Can employers make contact tracing apps compulsory?

With the government encouraging people to download its test and trace app, Fiona Herrell explains whether firms can insist their staff use it

Over the past two months, contact tracing apps have been launched across the UK, to alert smartphone users who have come into close contact with someone who has tested positive for Covid-19. We are being encouraged to download and use the relevant app to help reduce the spread of the virus. But can an employer go one step further and insist its workforce uses this technology?

From a legal perspective, businesses would need to consider whether such an instruction would be a reasonable management request. This will likely require an analysis of the infection risk within the workplace, other measures that are being taken to help reduce the spread of the virus, and the extent to which the employer considers the downloading and use of the app would help to safeguard the workforce and/or customers, clients and suppliers. 

There are also several practical issues to consider: 

  • Which device would the app be installed on? If workers do not always carry a work phone with them there is likely to be limited benefit if it is installed on that device.
  • If it is installed on a personal phone, how would the employer check whether the app has indeed been installed – and is active and running? Workers may, understandably, be reluctant to hand over their personal phone for checking.
  • What would the employer's position be if the worker's personal phone is not capable of running the app?
  • How could checks be made to ensure that workers are always carrying their phones? For example, how would an employer know whether a worker took their phone to the supermarket at the weekend?
  • How would such an instruction sit alongside other workplace rules? Some businesses will have rules in place that prohibit phones from being taken onsite.

There are also broader employment law questions that need to be considered. For example, if a worker receives an alert that they may be at risk, has the employer clarified what the worker needs to do next? And what reference does the business's sickness policy make about the requirement to self-isolate and employee wages during that period?

From a data protection perspective, insisting that workers download and use one of the government apps may make the employer a joint controller. This may be the case even though no personal data would actually be available to them. The European Data Protection Board's recent guidance on the concept of controllers, processors and joint controllers would need to be reviewed, and consideration would have to be given to what joint controllership responsibilities may arise. The employer would also want to document the reasons for its decision to compel workers to use a contact tracing app, and to explain to the workforce how their data would be used and who would be responsible for it. 

Unsurprisingly, a number of other contact tracing apps and solutions have appeared on the market in recent months. Some do not collect any information but make a noise when people are too close to each other, while others are more intrusive and track interactions between individuals – and provide that information to the person managing the system. Each of these presents different challenges from a data protection and employment law perspective, and would require a detailed impact assessment to identify the potential privacy risks.

Against that backdrop, it's likely that many businesses will promote the relevant app as part of the organisation's Covid-secure workplace strategy and highlight the benefits of everyone using it, but will stop short of compelling their workforce to download and use the technology. 

Fiona Herrell is an employment partner at Brodies