Protect Scotland Tracing App
Scotland’s Coronavirus tracing app, released earlier this month, is voluntary to download, although the government is strongly encouraging everyone to do so to help prevent the spread of the disease. Employers may wish to introduce a mandatory policy requiring employees to download and use the app. However there are a number of legal and practical issues to consider before they do so.
Specifically, under Data Protection legislation the NHS and Scottish government are ‘controllers’ of the information obtained through the app and this information must not be given to third parties, including employers. However, if employers introduce a mandatory policy requiring employees to download the app, the employer may become a ”joint controller” and subject to data protection obligations.
Any such policy should be drafted to include reference to the employer’s Data Protection obligations. Additionally, in drafting the policy employers should outline how refusals to download the app will be dealt with, what the worker needs to do if they receive an alert that they may be at risk and how the employer’s sickness policy relates to any requirement to self-isolate.
Practical issues to consider prior to implementing a mandatory policy are:
- Will the employee be required to install the app on their work or personal phone?
- Would installation on a personal phone carry any cost implication for the employee – eg. increase in personal data useage?
- How can the employer monitor the installation of the app on a personal phone?
- What can be done if an employee’s device is not compatible with the app – eg. not iOS or Android?
- How can the employer ensure that the employee carries the device at all times, including out-with working hours?