COVID-19 Privacy commissioner weighs in on workplace testing
Saskatchewan’s information and privacy commissioner has weighed in on the “tricky issue” of how employers should handle COVID -19 screening in the workplace.
“This is a fundamental issue and can be controversial,” wrote Ron Kruzeniski in a report published on Wednesday. “It gets us into the issue of whether employers can or should require medical tests in the workplace.”
He noted that requiring employees to answer questions or take tests for COVID-19 “might result in a court challenge.”
Kruzeniski explained in an interview that he sees parallels — and differences — with the long-standing debate over workplace drug tests.
“It’s similar in the sense that by asking an employee to take a test, you’re collecting information,” he said. “If you have the information, who gets that information?”
He said it’s not up to him to decide whether employers should conduct those tests, or whether workers can refuse them.
“I really shouldn’t comment on whether you should do it or not do it,” he said. “But if you do it, here’s some privacy concerns to think about.”
Kruzeniski explained that health sector and government employees fall under provincial privacy legislation that would impose special rights and duties to safeguard information. But he also laid out a series of “best practices” that any employer can follow.
He urged employers to be “open and transparent.” That means informing staff about the purpose of screening, and being up front about who the information will be shared with and how long it will be stored. Information should be shared only on a “need-to-know” basis. But employees should know that their information could be shared with public health authorities.
Kruzeniski noted that question-based screening in itself does not create any responsibility to report to the medical health officer, so long as it is conducted by a non-health professional. But a test conducted by a doctor or nurse would create such an obligation.
He said employers can provide statistical information about testing and results. But the data must be scrubbed of any identifying information.
“The employer should not give out names or identify the ones who tested positive as this may be considered a privacy breach,” he wrote.
According to Kruzeniski, it’s important for employers to define a purpose for their testing regime, and avoid what he called “function creep.”
“Employers should collect the least amount of information necessary to achieve the purpose,” he wrote.
He asserted that employers don’t need to know everything. Once an employee tests positive, the only thing to do is tell them to stay away from work and consider work-from-home options. Public health followup is not really an employer’s business.
“You are the employer, not the doctor,” he explained.
Kruzeniski stressed how critical it is for employers to make sure personal information is secure. That’s an obligation for many employers, and best practice for all. Employers will need to decide when the information should be destroyed.
“There has been media coverage about people’s fear of having COVID-19 and the stigma that comes along with that,” he said. “Maybe a year from now, there will be an approved treatment and vaccination, which might reduce the stigma and the fear. Maybe the information collected can be destroyed earlier than an employer’s standard procedure.”
John Hopkins, CEO of the Regina Chamber of Commerce, said he’ll share Kruzeniski’s report with his members. Though he hasn’t heard much about COVID-19 screening in private enterprise so far, he believes employers could benefit from the advice as they reopen for business over the coming weeks and months.
“It certainly is a question that every employer is going to have to answer,” he said.
But he predicted question-based screening is more likely than testing requirements, at least so long as cases remain low.
“Most employers will just ask, and take it from there,” said Hopkins. “At the end of the day, it really is about safety.”
Kruzeniski said employees who feel their rights have been violated can launch complaints with their HR departments, talk to union representatives or contact health authorities to ask what’s reasonable. Occupational health and safety authorities might also be an option.
“Finally, there’s an opportunity, if they feel too much information is being collected, to consider a complaint to our office,” he said, though he noted that would only apply to a limited number of employers under his jurisdiction.
“But we’re in the area of proper collection, proper storage, proper sharing, and not in the middle of the debate on whether society does this or not.”