Covid-19 business criminal law and other issues in the UK

Businesses covered by emergency coronavirus legislation that are required to close during the pandemic can be criminally liable for failing to comply with the restrictions.  All businesses, whether covered by the emergency legislation or not, must comply with existing health and safety laws and regulations.  Breach of those requirements also carries criminal liability as explained below.

Health Protection (Coronavirus, Restrictions) (England) Regulations 2020 (the “Regulations”)

Business closure and restriction rules

The Regulations came into force on 26 March 2020 ‘in response to the serious and imminent threat to public health’ posed by coronavirus. The Regulations will be reviewed every 21 days and have already been subject to three sets of amending regulations. Similar regulations have been adopted in Scotland, 1 The position under the Health Protection (Coronavirus) (Restrictions) (Scotland) Regulations 2020 differs slightly to that in England in that the 2 metre social distancing guidelines are framed as a statutory obligation under s4(1)(a) of the Regulations. Businesses which may remain open under Part III of the Scottish Regulations (such as hardware stores, storage and distribution facilities and banks)  are subject to an obligation to “take all reasonable measures to ensure that a distance of two metres is maintained between any persons on the premises”.   Wales 2 The Health Protection (Coronavirus Restrictions) (Wales) Regulations 2020. Again, businesses remaining open must take all reasonable measures to ensure that a distance of 2 metres is maintained, whereas in England, this measure is only suggested in government guidance and is therefore not directly enforceable under the Regulations and Northern Ireland 3 The Health Protection (Coronavirus, Restrictions) Regulations (Northern Ireland) 2020 (though for the purposes of this article, the focus will be on the English provisions).  The Regulations limit movement outside the home and limit gatherings in public places.

Certain categories of business must either close in full (such as cinemas, gyms and hairdressers) or part, or else cease certain operations (in particular selling food or drink for on-premises consumption) while the Regulations are in force. 4 Parts 1 and 2 of Schedule 2 of the Regulations.   Some businesses, such as food retailers, pharmacies and banks, are allowed to continue operations (subject to caveats). 5 Part 3 of Schedule 2 of the Regulations.  All other businesses which offer goods for sale or for hire in a shop must cease their physical operations, except in relation to providing services in response to remote orders, though restrictions on openings of certain types of businesses have now been removed. For example, “outdoor markets” and “showrooms and other premises, including outdoor areas, used for the sale or hire of caravans, boats, or any vehicle which can be propelled by mechanical means” may operate after 11:30am on 1 June 2020.

The Regulations include rules for hotels and other accommodation providers, places of worship, community centres, crematoria and burial grounds which are permitted to remain open only in specific circumstances, and for permitted purposes.

Corporate liability for breaches by individuals 

The Regulations, in their first iteration, placed restrictions on people leaving their home without “reasonable excuse” under Regulation 6. The offence of being outside your home without a reasonable excuse has now been replaced with a new offence of staying overnight at any place other than your home without a reasonable excuse (a reasonable excuse includes among other things to attend a funeral, to move house, or where “reasonably necessary” for work purposes). With effect from 11:30am on 1 June 2020, a person can be outside their home for any reason, as long as this does not contravene any of the other prohibitions in the Regulations, for example on public gatherings under Regulation 7. In its first iteration, Regulation 7 restricted gatherings in groups of more than two people in a public place, save where the gathering was “essential for work purposes” (Regulation 7(b)).  The restrictions on public gatherings have now also been loosened, and a person will now be able to lawfully participate in an outdoor public gathering of up to six people, though indoor gatherings of 2 or more people remain restricted. Larger gatherings are permitted for, among other things, work purposes, for the provision of voluntary or charitable services, or at an educational facility where the gathering is reasonably necessary for the purposes of education. The police can take “such action as is necessary” to enforce the requirements. 

Notwithstanding the focus on individuals for the restrictions in Regulations 6 and 7, under Regulation 9(2), “A person who obstructs, without reasonable excuse, any person carrying out a function under these Regulations commits an offence.”  That offence could be committed by a corporate if the corporate, through its ‘directing mind and will’, obstructs an officer seeking to require individuals to comply with the restrictions in Regulations 6 and 7.

A company could also be liable for ‘inchoate’ offences or secondary/accessory liability offences, i.e. of conspiring, assisting, encouraging (inchoate), or aiding/abetting/counselling or procuring (secondary/ accessory liability) an offence under Regulation 6 or 7 by individuals. For example, a company may be liable for counselling or procuring an offence under Regulation 6 by trying to require staff to stay somewhere overnight if that was not  “reasonably necessary” for work purposes. 

Prosecution risk for inchote/accessory liability?

Corporate prosecutions for inchoate/accessory liability for breaches by individuals of Regulations 6 and 7 may be unlikely in practice, save in the most serious cases, not least because of the limited penalties available. As noted below, we are not aware of any prosecutions of corporates for this offence to date.  However, if one case is brought, that would set a precedent that could lead to wider risk.

“Person responsible for carrying on a business”

Responsibility for compliance with the Regulations lies with the “person responsible for carrying on a business”. A “person” for such purposes is defined as including the owner, proprietor or manager of a company and may include legal persons, such as corporate entities.

Enforcement

Police officers and designated local authority enforcement officers can issue a prohibition notice to anyone who they believe is contravening a business closure or restriction requirement in the Regulations. It is a criminal offence to contravene the business closure or restriction requirements, or directions given in a prohibition notice. The defence in all cases is one of ‘reasonable excuse’.  There is no guidance available as to what might be a valid, reasonable excuse. Ignorance of the requirements would not be treated as a reasonable excuse.

Health & Safety laws

Reasonable practicability requirements

All employers must continue to comply with their existing health and safety (and all other legal) obligations, whether or not those businesses are covered by the Regulations. Those existing obligations require businesses, so far as is reasonably practicable, to ensure the health, safety and welfare of not only their employees, but also third parties such as contractors, customers and members of the general public. Breach of these requirements may constitute a criminal offence under the Health and Safety at Work Act 1974. The test is that of reasonable practicability – in other words, did the company do all that it reasonably could have done. What will be judged to be “reasonably practicable” during unprecedented circumstances remains to be seen; however, one would expect this at least to require compliance with Public Health England 6 And any equivalent Scottish, Welsh and Northern Irish public health advice and any other relevant industry-specific guidance on social distancing (see further below). 

Any strategy adopted must justify working practices, how those practices may affect members of the public, and interactions with the wider community by way of a suitable and sufficient documented risk assessment (as required under the Management of Health and Safety at Work Regulations 1999). Risk assessments are “living documents” and must be kept under review where a change occurs affecting the suitability of the previous assessment or if a new risk emerges. Accordingly, companies should undertake a full risk assessment before permitting staff to return to work, and indeed those continuing to operate ought to have done this already. The outcome of a risk assessment may determine the need for changes to facilities and their use, such as the introduction of hygiene and social distancing measures, the use of PPE, and new policies on internal and external meetings. The reality is that any risk assessment, and the risk-limiting measures indicated by that risk assessment, will be very different for each industry, workplace, employer and employee, and each situation must be looked at individually. Companies will also need to be mindful of the employment law and data protection implications of any changes that they intend to implement (in particular if this necessitates changes to working hours or shift patterns, the use of data-tracking apps, mandatory reporting of symptoms or any potential issues of discrimination that might arise from a staged return to work that might seek to protect vulnerable groups).

Contagion risks will obviously be a key consideration for businesses. Shortages of Personal Protective Equipment (PPE) for front line health workers have been the subject of headlines, and for employers and employees who may have contact with micro-organisms (e.g. those handling waste) there will be additional duties under the Control of Substances Hazardous to Health Regulations 2002 (COSHH). Current UK Government guidance does not require employers outside health and social care settings to provide face masks as a matter of course (though these, as well as other non-COVID-19 related PPE may already be mandatory in respect of certain activities and industries). Their use is encouraged in public, although this is only advisory and is not a legal requirement.

Enforcement notices could require compliance with public health measures

Prosecutions for breaches of health and safety law are conducted by the Health & Safety Executive (HSE) and, in certain business sectors, by Local Authorities. While social distancing is fundamentally a public health measure introduced to reduce the spread of infection, where HSE identifies businesses who are not taking action to comply with the relevant Public Health England guidance to control public health risks (for example, by not implementing workplace controls and facilities to ensure workers are able to maintain a minimum 2 metre distance from other workers or the public at all times), they have stated that they “will consider a range of actions to improve control of workplace risks. These actions include the provision of specific advice to employers through to issuing enforcement notices to help secure improvements with the PHE guidance”.

The test is ‘risk of harm’ not ‘actual harm’

Companies should be aware of the potential risks of criminal enforcement. Under UK health and safety law, actual harm is not a pre-requisite for prosecution. Rather, it is the exposure to risk of harm. Accordingly, even if a workplace contraction of the virus cannot be proven, if work practices are such that employees or members of the public are exposed to risk of harm, that may be sufficient for criminal liability to attach. 

Prosecution risk?

Prosecution is not expressly referenced by HSE as part of its COVID-19 related enforcement policy, but it certainly falls within its powers, and one must assume that this would be reserved as an outcome for serious or persistent breaches by companies. In addition, whilst the HSE has recently updated its guidance as to when COVID-19 cases will be reportable under the Reporting of Injuries, Disease and Dangerous Occurrence Regulations 2013 (RIDDOR) – i.e. as having been contracted at the workplace, it is considered unlikely that the majority of cases outside the context of frontline care provision will meet the “reasonable evidence” criteria set out by the HSE that the exposure arose in the workplace.  However, the longer existing social distancing controls have been in place before workers contract the virus, the greater risk that individuals may be able to meet this test on the basis that their risk of exposure otherwise than during work was minimal. 

The Coronavirus Act 2020

Finally, the Coronavirus Act 2020 (the “2020 Act”) came into force on 25 March 2020. Its stated aim is to introduce new laws to protect public health, increase NHS capacity, strengthen social care and support the public to take the right action at the right time.  The 2020 Act ensures lockdown restrictions and creates new offences for failing to comply with those restrictions. The Secretary of State and Welsh Ministers (as well as Scottish and Northern Ireland equivalents) are given powers to prohibit or restrict events and gatherings and to close and restrict access to premises if deemed necessary for public health. 7 Section 52 and schedule 22 of the 2020 Act  Unless they have a reasonable excuse, businesses that fail to comply with a relevant prohibition, requirement or restriction imposed on them, face criminal liability. 

(There are also separate offences for individuals who are considered ‘potentially infectious’ failing to comply with a requirement to attend or remain at a place for screening and assessment. 8 Section 51 and Schedule 21   Such a requirement can, in the most extreme cases, last for up to 28 days if relevant extensions are imposed.)

Specific requirements to ensure the food supply chain

The 2020 Act also allows UK authorities to require business in the food supply chain to provide information to enable the authorities to assess whether the whole or part of a food supply chain is being disrupted or is at risk of disruption and the nature of that disruption.  Failure to comply can result in a financial penalty of up to 1% of turnover.  If the penalty is not paid within 28 days, it will automatically increase by 50%.

As noted above, offences under the Regulations and the restrictions on gatherings and access to premises under the 2020 Act 9 Ibid. may be committed by a company.  Directors and officers of the company may also be personally liable where they have consented, connived or been negligent in relation to the commission of the offence.

Under existing laws, criminal liability may attach to senior managers and directors where an offence under the Health and Safety at Work Act 1974 can be shown to have been committed with their consent, connivance or neglect.

Prosecutions for breaches of the Regulations are summary offences (triable only in Magistrates Courts) and are subject to a 6-month statutory time limit for the institution of proceedings. Fines for corporate entities and individual directors are unlimited, but must be proportionate to the culpability for, and harm caused by the offence committed, and the means of that person. Provision is also made for a discretionary fixed penalty notice of £100, rising to a maximum of £3,200 for persistent breaches, in lieu of prosecution. There are no custodial sentences.

Under health and safety law, companies and directors can be fined, and directors may face custodial sentences of up to 2 years for breaches.  Again, fines are unlimited, and are determined based on culpability, the harm risked and the turnover of the relevant corporate entity. The level of sentencing is heavily fact specific, but for large organisations (defined in the relevant sentencing guidelines as those with annual turnovers in excess of £50 million) found to have breached health and safety law, fines in excess of £1 million are not unusual.  It is to be expected that cases, where a clear causal link is shown between unsafe working practices and a resurgence of infection rates, will be treated very seriously.

Prosecutions for breaches of the 2020 Act are also summary offences, punishable with a fine.

Where businesses have benefited financially from any criminal breach, such financial benefit may be confiscated under proceeds of crime legislation.  In theory, any use of those proceeds of crime by the company or anyone else in the business, knowing or suspecting that it is criminal property, would expose them to separate money laundering offences which carry much higher penalties (including up to 14 years’ imprisonment).  But where the underlying offence that generated the proceeds can be charged, prosecutors should normally charge that underlying offence instead of money laundering.  Compensation can also be ordered for identified victims.  Directors may also face disqualification in the most serious cases.

At the time of writing, we are not aware of any actual prosecutions of businesses or senior management relating to breaches of the Regulations  (including for any inchoate/accessory liability offences) or pre-existing health and safety laws.

Unfortunately, there have been a growing number of prosecutions and convictions (under The Assaults on Emergency Workers (Offences) Act 2018) of individuals for assaulting emergency workers by coughing/spitting/trying to bite them while claiming to be infected with the virus (usually untruthfully), resulting in imprisonment for up to 12 months and compensation orders for victims.

On 15 May 2020, the Crown Prosecution Service published its review of the first 200+ cases under the coronavirus laws up to the end of April 2020.  It found that almost all prosecutions under the Regulations (175 out of 187) were correctly charged.  However, all 44 cases charged under the 2020 Act (which were all against individuals failing to comply with requirements under section 51 and Schedule 21) were incorrectly charged because there was no evidence that they covered potentially infectious people, which is a requirement for that legislation to apply.  Of those 44 cases, 38 were charged alongside other substantive offences, such as assaults on emergency workers, theft and burglary (see here).

The HSE has published guidance aimed at all sectors, titled “Working safely during the coronavirus outbreak”. The guidance explains measures to help employers carry on working safely during COVID-19, for example by putting in place social distancing measures, staggering shifts, providing additional handwashing facilities and how to talk with workers to help them stay safe. The guidance states that employers must conduct a risk assessment to manage risks and protect people. Employers must, as part of any risk assessment:

• identify what work activity or situations might cause transmission of the virus;
• think about who could be at risk;
• decide how likely it is that someone could be exposed; and
• act to remove the activity or situation, or if this isn’t possible,
• control the risk.

Practical guidelines have also now been published by the government to help employers make workplaces as safe as possible, including the expectation that all employers with 50 or more staff should publish the results of their Covid-19 risk assessments. The documents have been developed in consultation with around 250 businesses, trade unions, the devolved administrations, Public Health England and the Health and Safety Executive (HSE). The guidance covers eight workplace settings permitted to be open, including construction sites, factories and takeaways, and includes downloadable notices for employers to display to demonstrate they are following official guidance.

There are five main principles:

1. Work from home, if possible

Employers should take all reasonable steps to enable people to work from home. For those employees who cannot and whose workplace has not been told to close, the government says its message is clear: staff “should go to work”. Employers should communicate with employees about when their workplace will open.

2. Consult with workers on Covid-19 risk assessments

The guidance operates within current health and safety laws and equality legislation. Employers need to carry out Covid-19 risk assessments in consultation with their workers and trade unions, to establish what guidelines to put in place. If possible, employers should publish the results of their risk assessments on their website and the government “expects” all businesses with over 50 employees to do so.

3. Maintain two metres’ social distancing ‘where possible’

Employers should redesign workspaces to maintain two-metre distances between people by staggering start times, creating one-way systems, opening more entrances and exits, or changing seating layouts.

4. Manage transmission risk

Where people cannot be two metres apart, employers should erect barriers in shared spaces, create shift patterns or fixed teams to minimise interpersonal contact, or ensure workers face away from one another.  They do not require employers to provide PPE.

5. Reinforcing cleaning processes

Workplaces should be cleaned more frequently, paying close attention to high-contact objects like door handles, keyboards and lift buttons. Employers should provide handwashing facilities or hand sanitisers at entry and exit points.

Specific guidance for the following eight workplace settings are also available:

• Construction and other outdoor work
• Factories, plants and warehouses
• Homes – Guidance for people working in, visiting or delivering to home environments
• Labs and research facilities
• Offices and contact centres
• Restaurants offering takeaway or delivery
• Shops and branches
• Vehicles – Guidance for people who work in or from vehicles, including couriers, mobile workers, lorry drivers, on-site transit and work vehicles, field forces and similar.

Separate guidance is in place in respect of the devolved administrations in Scotland 10 A notable difference is the Scottish government’s position that non-essential business sectors – like construction (unless it is essential construction, such as a hospital) – should close unless and until it is clear how operations can be undertaken safely.  This is to be contrasted with the position in England, where Prime Minister Boris Johnson said that those who could not work from home should be "actively encouraged to go to work" as from 13 May 2020. , Wales and Northern Ireland. 

Failure to comply with PHE, government (including devolved administration where applicable) or any other relevant industry specific guidelines is not a criminal offence. However, non-compliance (in the absence of other potentially offsetting/risk-reducing steps) may evidence a failure to do all that is reasonably practicable to prevent exposure to risks for both staff and members of the public, and so, constitute a breach of health and safety law.

Depending on how businesses react and adjust to the Covid-19 crisis there is significant scope for civil claims and threat of claims.  It is not possible to identify every sub-type of claim that could be brought or asserted in every circumstance, but we identify below some key categories and risks of claims from employees and customers or business partners arising from breaches of the above restrictions and regulatory requirements.  Of course there may also be contractual claims arising from how businesses deal with staff and pay during and at the conclusion of the lockdown, which are covered in other guidance we have produced.

Claims by staff relating to unsafe working conditions

• Most obviously at risk are businesses and public authorities which have continued to operate during lockdown, including healthcare and social care providers, other key public services (e.g. police, fire and ambulance services) and businesses where employees have continued to operate from their normal place of work, such as food retailers and distributors of online shopping.  Employees may argue that: they have suffered mental health issues and stress as a result of having to attend work (including via public transport with its own attendant risks) and expose themselves (and vicariously their families) to the virus; they should have been provided with some or better PPE; they should have been given better training; and/or their workplace should have been adjusted to create more distance between employees.  For those that can demonstrate to the appropriate legal standard (i.e. balance of probability) that they contracted the virus through work, the risk of claims for substantial damages will increase.

• As lockdown restrictions begin to ease, businesses resuming in-person operations must carefully consider the duties owed to employees.  On the one hand, business will want to resume operations in as “normal” a way as possible as quickly as possible, but proportionate adjustments may need to be made in light of their business and the nature of their workforce.  Indeed, duties may extend beyond business premises.  For example, a business may make necessary adjustments to the office, but find that public transport simply isn’t sufficiently safe.  A further issue is of vicarious liability and whether an employee recklessly or intentionally coming to work and spreading Covid-19 may impose liability on the business.

Claims connected to the transmission of Covid-19 are likely to raise complex questions of causation.  For each case of Covid-19, there could be numerous potential infection sources.  By making prudent adjustments to the workplace and encouraging social distancing, employers can not only reduce the risk for their employees, but also make it more difficult to prove that transmission occurred at the place of employment, increasing the causation challenge should an unfounded claim be filed.

Claims by members of the public

Such claims must be founded on breach of a duty owed by the business, whether established by statute, contract or otherwise.  Categories of potential claims include where members of the public were subjected to unsafe conditions.  This is a particular concern for businesses that provide in-person services, such as entertainment venues, hospitality, transport, leisure and tourism.

Collective redress

Many of the events that lead to claims by employees or customers will be particularly suited for collective proceedings or class actions.  This is both due to the number of potential claimants impacted by a single event and issues of common fact or law in relation to each claim.  The risk of facing proceedings depends of course on the facts of the particular event, but also on the domest in Scotland and Northern Ireland 11 The procedural law in Wales is the same as England. and its suitability for collective proceedings, including whether such claims operate on an opt-in or opt-out basis (the latter being potentially more concerning for businesses). Litigation funders are very active in assisting claimant law firms to bring mass claims, and we know that they are closely monitoring the Covid-19 environment.