensure the employee is clear on the status of that subsequent period of leave at the earliest possible opportunity.
3. Are employees entitled to be paid during self-isolation?
This has been a topic of much debate. A tripartite agreement was reached between trade unions, employer representative bodies and the government urging all employers to support national health objectives by continuing to pay employees who cannot attend work due to a Covid-19 illness or certified self-isolation. New illness benefit rules will apply in such circumstances, as a result of which employees will be eligible for illness benefit from day 1 of absence (see our update here). However, where employees voluntarily self-isolate (i.e. not due to medical certification), they are not entitled to be paid or claim illness benefit.
“Topping-up” illness benefit may not be a viable financial option for some businesses, but employers are being urged to do so to the extent possible. Employers should consider to what extent they can “top-up” where an employee needs to self-isolate and cannot work remotely. If providing “top-up” pay the employer should make it clear that “topping-up” is discretionary, will be kept under review and may be withdrawn at any time.
4. If we need to close our premises for a temporary period or lay off certain employees because they cannot work from home, are staff entitled to be paid?
The starting point is that if an employee is medically fit to work and available to work but their employer does not permit them to work, they are entitled to be paid as normal. However, in certain circumstances, employers may not be in a position to provide work for employees on a temporary basis and seek to lay employees off without pay as a result. Where an employer is only able to provide a reduced workload, the employer may seek to place employees on short-time.
Under the Redundancy Payments Acts 1967–2014 a lay-off situation arises where an employer is unable to provide work for an employee, but believes this to be a temporary situation. It must give notification of the lay-off, which should ideally be in writing, before the lay-off commences. A short-time situation arises where, due to a temporary reduction in the amount of work to be done, an employer pays an employee less than half their normal weekly pay or hours worked are reduced to less than half their normal weekly working hours.
The amount of notice of lay-off/short-time to which an employee is entitled is not provided for in statute therefore reasonable notice should be given. What would be considered reasonable would depend on how far in advance the cause and the date of the interruption to normal working are known. In the case of Covid-19, notice of a relatively short duration is likely to be considered reasonable notice.
Employees are generally not entitled to be paid while on lay off. While the Redundancy Payments Acts does not state that lay off is unpaid, it tends to be unless the employee’s contract of employment provides for a right to be paid while on lay off. Employers in this regard tend to rely on the custom and practice of lay off being unpaid in Ireland. We do however recommend specific advice is sought before an employer places employees on unpaid lay off without their consent as the potential for litigation risk does need to be identified and managed.
The government yesterday (15 March 2020) issued an announcement asking employers, if at all possible, to continue to pay workers at least the jobseeker rate of €203. Employers who have had to cease trading due to the impact of social distancing, will be able to claim refunds from the Department of Employment Affairs and Social Protection. Further details of this scheme will be brought to cabinet today (16 March 2020).
A right to claim redundancy arises where an employee is on lay-off or short-time for a period of 4 or more consecutive weeks or for a period of 6 or more weeks within a period of 13 consecutive weeks.
5. What practical steps should employers be taking at this time?
The practical tips below should assist HR managers and employers in meeting health and safety obligations, resource planning and keeping their workforce safe:
- Assign appropriate members of staff responsibility for keeping the business up to date on latest guidance and coordinating the business’s response to covid-19 matters as they arise
- Employers should provide guidance and information to staff on a regular basis as per the latest Government/HSE updates, available here.
- Ensure all emergency contact details for staff are up to date
- Hygiene in the workplace is clearly vitally important. Handwashing guidelines and alcohol hand sanitiser should be widely available, in addition to further measures, which will vary depending on the nature of the business and should be identified by way of risk assessment.
- Employers should review their working from home or flexible work policies and make appropriate amendments to make sure they are fit for purpose. Guidance from the Health and Safety Authority is available here
- Employers should inform themselves of the different statutory/non-statutory leaves that employees might wish to take and, to the extent possible, make sure they adopt a consistent approach when responding to employee requests
- If an employer has an Employee Assistance Programme, circulate the contact details and remind employees to mind their mental health and well-being during this time
- Implement a travel policy covering both work-related and personal travel plans. Employees should be required to report recent travel abroad (subject to GDPR requirements, see below). Non-essential business travel should be postponed.
6. Can an employer require employees and visitors to the workplace to provide details of any travel, exposure to contaminated individuals or flu-like symptoms?
An employer may be justified in requesting employees and visitors to inform them of any recent travel and health data, in its effort to prevent or contain the spread of Covid-19 in the workplace. However, employers will need to ensure compliance with the GDPR’s core data protection principles (such as transparency, security, data minimisation and accountability) and that they have a clear legal basis under the GDPR to collect such data.
7. How can an employer ensure compliance with their GDPR obligations?
- Personal Data: Before collecting any travel data relating to an employee or third party, employers need to identify a legal basis for processing such data under Article 6 of the GDPR. It is unlikely that an employees’ consent would be a valid legal basis, as such consent may not be freely given in light of the unequal balance of power in the employer/employee relationship. An employer may be able to rely on the “legal obligation” basis under Article 6(1)(c) GDPR or “legitimate interests” basis under Article 6(1)(f). If relying on legitimate interests employers should document their legitimate interest assessment.
- Health Data: Health data is “special category data” under the GDPR. Employers therefore need to identify a legal basis under Article 9 GDPR and/or the Data Protection Act (DPA) 2018 before asking employees for this information. Guidance from the Irish Data Protection Commission (DPC) confirms that there are a number of potential legal bases under Article 9 and the DPA 2018 for processing health data, for the purposes of Covid-19 containment. For example, Article 9(2)(b) GDPR and section 46 DPA 2018 permit the processing of health data where necessary and proportionate for the purposes of exercising or performing any right or obligation under Irish employment law – employers are legally obliged to ensure the safety, health and welfare at work of their employees. Alternatively, Article 9(2)(i) GDPR and section 53 DPA 2018 permit the processing of health data where necessary for reasons of public interest in the area of public health, and subject to suitable safeguards. Such safeguards may include limitation on access to the data, strict time limits for erasure, and other measures such as adequate staff training to protect the data protection rights of individuals. In all cases, employers must ensure that the processing is limited to what is necessary and proportionate.
- DPIA: It would also be prudent for employers to carry out a data protection impact assessment (DPIA) prior to collecting any health data. The GDPR requires a DPIA to be carried out where data processing is likely to result in a “high risk” to the rights and freedoms of natural persons. A DPIA is mandatory where there is large-scale processing of special category data In addition, DPC Guidance on DPIAs requires consideration to be given to carrying out a DPIA in regard to any processing of special category data (regardless of whether it is large-scale). If an employer is of the view that its collection of health data of employees and visitors does not present a high risk to such persons, then it should document its reasons for not carrying out a DPIA.
- Records: Employers should ensure they keep a record of any decision-making process regarding measures implemented to contain Covid-19, which involve the processing of personal data.
8. Can an employer disclose that an employee has Covid-19 to their colleagues?
The identity of an affected employee should not be disclosed to their colleagues or any other third parties unless there is a clear legal basis for such disclosure. An employer would, however, be justified in informing staff that there has been a case, or suspected case of Covid-19 in the company, in order to require them to self-isolate and work from home. An employer should ensure that any internal communications about an employee affected or potentially affected by Covid-19 is limited to the minimum information necessary to ensure the health and safety of their colleagues, and is disclosed only to those who strictly need to know it. An employer may also be required to disclose information about the affected individual to the HSE and/or other public health authorities in order for them to carry out their functions. Such data-sharing should be in compliance with the GDPR.
9. Does a bespoke data privacy notice need to be provided to employees?
Employees should be provided with a privacy notice in advance of, or at the time of collection of any personal data, that explains the purpose of collecting any personal data in relation to Covid-19; how long it will be retained for; to whom it will be disclosed, and complies with the other information requirements in Article 13 GDPR. Employers may choose to update existing privacy notices and bring them to the attention of employees, or create a new Covid-19 dedicated privacy notice.
10. What practical steps should employers be taking now from a data protection perspective?
- Regularly review Covid-19 related guidance published by the Data Protection Commission
- Review their Data Privacy Notice and update it to ensure it adequately addresses Covid-19 related data processing
- Ensure security safeguards are in place in relation to the processing of health data
- Familiarise themselves with the data breach notification protocols so that, if a data breach occurs, they are in a position to mitigate the associated regulatory risk
- Do not roll out workplace medical testing (e.g. temperature testing) without carefully considering the associated data protection issues
The situation with regard to Covid-19 is evolving rapidly and we will continue to publish articles and information on a regular basis with a view to assisting employers and the wider community during this challenging time.