Covid-19: Data protection of employee health information

Sarah Taïeb, Data Protection Officer at UGI International – a leading gas suppliers in Europe – shares her analysis on privacy protection during this global health crisis.
This interview was originally published on www.mazars.fr

Can companies make it mandatory to screen employee temperatures?

Several countries have concluded that screening employee temperatures is not permitted, despite the Covid-19 pandemic, such as France, Luxemburg, Sweden, the Netherlands and Hungary. The European Data Protection Board (EDPB) has advised that companies should consult existing employment, health, and safety laws for further guidance, although it does suggest that temperature checks without subsequent analysis of the results does not breach GDPR.

One alternative to temperature screening could be to place non-contact thermometers at the entrance of a company’s premises, thus, allowing employees to check that they do not have a fever before going into work.

Can information about a sick employee be shared with colleagues and for what purpose?

Most regulatory bodies allow employers to inform their employees of a confirmed Covid-19 case in order to adopt protective measures for colleagues who may have been exposed. However, to the fullest extent possible, only the necessary preventive information should be divulged, and when possible the name of the employee or any other identifying information should not be disclosed "so as not to infringe on the individual’s dignity".

Can companies question their suppliers or visitors about their risk of being in close proximity to a person diagnosed with Covid-19 or about the possibility that they have gone to an at-risk area?

Regulatory bodies are divided on this point. If we look at examples in Europe, some countries believe this type of questioning to be excessive and unnecessary, such as Belgium, France and Luxemburg. A larger majority (UK, Denmark, Hungary to cite a few) have adopted a more flexible approach and authorise this practice, which is usually based on relevant local legal obligations. Nevertheless, these inquiries should not include questions about the individual’s health history and should not require supporting medical documentation.

Are the response times imposed by GDPR affected by Covid-19 (information requests on personal data, for example)?

Regulators remain silent on this matter, but are expected to be flexible with companies that receive requests from people concerning their personal information, whilst still managing the Covid-19

pandemic. Some regulatory bodies have stated that, in certain cases, corporate resources can divert from usual compliance protocol. Other regulators have emphasised that, although statutory deadlines cannot be extended, companies are to inform the persons concerned that they may experience delays regarding their rights to information requests.

Obviously, companies should be able to justify that their lack of resources is due to the current pandemic, and not merely an excuse.

What are the obligations for employees?

In some countries, employees are required to notify their employers if they have Covid-19. In Europe, this is the case in Italy, France, Hungary and Denmark, but other regions around the world have also required such disclosures. Other countries have encouraged companies to deploy specific communication channels linked to this type of information.

What has been the strategy for UGI International? Do you have any advice for DPOs?

Despite the exceptional circumstances due to the Covid-19 pandemic, data protection obligations continue to apply. At UGI, we are fully aware of this, especially since the amount of sensitive data that the group can hold on its employees is likely to increase, and that remote work presents new challenges in itself in terms of information security. As the global situation is in constant evolution due to Covid-19, new developments and recommendations issued by regulatory bodies will continually emerge. Therefore, it is essential that DPOs keep themselves informed of the latest legislative measures so that they can best advise data controllers and their teams.