Data protection issues in dealing with pandemics

Data protection issues in dealing with the coronavirus

The current pandemic is forcing governments and companies to make quick and far-reaching decisions.

Given these rapid developments, we would like to update you once again on the latest developments in the Data protection Keep you up to date so that, as an employer, you can address any questions that arise regarding data protection implications without unnecessary delays.

The Federal Commissioner for Data Protection and Freedom of Information (BfDI) has now also commented on the issue of data processing in the context of the pandemic. From the BfDI’s perspective, the following data processing activities—including those carried out by Health data – the following are considered permissible measures to contain and combat the pandemic:

Survey and Processing personal data (including Health data) provided to employees by their employer or public employer to prevent or contain the spread of the virus among employees as effectively as possible. This includes, in particular, information about cases…

• in which an infection has been detected or contact with a demonstrably infected person has taken place.
• in which a stay in an area classified as a risk area by the Robert Koch Institute (RKI) took place during the relevant period.
• have stayed in an area classified as a risk area by the RKI during the relevant period.
• the collection and Processing personal data (including Health data) of guests and visitors, particularly to determine whether they themselves are infected or have been in contact with a person confirmed to be infected.
• By contrast, the disclosure of personal data regarding individuals who are confirmed to be infected or suspected of being infected, for the purpose of informing their close contacts, is lawful only if knowledge of their identity is, in exceptional cases, necessary for the close contacts to take precautionary measures.

Based on the information currently available to us, the legal situation in Germany in this matter is comparable to that in the USA. United States comparable. Our comments on this matter should therefore serve as a guide for Duty to inform and the corresponding options apply.

FAQ for Businesses

As a business, am I required to report a suspected case to the health authorities?

Answer: No. There are no reporting requirements for companies; they apply only to doctors and hospitals that diagnose an infection. This reporting requirement is stipulated in the Infection Protection Act. If you report a suspected case to the health authorities, this may, from a data protection perspective, constitute a disclosure of Health data without a legal basis. This would be a Infringement against the GDPRwhich is equipped with a Fine can be punished.

Even if you feel obligated to report your suspicions, please keep in mind that doctors and hospitals are already required to report such cases. Therefore, there is no compelling reason for you to take action as well.

Upon request from a public health authority, the following should be done: personal data about employees who are sick or who have been in high-risk areas. However, there is currently no requirement to report such cases. This may still change, though.

As a company, am I allowed to collect my employees' personal contact information in order to keep them informed about current developments?

Answer: The collection of personal contact information, such as cell phone or landline numbers or email addresses, is permitted and is justified by the company’s legitimate interest in the rapid dissemination of information related to the virus. This is intended to enable the employer to inform employees about the office closure and work-from-home directives, etc., without requiring them to visit the office first.

Please note, however, that the data collected for this specific purpose may not be used for any other purpose and must be deleted once the crisis is over or when it is no longer needed.

As a company, do I have to inform the workforce in the event of a suspected case?

Answer: An employer has a duty of care toward its employees. This may give rise to an obligation to inform the workforce about a suspected case. Please note, however, that disclosing that Colleague X may be infected with the virus constitutes a disclosure of Health data represents. This is without Consent of the possibly infected colleague is generally not permitted. You should therefore obtain written or electronic confirmation from the colleague concerned that you may also mention their name in a report to colleagues.

May I disclose the name of the potentially infected person to the staff even without Consent to the person?

Answer: This is possible only in extremely exceptional cases, when the employee is unable to do so—because he or she cannot be reached even after repeated attempts to contact him or her, or is no longer able to give consent—and the safety of the workforce cannot be ensured in any other way. As a rule, however, it will not be necessary to disclose the name of the potentially infected person to the workforce.

Such an exceptional case could exist, for example, if a colleague has been tested positive for infection but can no longer be contacted or is so seriously ill that communication is not possible. Due to the high probability of infecting other colleagues, every person who has had contact with the infected person must be tested as soon as possible. In this case, mentioning the name of the infected person even without their Consent permissible.

Regulatory authorities also consider a phased approach to be permissible. Thus, information about an infection should initially be provided on a department- or team-by-team basis without mentioning specific names.

If, in exceptional cases, this is not sufficient, the employer should contact the health authorities and request their decision. However, given the workload of the health authorities, this measure should be chosen with caution.

If it is not possible to obtain a response from the health authorities, the other employees may be informed, by name, of the suspected infection or illness of the specific employee in order to identify and contain sources of infection.

As a company, do I have to investigate the employee's contacts myself in the event of a suspected case?

Answer: No. If you have publicly announced the possibility of a viral infection within the company to protect the workforce, you have fulfilled your duty of care. A company is not required to collect additional data to identify potential contacts of the colleague who may be infected. Of course, you are free to implement appropriate preventive measures, such as instructing the workforce—to the extent possible—to refrain from business trips and in-person meetings with business partners and/or to work from home.

From the perspective of regulatory authorities, it is permissible to collect information about the people with whom an employee who is ill has had contact.

Can I ask my employees if they have contracted the virus?

Answer: Unless you are subject to a corresponding legal obligation, you may not ask this question in this form. Employers in the healthcare sector or the food service industry may be subject to such a legal obligation. In other professions, employees’ health is generally a private matter. If you were to ask about it specifically nonetheless, you would most likely be acting without a legal basis.

However, it would be permissible to ask where the employee has been in the last few days or weeks. Of course, the answer to this question alone does not allow for any direct conclusions about the employee’s state of health. However, if the employee has been in a high-risk area, you as the employer could take appropriate safety measures, such as placing the employee on leave until further notice or, if possible, having them work from home.

From the perspective of regulatory authorities as well, it is permissible to ask employees whether they have been in a high-risk area.

Do I have to notify business partners about a suspected case of the pandemic at my company?

Answer: Data protection law does not provide for a corresponding duty to disclose information. However, if there is a risk of infection, a duty to disclose information may arise from the general duty of care between contracting parties.

However, if you inform your business partners of a suspected case, please note that the name of the potentially infected person may only be mentioned with their consent. Consent is possible and must otherwise be omitted.

Do I need to create attendee lists at events so that I can provide them to health authorities if an infection is later detected?

Answer: There is no legal obligation to create such a list. However, you may provide the names you have collected to health authorities upon request in the public interest. If you intend to create such a list prior to an event, you must inform the participants as part of the Duty to inform according to Art. 13 GDPR that the data collected may be passed on to the health authorities in the event of infection with the virus.

May I share an existing list of participants with health authorities upon request?

Answer: A list of participants that was originally compiled for another purpose may be disclosed for a new purpose, namely contact tracing. The protection of the lives and health of those who may be affected takes precedence and permits such a change in purpose. Should this situation arise and you share the list, you must inform the individuals listed on it of this change. An email or a simple letter is sufficient for this purpose.

Do I have to answer the employer's question about a pandemic infection?

Answer: You are only required to answer such a question from your employer truthfully in cases where you or your employer are subject to a corresponding legal obligation. Such an obligation exists, for example, for healthcare professionals and those working in the food service industry. Unless you work in these industries or are aware of any other obligation to disclose your health status, you are not required to answer this question. If there is another obligation of which you were previously unaware, your employer will generally inform you of it during the interview.

In principle, therefore, it is entirely sufficient to notify the employer of an inability to work due to illness, as is typically done by submitting a sick note.

However, you are free to inform your employer of a possible infection with the virus in order to protect your coworkers and customers.

Do I have to tell my employer if I've been in an area with an outbreak?

Answer: Current German law does not require you to disclose this information. However, you are free to share this information with your employer in the interest of your colleagues and clients.

Different Approaches by European Countries

Italy

Only individuals working in the healthcare sector or in emergency response are permitted to request information about the health status of affected individuals. However, employees suspected of being infected are required to notify their employer and public health authorities.

Given the critical situation we find ourselves in, employers should take the following measures:

Facilitating communication between healthcare professionals and staff (e.g., providing information about a central number that can be called)

Please advise people who have traveled to high-risk countries to notify health authorities

Notifying health authorities of suspected infections at the company

Source: garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9282117

United Kingdom

The data protection situation is comparable to that in Italy. The British government has also published very comprehensive guidelines on how to handle such situations.

Only registered healthcare professionals may collect health or medical data. Therefore, the employer cannot Health data from employees. If there is any suspicion that an employee has been infected with the virus, company management must notify Public Health England (PHE), which will then advise on the appropriate measures.

The authorities are not yet recommending the closure of offices, etc., but they do recommend the following measures:

People who have traveled to high-risk areas are advised to monitor their own health

Public Health England (PHE) must be informed if it is suspected that the infection is being spread within the company

Source: gov.uk/government/publications/guidance-for-social-or-community-care-and-residential-settings-on-covid-19/guidance-for-social-or-community-care-and-residential-settings-on-covid-19

France

As expected, employers in France can also take general measures, such as issuing health guidelines to all employees and reminding them of the government’s recommendation to notify their employer if they return from one of these high-risk areas. Aside from that, according to French Regulatory Authority The CNIL refrains from collecting information related to the search for possible symptoms in a systematic and general manner or in response to individual requests.

It is recommended that employees inform their employers before returning to work if they have returned from one of these high-risk areas. However, employers do not have the right to ask employees whether they have vacationed in one of these high-risk areas.

If an employer is aware that an employee is returning from one of the high-risk areas, the employer should, as part of its health and safety obligations, (Article L.4121-1 of the Labor Code), to work from home or to reconfigure their workspace in a way that minimizes the risk of infection.

If the employer cannot adapt the employee's workspace to limit contact, and if working from home is not compatible with the employee's job, the employer may ask the employee to stay home.

As in the other two countries, an employee must notify their employer if they suspect they have been exposed to the virus. If a risk is confirmed, the employee in question—or, if that is not possible, the employer—must call the emergency medical service (SAMU). In this case, the employer may record the date and the identity of the person who may have been exposed to the virus in order to provide the health authorities, upon their request, with the information regarding the nature of the exposure that is necessary for the health or medical care of the person who may be ill.

The employer should contact the company's occupational health physician to discuss how best to implement the government's recommendations regarding the protection of other employees.

Source:

gouvernement.fr/info-coronavirus https://www.cnil.fr/fr/coronavirus-covid-19-les-rappels-de-la-cnil-sur-la-collecte-de-donnees-personnelles https://travail-emploi.gouv.fr/actualites/l-actualite-du-ministere/coronavirus-questions-reponses-entreprises- salaries

Although we believe the information contained in this document is accurate, it is general legal and business information that is not tailored to the facts of your situation.  It does not constitute legal advice. To obtain legal advice tailored to your needs, please consult an attorney licensed to practice law in your country.