Employees Data Protection with respect to COVID-19

Employees Data Protection with respect to COVID-19 in the context of the public health emergency raises many questions.

The Spanish Data Protection Agency is clarifying how compliance with data protection regulations on the processing of personal data relating to health should be.

Employees Data Protection with respect to COVID-19

Here are some of the questions and answers that the Agency itself is providing.

Can companies deal with the information of whether their workers are infected by the coronavirus?

In application of what is established in the health and labour regulations and, in particular, in the prevention of occupational risks, employers may process, with the guarantees that they establish, the personnel data necessary to guarantee their health and adopt the necessary measures by the competent authorities.

This also includes ensuring the right to health protection of the rest of the personnel and avoiding contagion within the company and/or work centres.

The company may know whether the worker is infected or not. To design through its prevention service the necessary contingency plans. Or those that have been foreseen by the health authorities.

This information can also be obtained by asking the staff.

However, the questions should be limited exclusively to inquiring about the existence of symptoms. They should also ask whether the worker has been diagnosed as contagious or subject to quarantine.

Extensive and detailed health questionnaires cannot be carried out. Or that include questions not related to the disease.

Can you pass this information on to the company’s staff?

No. This information should be provided without identifying the person concerned in order to maintain their privacy. However, it could be transmitted at the request of the competent authorities, in particular health authorities.

This means that it is possible to disclose the existence of an infection, but without specifying the identity of the infected person.

Identifying information could, however, be provided in the event that partial information could not be used to protect the health of staff. Or, if such a practice is discouraged by the competent authorities.

Can employees and visitors from outside the company be asked for data on countries they have visited before, or if they have symptoms related to coronavirus?

As employers have a legal obligation to protect the health of workers and to keep the workplace free of health risks, a request for such information would be justified. Both employees and external visitors about symptoms or risk factors without the need to ask for their explicit consent (RGPD and LPRL). Regardless of whether the competent authorities, in particular the health authorities, establish these measures for a public health issue and communicate them to the workplaces,

The information that can be requested should be in accordance with the principle of proportionality. It should be limited to enquiries about visits to countries with a high prevalence of the virus and the incubation period of the disease. The last 2 weeks, or if you have any of the symptoms of the disease.

Is it possible to treat workers’ health data related to coronavirus?

In order to comply with decisions on the coronavirus pandemic taken by competent authorities, in particular health authorities, data protection regulations should not be used to hinder or limit the effectiveness of measures taken by these authorities, in the fight against the pandemic.

Data protection rules allow the adoption of measures that are necessary to safeguard the vital interests of natural persons. The essential public interest in the field of health The performance of medical diagnoses, or the fulfilment of legal obligations in the field of employment. Including the processing of health data without the need for the explicit consent of the person concerned.

In any case, the processing of these data must observe the principles established in the RGPD, in particular those of minimisation, purpose limitation and minimization of storage.

In the event of preventive quarantine or being affected by the coronavirus, is the worker obliged to inform his employer of this circumstance?

Yes, they must inform their employer and the prevention service or, where appropriate, the prevention delegates (LPRL)

The worker on sick leave is not obliged to inform the company of the reason for the leave, however, this individual right may be given up in favour of the defence of other rights such as the right to the protection of the health of the collective of workers in situations of pandemics and, more generally, the defence of the health of the entire population.

Can security personnel take the temperature of workers in order to detect cases of coronavirus?

Yes, according to the LPRL, it is mandatory for the employer and should be carried out by health personnel.

Please note that it is mandatory to check whether the health status of workers may constitute a danger to themselves. For the rest of the staff, or for other people related to the company.

In any case, the processing of the data obtained from the temperature measurements must respect the data protection regulations. Therefore, and among other obligations, it must obey the specific purpose of containing the spread of the coronavirus. And it must be limited to that purpose and not extended to other purposes. Keeping no more than the time necessary for the purpose for which they are collected

If you need help with the implementation of the Occupational Risk Prevention plans, do not hesitate to contact the experts of our Labour Consulting Dept.