With employer plans for more staff to return to the workplace coming into direct conflict with ongoing high infection rates, we have been receiving more queries from clients about whether they can or should be checking their employees' vaccination status before they return to the office and the potential impact of the changes to the self-isolation rules on 16 August. Below we share our outline answers to the key questions employers may be asking themselves.

1.Should we check our employees' vaccination status before they return to the office?

There is currently no statutory obligation on employers to do this although this will change for anyone working or volunteering in registered care homes in England in November when new regulations come into force requiring them to be fully vaccinated unless medically exempt. Guidance on these changes was published last week. Indeed, as per our previous alerts, blogs, etc., even the fact of asking for information about an employee's vaccination status raises a number of employment, health and safety and data protection issues for employers to consider and so should not be done lightly.

It is accepted medical wisdom that being vaccinated reduces the risk of your passing the COVID-19 virus to anyone else, and, therefore, there are good arguments that your knowing whether someone is vaccinated is a necessary precursor to assessing the health and safety risks in your workplace. With the rules on self-isolation changing on 16 August (which means that those individuals who are fully vaccinated and under 18s will no longer have to self-isolate if they have been in close contact with someone who has tested positive for COVID-19 for further details, see below), asking about someone's vaccination status may also be relevant for workforce planning purposes. After all, if most of your workforce is fully vaccinated, you are less likely to face disruption by large numbers of them having to self-isolate, as has been the case in recent weeks. But is this a good enough reason to request this information, especially from a data protection perspective?

Per the ICO's updated guidance, the key question is what are you seeking to achieve and how will asking your staff about their vaccination status help you achieve this? What are you going to do with that knowledge? Will it dictate who is allowed into the office or to work in certain roles or undertake certain tasks? How will you treat people differently if they are not vaccinated? On the assumption that the underlying purpose is the protection of the health and safety not just of your own workers but also visitors and the public generally, is that something you actually need that information for?

The obvious problem is that information about who has and has not been vaccinated (and if not, why not) will constitute special category data. Employers will, therefore, have to comply with their UK GDPR/Data Protection Act 2018 obligations if they process such information. You will need a lawful basis for processing it, most likely to be compliance with a legal obligation and "substantial public interest", although legitimate interests may also be relevant. Though, theoretically, a valid basis for processing, consent is obviously always difficult in an employment context and employers should usually avoid seeking to rely on this, especially if there is any downside or sanction attached to the information not being provided (as there should be, in the sense that if you do not need it enough to enforce the request, you should probably not be asking for it).

Employers would then need to satisfy an additional condition for processing most likely the rights and obligations under employment law (which requires an appropriate policy in support) or substantial public interest. Again, some direct link between your obtaining the information on vaccine status and your achieving your intended aims with it is essential. If you cannot show that it is helping you protect the health and safety of your staff and/or the public, you will not satisfy that extra condition and so the processing of that data would strictly become unlawful.

As this is likely to involve processing of special category data on a large scale, it would also require the completion of a written data protection impact assessment first, in order to evidence your prior consideration of the risks and how they are to be mitigated.

Employers need to be clear, open and honest with staff about how and why they would use their personal data, roughly how long it would be kept for, who it would be shared with (see below) and how they may update it (i.e. by notifying the employer that they have now had the vaccination). Staff should also be told how the information would be held securely, as well as the rights they have in relation to the data. Privacy notices may need tweaking. There may be limits on how precise you can be about any of those things, since circumstances may alter had it not been for the delta variant, for example, it is possible that many such records could now have been dispensed with. The short point may be that for so long as COVID-19 remains a material risk to others, there will be a need for employers to be able to show who has been vaccinated. Clients may require that they are visited only by vaccinated employees, or someone may contract COVID-19 in your workplace and that person or the HSE may allege that you had not taken sufficient precautions to protect against that.

The general thrust is that data protection law does not per se prevent employers from asking for such information, provided they have a good reason for doing so. The guidance makes it clear that if you cannot specify a specific use for this information and you are recording it on a "just in case" basis, or if you can achieve your goal without collecting this data, you are unlikely to be able to justify collecting it. The sector you operate in, the kind of work your staff do and the health and safety risks in your setting should help you decide if you have compelling reasons to request this information.

All that said, the biggest practical problem here is actually not the asking or the data privacy considerations but the issue of how you deal with the enforcement of any difference in treatment you impose as a result of the knowledge you have acquired. Many clients have queried, in particular, the possibility of requiring the unvaccinated to wear masks in the workplace where others are not obliged to do so. Superficially simple and fair in principle, yes, but then you get onto the issue of how you make that happen. To enforce it, any manager would need to know who precisely was vaccinated and who was not. If not, they would also then need to know why not, so that those who are pregnant or medically exempt can be left alone while others are not. So much for protection of your personal data. The scope for workplace tension between the vaccinated and (from next month, when all adults should have had the chance to be vaccinated) wilfully unvaccinated populations would also be substantial, and to defuse that, it may also be necessary to tell peers that X does not have to wear a mask because of whatever it is. Therefore, it may be best to work backwards from your intended response to knowing that status if the reality is that it will not work or will be more trouble than it is worth, there must be a serious question mark over whether the question is worth asking in the first place. Weirdly, maybe, it would probably be much easier in practice and as a justification for requiring notice of vaccine status to enforce a blanket ban on the non-vaccinated attending work than something that allows everyone in and then treats them differently.

2.What is the NHS COVID Pass and can we ask our employees to show that instead before returning to the workplace?

An NHS COVID Pass shows someone's COVID-19 vaccination details or test results. It allows people in England to demonstrate that they are at a lower risk of carrying COVID-19 at that point in time, whether through vaccination, testing or natural immunity, and, therefore, of transmitting it to others. The pass can be accessed in various ways, but most people are likely to obtain it via the NHS App and, therefore, have it available on their mobile phone.

At this stage, the Pass has been introduced to allow people in England to demonstrate their COVID-19 status when travelling abroad or attending certain events and venues in England. It is a snapshot at a particular moment and so is not, therefore, geared for long-term use by employers or in an employment context although this may of course change. Indeed, the government is apparently considering how the Pass could be used to demonstrate evidence of vaccination in care homes in light of the changes to the requirements concerning vaccination. The government is currently encouraging use of the Pass in circumstances where people are likely to be in close proximity to a large number of others for a sustained period, e.g. clubs and music venues, business events, festivals and sporting fixtures. As such, the updated Working Safely guidance only refers to it in the context of advice to restaurants, pubs, nightclubs, etc. for checking the status of their customers and visitors.

As the Pass has been introduced at this stage for nonemployment related reasons, there is no guidance available for using it in an employment context. Having said that, there is nothing expressly stating that employers cannot ask for this information from their employees indeed, we have had a number of queries from clients about whether they can request this information via the Pass. If employers are thinking about going down this route, they will need to consider similar issues as those outlined in question 1 above, since what the Pass says about an individual is also their personal data. To a limited degree, asking someone to show their Pass may be less controversial than asking someone specifically about their vaccination status, as the Pass allows them to demonstrate their COVID-19 status in a number of different ways, e.g. that they are fully vaccinated, have had a negative PCR test within the last 48 hours, etc.

It may also be simpler from a data protection perspective. The COVID-19 Pass can be checked visually or scanned using the NHS Verifier app. The ICO's updated guidance says that if you only conduct a visual check of the Pass (either the hard copy document or a Pass held on a digital device) and do not retain any personal data from it, this would not constitute "processing" and the activity would, therefore, fall outside the scope of the Data Protection Act. If, however, you are conducting checks digitally (e.g. by scanning the QR code displayed on the Pass) then this would technically constitute processing of personal data even if you do not keep a record of it. Clearly, if you make a record of any personal data obtained from sight of the Pass, such as a tick on a staff list, then whether you conduct visual or digital checks, you will be processing personal data and the DPA would apply.

3.How are the self-isolation rules changing on 16 August and how will these affect employers?

As has been widely reported, the self-isolation rules in England are changing on 16 August in an endeavour to reduce the disruption that has been caused to businesses by the large number of people told to self-isolate by NHS Test and Trace. The government has recently made parallel changes to the NHS COVID-19 app to limit the number of people who are contacted.

At the moment, the NHS guidance on self-isolation in England says that individuals must self-isolate if they:

a. Have any symptoms of COVID-19

b. Have tested positive for COVID-19

c. Live with someone who has symptoms or tested positive

d. Have been told to self-isolate by NHS Test and Trace or the NHS COVID-19 app

e.Have arrived in England from abroad from a "red list" country, or from an "amber list" country and not been fully vaccinated

There are detailed regulations that sit behind this guidance. Individuals usually have to self-isolate for 10 full days.

There are currently some temporary exemptions from the self-isolation rules for "critical workers" these run until 16 August. Separate arrangements are also in place for frontline healthcare workers. There are also exemptions under the test to return to work scheme. Daily contact testing is designed to offer an alternative to self-isolation but is currently only available to certain workplaces that have been approved to take part in the workplace daily contact testing scheme.

Under the new rules, from 16 August, individuals who are fully vaccinated (14 days after the second dose for twodose vaccinations) and under 18s will no longer have to isolate if they are notified they have been in close contact with someone who has COVID-19. Such individuals will be advised to take a PCR test, but this will not be a legal requirement. They will still need to isolate if they themselves have any symptoms of COVID-19 or if they test positive for it themselves.

We do not yet have any further guidance from the government on how the new rules will work, but amendments have been made to the self-isolation regulations in England to implement the changes. The original press release about the changes stated that the NHS COVID-19 app would be updated in August in line with the new guidance on self-isolation for close contacts. Presumably, the NHS guidance above will also be updated to reflect the changes.

We are being asked by clients whether they should be asking employees if they have been double vaccinated (and request proof of this) to ensure they only allow individuals to come to work who are not legally obliged to self-isolate.

As highlighted above, there is currently no statutory obligation on employers to check whether someone is fully vaccinated. There is a legal obligation on workers (including agency workers) to notify their employer if they are required to self-isolate by Test and Trace, including the start and end dates of the isolation period, with limited exceptions. It is an offence for an employer to allow someone to attend work if it is aware of the requirement to self-isolate.

In terms of whether employers should be asking individuals for this information, see answers above concerning the issues to consider when requesting information about someone's vaccination status. Additional issues to consider here may include whether it is necessary to ask everyone about their vaccination status or whether you could achieve your aims by simply asking those individuals who inform you they have been notified they have been in close contact with someone who has tested positive for COVID-19 about their vaccine status? Is it then necessary to record this information? If so, for how long? Furthermore, if you tell employees that you are only using this information for self-isolation monitoring purposes, you should ensure you do indeed only use it for these purposes. As a minimum, employers should be making their staff aware of the changes to the rules on self-isolation and reminding them of their obligations and the potential consequences of not complying with them.

Linked to this discussion, there has been some debate about whether individuals are legally required to self-isolate if they are "pinged" by the NHS COVID-19 app, as opposed to being contacted by NHS Test and Trace. It is correct that the Regulations themselves only require anyone directed by NHS Test and Trace to self-isolate to do so, i.e. not if they have simply been contacted by the app. However, the government has nonetheless said that individuals should isolate whether they are contacted by Test and Trace or the app. The NHS guidance calls on employers to encourage staff to act on any notification to self-isolate and to support them while they are in self-isolation.

4.What are the rules governing pay during self-isolation?

If an employee is self-isolating in accordance with government guidance, they are entitled to Statutory Sick Pay, subject to satisfying the eligibility criteria. The only exception is probably if they are self-isolating without symptoms after returning to the UK from abroad, although the rules are not clear.

SSP is still payable from day one of deemed incapacity (or actual incapacity if it is by reason of COVID-19) but remember that an individual must still actually be absent from work for four days to receive SSP.

In terms of eligibility for company sick pay, employers should check their own policies/contracts to see what employees are entitled to. It does not automatically follow that if an employee is eligible for SSP they are also entitled to company sick pay (because self-isolating is not the same as being ill and of course it may be entirely possible to work from home while self-isolating anyway), although this is usually what happens in practice. When the government extended the category of individuals who are eligible to claim SSP, there was discussion about whether companies wanted to be so generous with their company sick pay entitlement, especially with so many people having to selfisolate. Having said that, we are aware of only a handful of companies that have changed their rules governing eligibility for company sick pay when someone is selfisolating and is unable to work from home.

Anyone who is not eligible to receive SSP may be eligible to claim a 500 one-off welfare payment under the Test and Trace Support Payment Scheme, subject to meeting certain criteria.

Remember that those employers with fewer than 250 employees prior to 29 February 2020 are still eligible for SSP rebates. Details can be found here. This is limited to two weeks' SSP per eligible employee.

On the topic of sick pay, we have been asked if employers can differentiate between staff when it comes to paying company sick pay, e.g. will only those staff who are fully vaccinated be entitled to company sick pay if they are absent from work due to COVID-19? As per previous articles, if you start differentiating between employees who are fully vaccinated and those who are not, you are increasing the risk of claims from anyone who is treated differently. For starters, you would need to make an exemption for anyone who is unable to have the vaccine for medical reasons. You may also find that this encourages a degree of deception of the employer as to whether the employee has COVID-19 or something else and perhaps also the regrettable attendance at work of people who are both sick and unvaccinated and so represent the most substantial risk to others in the workplace.