BACKGROUND

This legal FAQ addresses certain considerations for data center operators following the spread of, and the United States federal and state governments’ and the public’s reaction to, COVID-19 and its impact on businesses and their contractual arrangements.

The COVID-19 situation continues to develop at pace and governmental advice is being updated daily. This briefing therefore reflects the position as of March 24, 2020, only.

While this FAQ has been written to reflect the position under United States law, a number of the principles discussed will have wider application outside of the laws of the United States.

FAQ

Does COVID-19 constitute a force majeure event?

The applicability of force majeure depends on the wording of the relevant force majeure clause.

Data center operators are most likely to be able to rely on force majeure if their contract refers to “disease” or “pandemic” or other similar language.

We do not, however, expect to see such language in typical contracts between data center operators and their customers.

As the response and steps taken by governments to tackle COVID-19 intensify, it may become more likely that companies can rely on force majeure triggers that refer to “governmental intervention” or similar.

Seeking to rely on more common wording like “acts of God” or “circumstances beyond the party’s reasonable control” may provide a basis for a force majeure claim depending on the drafting of the clause.

There will also often be further hurdles to surmount, such as conditions in the force majeure clause itself and the requirement to show a causal link between COVID-19 and the delay or failure to perform.

Relying on force majeure will not be straightforward and, given the potential financial implications of not performing their contractual obligations, data center operators should consider steps to mitigate the impact of COVID-19 such as resourcing considerations and business continuity planning.

For a Force Majeure COVID-19 Checklist for Real Estate and Construction Projects, please review this March 17, 2020, legal alert from Partners Trent Myers and Jesse Lincoln.

What other contractual considerations are there due to COVID-19?

In addition to force majeure, it will be necessary for data center operators to understand the position in other areas of their contracts, including:

• Compliance with applicable law – do the obligations to comply with applicable law extend to regulatory / government guidance?
• Change of law – does a change of law that arises as a result of a public health emergency mean additional costs or obligations?
• Termination rights – are there any termination rights that need to be considered more closely in light of COVID-19?
• Insurance – Check insurance policies to see if they cover losses or liabilities relating to COVID-19.  Many business interruptions insurance policies have an exception to coverage for interruptions caused by viruses or must be triggered by insurable events such as physical damage.
• Business continuity obligations – a careful review of the contractual business continuity position should be undertaken.
• Supply chain/subcontractors – what controls are there over supply chain/subcontractors (for example, restrictions on use of alternative subcontractors)?
• Governance and escalation – how often are the parties obliged to meet to discuss contract operation?

In collecting visitor personal data (whether related to possible exposure to COVID-19 or otherwise), a data center provider will be subject to rules relating to such collection, including that the collection is necessary, justified and fair.

This would most likely be justified as necessary for legitimate interests in promoting the health, safety and welfare of employees and visitors to sites (though care should be taken regarding explicit questions about an individual’s health that would require additional lawful grounds and policy documentation).

Given the seriousness of this pandemic and the latest governmental advice, we would expect parties to take a sensible approach to this, and anyone who is deemed to be at risk of having contracted the virus should be refused entry and be advised to self-isolate.

From a privacy law perspective, while it is unlikely that a person would object to being denied access, even if this was the case, our view is that the negative impact on that person’s rights is outweighed by the need to protect the health of employees and other visitors.

In guidance from March 19, 2020, the EEOC clarified that, during a pandemic, ADA-covered employers may ask employees if they are experiencing symptoms of the pandemic virus and may measure employees’ body temperature.

When employees return to work, the ADA permits employers to require doctors’ notes certifying their fitness for duty. In hiring new employees, an employer may also screen applicants for symptoms of COVID-19 as long as it does so for all entering employees in the same type of job. An employer can either delay the start date for the applicant or withdraw the job offer.

All information about applicants or employees obtained through medical examinations must be kept confidential. Information regarding the medical condition or history of an employee must be collected and maintained on separate forms and in separate medical files and be treated as a confidential medical record. If an employee voluntarily discloses that he or she has a specific medical condition or disability that puts him or her at increased risk of influenza complications, the employer must also keep this information confidential.¹

While the definitions of essential businesses vary from state-to-state, data center operators should make a determination of which employees are essential to keep the business operating and be prepared to implement some rotating staff plans. Prepare essential personnel letters for use by employees who are stopped and questioned. Such letters should indicate that the employee is designated as an essential employee for the data center, that the data center needs to continue operations 24/7 to continue operating the essential business, and that the employee needs to travel back and forth from the data center to his or her home.

Generally, State shelter-in-place orders and federal guidance classify data centers as essential businesses and allow for essential employees and contractors to continue to travel to the data center to maintain operations. In the guidance from the US Department of Homeland Security’s Cybersecurity & Infrastructure Security Agency (CISA), data centers are included as part of the essential critical infrastructure workers during the COVID-19 response.² Many States and localities implementing shelter-in-place orders have used this guidance as a framework in designating businesses as exempt. Below is a summary of categories of businesses exempted under the various shelter-in-place orders in place. A category is bolded to indicate it likely includes data centers within that category. Even where a data center may be exempt, however, personnel at the data center should continue to comply with executive orders that require social distancing.

Employees infected with COVID-19 or who have to take time off work to care for their dependents may be entitled to pay depending on the terms of the employer’s paid leave policies. Effective April 2, 2020, until December 31, 2020, the Emergency Paid Sick Leave Act allows eligible employees under the FMLA to take up to 80 hours of paid sick leave related to COVID-19, including caring for an individual under COVID-19 quarantine or caring for the employee’s child if the child’s school or place of care is unavailable due to the public health emergency. The employee threshold for FMLA coverage has also increased from covering employers with 50 or more employees to instead covering employers with fewer than 500 employees.³

Guidelines are being updated rapidly and, as with all other businesses, data center operators should actively follow and act in response to up-to-date governmental advice.

____

[View source.]