Data protection issues in dealing with pandemics

Data protection issues in dealing with the coronavirus

The current pandemic is forcing governments and companies to make quick and far-reaching decisions.

Due to this rapid development, we want to keep you up to date with the latest developments in data protection so that you, as an employer, can answer any questions that may arise with data protection implications without unnecessary delay.

The Federal Commissioner for Data Protection and Freedom of Information (BfDI) has now also commented on the issue of data processing in the context of the pandemic. In the view of the BfDI, the following data processing - including health data - should be considered permissible in order to contain and combat the pandemic:

Collection and processing of personal data (including health data) of employees by the employer or principal in order to prevent or contain the spread of the virus among employees in the best possible way. This includes, in particular, information on cases...

• in which an infection has been detected or contact with a demonstrably infected person has taken place.
• in which a stay in an area classified as a risk area by the Robert Koch Institute (RKI) took place during the relevant period.
• have stayed in an area classified as a risk area by the RKI during the relevant period.
• the collection and processing of personal data (including health data) of guests and visitors, in particular to determine whether they themselves are infected or have been in contact with a demonstrably infected person.
• in contrast, the disclosure of personal data of persons who are demonstrably infected or suspected of being infected in order to inform contact persons is only lawful if knowledge of the identity is exceptionally necessary for the precautionary measures of the contact persons.

Based on the information currently available to us, the legal situation in Germany in this matter is comparable to that in the USA. United States comparable. Our comments in this regard should therefore apply accordingly to disclosure and information obligations and options.

FAQ for companies

As a company, do I have to report a suspected case to the health authorities?

Answer: No. There are no reporting obligations for companies, but only for doctors and hospitals that detect an infection. This reporting obligation is laid down in the Infection Protection Act. If you report a suspected case to the health authorities, this may constitute a disclosure of health data without a legal basis from a data protection perspective. This would be a breach of the GDPR, which can be punished with a fine.

Even if you feel obliged to report the suspicion, please bear in mind that doctors and hospitals are already obliged to report it. There is therefore no compelling reason for you to take action as well.

At the request of a health authority, personal data on employees who have fallen ill or who have spent time in risk areas should be passed on. However, there is not yet an obligation to report. However, this may change in the future.

As a company, am I allowed to collect my employees' private contact details in order to inform them about current developments?

Answer: The collection of private contact data such as cell phone / landline number or e-mail address is permissible and covered by the company's legitimate interest in the rapid dissemination of information in the context of the virus. This should enable the employer to inform employees about the closure of the office and instructions to work from home etc. without them having to visit the office first.

Please note, however, that the data collected for this specific purpose may not be used for other purposes and must be deleted after the end of the crisis or when it is no longer required.

As a company, do I have to inform the workforce in the event of a suspected case?

Answer: The employer has a duty of care towards its own employees. This may result in an obligation to inform the workforce about a suspected case. However, please bear in mind that the information that colleague X may be infected with the virus constitutes a disclosure of health data. This is generally not permitted without the consent of the potentially infected colleague. You should therefore obtain written or electronic confirmation from the colleague concerned that you may also mention their name in a report to colleagues.

Am I allowed to pass on the name of the potentially infected person to the staff without the person's consent?

Answer: This is only possible in absolutely exceptional cases if the employee is unable to do so because he/she cannot be contacted even after repeated attempts at contact or can no longer give consent, and the protection of the workforce cannot be ensured in any other way. As a rule, however, it will not be necessary to disclose the name of the potentially infected person to the workforce.

Such an exceptional case could exist, for example, if a colleague has been tested positive for infection but is no longer available or is so seriously ill that communication is not possible. Due to the high probability of infecting other colleagues, every person who has had contact with the infected person must be tested as soon as possible. In this case, mentioning the name of the infected person would also be permissible without their consent.

The supervisory authorities also consider a staggered approach to be permissible. For example, information about an infection should initially be provided on a departmental/team basis without naming specific names.

If this is not sufficient in exceptional cases, the employer should contact the health authorities and request their decision. However, due to the workload of the health authorities, this measure should be chosen with caution.

If it is not possible to obtain a response from the health authorities, the other employees may be informed of the suspected infection or illness of the specific employee by name in order to localize and contain sources of infection.

As a company, do I have to investigate the employee's contacts myself in the event of a suspected case?

Answer: No. If you have publicized the possibility of a virus infection in the company to protect the workforce, you have fulfilled your duty of care. A company does not have to collect further data in order to identify possible contacts of the potentially infected colleague. However, you are of course free to take appropriate preventive measures, such as instructing staff - as far as possible - to avoid business trips and face-to-face meetings with business partners and/or to work from home.

From the point of view of the supervisory authorities, it is permissible to collect information about the persons with whom a sick employee has had contact.

Can I ask my employees if they have contracted the virus?

Answer: Unless you are subject to a corresponding legal obligation, you may not ask this question in this form. Employers in the healthcare or catering sectors may be subject to a corresponding legal obligation. In other professions, the health of employees is generally a private matter. If you do ask about this specifically, you are very likely acting without legal permission.

However, it would be permissible to ask where the employee has been in the last few days or weeks. Of course, the answer to this question in itself does not allow any direct conclusions to be drawn about the employee's state of health. However, as an employer, you could take appropriate safety measures if the employee is in a risk area, such as releasing them from work until further notice or transferring them to a home office if possible.

From the perspective of the supervisory authorities, it is also permissible to ask employees whether they have been in a risk area.

Do I have to inform business partners about a suspected pandemic case in my company?

Answer: Data protection does not provide for a corresponding duty to inform. However, if there is a risk of infection, an obligation to provide information may arise from the general duty of care between contractual partners.

However, if you inform your business partners about a suspected case, please note that the name of the potentially infected person may only be mentioned with their consent and must otherwise be omitted.

Do I have to create lists of participants at events in order to be able to give this list to the health authorities if an infection is detected later?

Answer: There is no legal obligation to compile such a list. However, you can hand over the collected names to the health authorities on request to protect the public interest. If you already intend to compile such a list before an event, you must inform the participants as part of the information obligations under Art. 13 GDPR that the data collected may be passed on to the health authorities in the event of infection with the virus.

May I pass on an existing list of participants to the health authorities on request?

Answer: A list of participants that has already been compiled for another purpose can be published for a new purpose, namely contact tracing. The protection of life and health of the persons possibly affected prevails and allows a corresponding change of purpose. If this is the case and you pass on the list, you must inform the persons on this list. An e-mail or simple letter is sufficient.

Do I have to answer the employer's question about a pandemic infection?

Answer: You only have to answer such a question from your employer truthfully in cases where you or your employer are subject to a corresponding legal obligation. Such an obligation exists, for example, for members of the health professions and in the catering industry. If you are not employed in these sectors and are not aware of any other obligation to disclose your state of health, you do not have to answer this question. If there is another obligation of which you were previously unaware, your employer will usually inform you of this as part of the interview.

In principle, it is therefore perfectly sufficient to inform the employer of an inability to work due to illness, as is usually done by means of a sick note.

However, you are free to inform your employer of a possible infection with the virus to protect your colleagues and customers.

Do I have to inform my employer if I have been in an infected area?

Answer: The legislation in Germany does not currently require you to disclose this information. However, you are free to pass this information on to your employer in the interests of colleagues and customers.

Individual handling of European countries

Italy

Only persons working in the health sector or in civil protection may request information on the health status of affected persons. However, employees who are suspected of being infected are obliged to inform their employer and the health services.

In the critical situation in which we find ourselves, the employer should take the following measures:

Facilitate communication between healthcare staff and employees (e.g. information via a central number that can be called)

Advise people who have traveled to high-risk countries to inform the health services

Informing the health authorities about suspected infections in the company

Source: garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9282117

Great Britain

The data protection situation is comparable to that in Italy. The British government has also published very comprehensive guidelines on how to behave in such situations.

Only registered medical practitioners can collect health/medical data. Therefore, employers cannot collect health data from employees. If it is suspected that an employee has contracted the virus, management must inform Public Health England (PHE) who will then advise on the appropriate action to take.

The authorities are not yet recommending the closure of offices etc., but they do recommend the following measures:

People who have traveled to the risk areas are advised to monitor their own health situation

Public Health England (PHE) must be informed if it is suspected that the infection is being spread within the company

Source: gov.uk/government/publications/guidance-for-social-or-community-care-and-residential-settings-on-covid-19/guidance-for-social-or-community-care-and-residential-settings-on-covid-19

France

As expected, the employer can also take general measures in France, such as issuing health instructions to all employees and reminding them of the government's recommendation to inform the employer if the employee returns from one of these risk areas. Apart from that, according to the CNIL, employers should refrain from collecting information related to the search for possible symptoms in a systematic and general way or on the basis of individual requests.

It is recommended that the employee informs their coworker before returning to work if they are returning from one of these risk areas. However, the employer does not have the right to ask an employee whether they have been on vacation in one of these risk areas.

If the employer is aware that an employee is returning from one of the risk areas, he should advise this employee to work from home as part of his health and safety obligations (Article L.4121-1 Code du travail) or to rearrange his workplace in such a way as to limit the risk of infection.

If the employer cannot adapt the employee's workplace to limit contact and if working from home is incompatible with the job, the employer can ask the employee to stay at home.

As in the other two countries, employees must inform their employer if they suspect they have come into contact with the virus. In the event of an identified risk, the employee concerned or, if this is not possible, the employer must call the emergency medical service (SAMU). In this case, the employer may record the date and identity of the person who may have been exposed to the virus in order to be able to provide the health authorities, at their request, with the information on the nature of the exposure that is necessary to provide health or medical care to the person who may have fallen ill.

The employer should contact the company's occupational health physician to discuss how best to implement the government's recommendations regarding the protection of other employees.

Source:

gouvernement.fr/info-coronavirus https://www.cnil.fr/fr/coronavirus-covid-19-les-rappels-de-la-cnil-sur-la-collecte-de-donnees-personnelles https://travail-emploi.gouv.fr/actualites/l-actualite-du-ministere/coronavirus-questions-reponses-entreprises- salaries

Although we believe the information contained in this document is accurate, it is general legal and business information and is not tailored to the facts of your situation. It does not constitute legal advice. To obtain legal advice that meets your needs, please contact an attorney licensed to practice law in your jurisdiction.