COVID-19 Test Kits for Real Estate Businesses

To help you decide whether measures such as collecting employee health information or asking staff to be tested for COVID-19 are necessary, you should consider the specific circumstances of your organisation and workplace. These include:

the type of work you do;
the type of premises you have; and
whether working from home is possible.
You should consider whether specific regulations or health and safety requirements apply to your organisation or staff. You should also take into account whether you have a specific duty of care to employees. This wider legal framework will help in informing how you apply data protection law.

Keep in mind that, due to its sensitivity, health data is classed as ‘special category data’ and has extra protections under data protection law.

You should be clear about what you are trying to achieve and whether personal information is necessary for that purpose. Data protection law provides you with flexibility if you can demonstrate that you need to process personal information for a specific purpose.

Once you've considered your circumstances, ask yourself these questions:

Do you really need the information?
Will these steps actually help you provide a safe environment?
Could you achieve the same result without collecting personal information, in particular, without health information?
If you can show that your approach is reasonable, fair and proportionate, then data protection is very unlikely to be a barrier. If staff proactively ask you to collect information in relation to COVID-19 or to undertake testing, you could use this to demonstrate that your measures are proportionate for those employees.

If you decide that it is necessary to test staff, you need to make sure you manage the information appropriately.

When considering if your approach can be less intrusive, the following questions may be useful:

Can you confine the collection of health data to the highest risk roles?
Can you limit access to health data, so that only medically qualified staff, those working under specific confidentiality agreements or those in appropriate positions of responsibility see it?
Do you have reasonable alternative measures which don't rely on personal information, such as strict social distancing or working from home?