What are the Legal Duties to Control Legionella?

As an employer, health and safety is of the utmost important when it comes to the safety of all employees, work associates and customers. With regard to the control of legionella within the workplace, UK health and safety legislation has set out certain provisions and guidelines to help employers comply with their legal duties. The Health and Safety at Work etc. Act 1974 (HSWA) takes into consideration how the growth and spreading of legionella can affect the workplace environment as well as your own domestic environment. The Management of Health and Safety at Work Regulations (MHSWR) is the complementary piece of UK legislation which also offers guidance regarding what is legally expected of an employer. As an employer, it is your responsibility to ensure everyone within your workplace environment is cared for, and you must be aware of the legal duties stated within all relevant UK health and safety laws.

Which UK laws state the legal duties to control legionella?

As an employer, you need to ensure that you are complying with all relevant UK health and safety legislation in order to avoid harming any of your customers or work associates. Moreover, it will protect your organisation from fines, imprisonment and damage to your reputation which will arise if it is publicised that your organisation did not maintain health and safety standards, leading to an individual falling ill due to infection by legionella bacteria. The legal duties to control legionella are set out in:

The Health and Safety at Work etc. Act 1974 (HSWA)

The Management of Health and Safety at Work Regulations (MHSWR)

and

The Control of Substances Hazardous to Health Regulations 2002 (COSHH)

Ensuring you are aware and well educated in the provisions stated in the above three sets of legislation will stand your organisation in good stead for complying with legal duties to control legionella.

To start, the main legal duties your organisation should be exercising in all matters related to health and safety are:

1) Carry out a risk assessment. Regarding controlling legionella, your responsibility is to conduct a risk assessment which analyses all possible outlets and instances where the legionella bacteria will be present or could multiply due to certain changes in conditions. Legionella will present a risk in water systems. Legionella bacteria will multiply and grow, thus presenting a more severe risk, if: the water system is between 20–45 °C or if rust, sludge or scale is present within the water system.

2) Manage these risks. If you have identified that legionella bacteria is growing within your organisation’s water system, then there is the potential for legionella bacteria to be spread via water droplets, which can be circulated from aerosols from cooling towers and within showers. Thus, you need to manage these risks. Legionella can be managed by ensuring the water system is not between the temperature of 20–45 °C and that the water system is updated and maintained regularly so that rust and scale cannot grow.

3) Take into consideration which employees, work associates and customers are at particular risk of infection by legionella bacteria. This is an important legal duty considering that certain individuals are more susceptible and vulnerable to legionella related diseases. Legionnaires’ disease will more likely infect an individual if they are pregnant, elderly or already have a weakened immune system. Take into consideration the individuals that you are dealing with in your workplace environment.

4) It is an employer’s responsibility to ensure that this legionella related risk assessment process is documented and recorded. This record will subsequently allow your organisation to continually update your risk assessment procedures effectively, and if any incident were to occur, it means that your organisation has the relevant documents to prove that there was a concerted effort to control legionella.

It is essential as an employer to ensure that training for the management team and all employees in health and safety related matters regarding legionella is conducted.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

“In a world older and more complete than ours they move finished and complete, gifted with extensions of the senses we have lost or never attained, living by voices we shall never hear.”