Coronavirus Testing: Key Legal Points for College Leaders

Obligation on school to test?

The Secretary of State has indicated that testing of students is expected, but is still not compulsory.  However, as the testing regime develops, colleges will struggle to justify non-participation in testing unless very clear factual reasons can be shown.

DHSC terms and conditions

When colleges make the decision to participate in the government’s Covid-19 testing programme, they must automatically adhere to the Department for Health and Social Care’s (DHSC’s) terms and conditions, which include the following key provisions:

Funding for costs
  • DHSC will fund the DfE, who will in turn fund participating colleges.
  • Colleges must incur costs up front for the resources and materials that are necessary for the testing.
  • Payments will be made retrospectively to schools, and the amount of funding a college will receive will depend on its size.
Main obligations
  • The terms and conditions apply from when a college places an order for supplies and/or agrees to participate in the testing. 
  • College are committed until the end date of the Spring term 2021, although colleges can terminate the arrangement at any time by providing 14 written days’ notice to DHSC.  All supplies must be returned on termination.
  • As well as complying with ‘all applicable law’, colleges must perform testing “with all reasonable skill and care” and in accordance with the detailed Standard Operating Procedure (SOP), which forms a schedule to the agreement.
  • Liability to third parties (i.e. students or staff)

Many colleges have raised concerns about the DHSC terms and conditions, including being liable for a claim for personal injury for undertaking medical tasks which do not fit squarely with the day to day operations of the college. Many colleges were expecting an indemnity from the DHSC regarding any liability which may arise during the testing process, but it would appear that DHSC (and DfE) is expecting colleges to rely on their insurance cover. DHSC’s liability for personal injury would only arise due to any negligent act or omission of DHSC (or its employees and contractors) resulting in personal injury (for example due to any errors in the SOP or equipment). We understand (more detail provided in the section directly below) that the Risk Protection Arrangement (RPA) has confirmed that it will cover personal injury resulting from testing under its usual terms.  It is important to note, however, that many colleges are not in the RPA, and therefore are advised to check their insurance policies, and to seek confirmation that liability will be covered, and the extent of the coverage.  

  • Liability to DHSC:

As regards liability to DHSC, liability is capped at £100,000 (or the value of any applicable insurance held by the college, if higher). Consequential loss and damage is excluded (including loss of data, profits, business, goodwill or anticipated savings).  It is unlikely that DHSC would take legal action against colleges acting prudently and in good faith under the contract, and DHSC would also have to prove loss for any breach of contract claim.

Overarching commentary

Overall, colleges are not experts in testing, and while this agreement may, on the face of it, appear to go too far to place legal obligations on colleges, realistically it is not negotiable. As stated above, we would be surprised if the DHSC took any legal action against participating colleges who are carrying out the testing in good faith. The fact that the RPA appear to have agreed to cover personal injury and any damage to testing equipment under its standard terms is also a positive development. It is possible (although schools are advised to check) that other insurers would do the same. The programme has also been the subject of a pilot, and the general consensus appears to be that the risk of any personal injury is low (see also section entitled Health and Safety: Civil Liability (personal injury) below). can advise further on this issue.


The DfE has told a trade association that the RPA will indemnify members if a claim is brought by a third party (including pupils) or employees. It will cover death, injury, or damage to third-party property, due to the school or colleges undertaking the rapid tests. It would be advisable that these establishments, and all colleges which are not members of the RPA, should contact their individual commercial insurance provider, for definitive clarification on cover.

It is a requirement that risk assessments are undertaken, recorded, and adhered to.
In the event of loss or damage to any equipment that is owned by or a college’s responsibility (e.g., through a lease or hire agreement) used in the provision of the testing, the RPA will provide an indemnity to the college for the cost of repair or replacement. The cover is subject to the usual RPA Membership Rules (including all limitations, conditions, and exclusions). can advise further on this issue.

Staffing: availability

The current Government guidance contemplates “a small team to support the work. We recommend that this includes 1 to 2 members of staff with others being either volunteers (for example governors) or agency staff”.

As a consequence, it is likely that the required duties will fall to senior leaders (non-teaching) and support staff, with school business professionals playing a key role. Colleges would be well-placed to consider staff in the context of their current roles. If colleges have current members of staff that have caring responsibilities, we would suggest that these staff should be considered as a first step. Seeking volunteers is an advised starting point.

There are 7 workforce roles required to be able to conduct testing in colleges. The roles can be performed by the same person and all individuals must complete mandatory online training before testing commences. A workforce planning tool is available to assist each individual college and this also calculates how much funding each college can receive. The DfE have made £78 million available to support testing in schools and colleges. can advise further on this issue

Can colleges compel staff to supervise or carry out duties related to testing?

Many employees will have a clause in their contract of employment which permits employers to vary employees’ duties as and when required. Even in the absence of such a clause, there is a general implied duty in contracts of employment to be adaptable. Furthermore, employees have a duty to obey lawful and reasonable orders. That said, the employer needs to be careful as to not go beyond what is reasonable in relation to the requirements placed on employees, so as to not breach the implied duty of trust and confidence between the parties. If colleges are in doubt about whether then can oblige a particular member of staff to carry out duties related to supervising testing without their agreement, they should take legal advice. can advise further on this issue

Pupil testing consent

Participation is optional for students.  Consent will need to be obtained in all cases using the DHSC template consent form.  Parental consent will be required in practice for all students under the age of 16 to avoid any later arguments about the capacity of younger children to give consent for this testing. A single parent can provide consent if needed unless another parent has previously notified the college that they will also expect to give consent. can advise further on this issue

Employee testing

Testing for staff is an option, not a requirement. The DfE have confirmed that testing is central to overall risk assessments in colleges and it is reasonable for colleges to strongly encourage staff engagement with the testing programme. Trade unions have also encouraged staff in colleges to engage with testing.

Our advice is that staff should not suffer any detriment for refusing consent to be tested. Colleges should consider the employee’s individual circumstances and any mitigating factors, as individuals may have valid reasons for refusing to be tested. The requirement to be tested could also disproportionately affect some protected groups, such as those with certain disabilities.  

If an employee does have close contact with a student or colleague who tests positive and they refuse to be tested then they would need to self-isolate in accordance with national guidance rather than commence the daily testing programme. can advise further on this issue

Data Protection: processing and sharing health-related personal data

Personal data will need to be handled in line with the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018 (“DPA 2018”).

The DfE Schools Testing Handbook contains a model privacy. This should be provided to student/staff before their data is collected. i.e. together with the consent form.

Although participation in testing is optional, the DfE’s approach is that consent is not required under the UK GDPR in order to process or share personal data from the tests including test results. Instead, the DfE’s template privacy notice indicates that pupil personal data will be processed under Article 6(1)(e) of the UK GDPR i.e. the processing is necessary for the performance of a school’s “public task”[1].

For the processing of staff personal data, the DfE’s current position is that this can be processed under the UK GDPR legal basis of “legitimate interests”. (Article 6(1)(f) of the UK GDPR) where the legitimate interests are to minimise the spread of Covid-19 in a timely manner and for the continued delivery of education services safely and securely. NB. Stone King’s Information Law team has raised the applicability of this legal basis in this context with the DfE, so please return to this page for future updates when we publish them.

As colleges will be handling special category personal data (i.e. health-related personal data), the DfE template privacy notice provides that the relevant condition under Article 9 of the UK GDPR is Article 9(2)(i)  (Processing for reasons of public interest in the area of public health) together with Paragraph 3 of Part 1 of Schedule 1 of the DPA 2018 (“Public Health”) i.e. this allows for health-related personal data to be processed and shared providing that the processing is necessarily in the public interest for public health and carried out by or under the responsibility of a health professional or someone who owes a duty of confidentiality under an enactment or rule of law.

Retention of personal data: The DfE template privacy notice states that personal data in relation to both positive and negative test results will be kept by the college for up to 14 days. Your Covid Test Register should be securely destroyed within 1 month of the testing programme ending.

Your status as a data controller: The Terms and Conditions for Covid-19 Testing (Schools and Further Education Providers) Agreement contain data protection obligations at clause 6. In simple terms, these provide that the “provider” (i.e. the school or college) will be an independent controller in respect of personal data that it collects from or that relates to test subjects and the DHSC shall be an independent controller of any personal data it collects from the provider. This means that whilst the school or college is a data controller of the personal data it will need to handle it in line with the UK GDPR and DPA 2018. This includes ensuring that the personal data is processed in line with the seven Data Protection Principles and dealing with the exercise of any individual legal rights such as, for example, data subject access requests.

Data protection liability: Providers’ participation in this mass testing programme may lead to certain data protection liabilities, for example where a school or college suffers a personal data breach. Liability for loss of data is expressly excluded as between the provider and the DHSC.  Schools and colleges must therefore be prepared to cover any regulatory fines or individuals’ claims that may result. The general provision limiting liability under The Terms and Conditions for Covid-19 Testing applies which states that the total liability of the Providers to DHSC, including data protection liabilities, has been capped, so that it cannot exceed the greater of £100,000 and the value of any applicable insurance held by the Provider. DHSC’s liability to the providers has not been capped. can advise further on this issue


[1] The DfE has indicated that the relevant statutory functions are the school’s safeguarding powers under Section 175 of the Education Act 2002 (for maintained schools) or Paragraph 7 of the Schedule to Education (Independent School Standards) Regulations 2014 (for Academies) and Paragraphs 3 and 14 of the Schedule to the Non-Maintained Special Schools (England) Regulations 2015 (for non-maintained special schools).


Health and Safety: civil liability (personal injury)

Our understanding is that the test will be self-administered by students by applying a swab within their own throat and nose, under adult supervision but without the adult being involved (except children with SEND where necessary).  There should be a low risk of injury, but if harm is caused as a consequence of the process not being carried out correctly then a claim for financial compensation could follow.  Even though a court would almost certainly support a college following Government guidance as being reasonable, the actual administration of the tests would still need to be a carried out at a basic level of competence to avoid a breach of duty.  If there was such incompetence, causation of any injury would be simple to establish, although compensation levels for any injury would be likely to be low unless serious injury occurred. Consequently, colleges should be particularly vigilant in maintaining a sufficient safety regime regarding testing, given the risk of a small minority of parents potentially attempting to make claims in due course.  Incidentally, getting parents to sign a waiver regarding liability would be of no effect regarding a personal injury claim. 

As regards staff, colleges should consider the potential risk of repeated exposure to covid by those involved in testing and how this risk should/can be managed. We would suggest that  a risk assessment of the testing site and process are carried out as a preliminary step. Colleges should also should consider the impact of those staff who are testing on bubble contamination.  

Colleges carrying out testing are strongly advised to check their testing system with their public liability insurer before implementing it. can advise further on this issue.

Health and Safety: Criminal  Liability

A failure to carry out a suitable and sufficient risk assessment of the activity and carry out sufficient training could lead to prosecution, in theory, in respect of systematic failings. In reality, given the Government guidance, our advice is that the risk of prosecution for shortcomings in carrying out this testing is negligible. Prosecutions for shortcomings leading to safeguarding issues are phenomenally rare, and it is highly unlikely that the Health and Safety Executive will view prosecutions to be in the public interest, consistent with their approach during the pandemic to Covid-related initiatives. can advise further on this issue.

The law and practice referred to in this article or webinar has been paraphrased or summarised. It might not be up-to-date with changes in the law and we do not guarantee the accuracy of any information provided at the time of reading. It should not be construed or relied upon as legal advice in relation to a specific set of circumstances.

The Legal 500 - The Clients Guide to Law Firms

UK Chambers logo

Best Companies - One to watch logo

Cyber Essentials Certification Logo