Commercial corona test for employees; a godsend?

We are now several weeks into the second corona wave. Despite the fact that this second wave was expected and the number of infections is rapidly increasing, the testing policy is still not in order. Whereas people in Germany can be tested quickly and have the results within 24 hours, people with complaints here in the Netherlands sometimes have to wait days before they can be tested. Also, the results then usually take some time to come in. This is why commercial tests are becoming popular with employers. This is to prevent employees from sitting at home for days on end - with pay. This seems like a nice solution, but is this allowed given the applicable privacy laws?

Privacy Rules

The Personal Data Authority (AP) has a strict policy on enforcement and interpretation of the General Data Protection Regulation (GDPR). The AP keeps letting employers know what is not allowed, but fails (in my opinion) to think with employers in this time of crisis and clearly let them know what is allowed. I have written several blogs about this already.

The problem with employers performing commercial testing is, potentially health data (is the employee infected with the coronavirus or not) may be processed by the employer. Stricter rules apply to the processing of health data. Health data are therefore referred to as special personal data in the AVG. In principle, an employer is not allowed to process special personal data of employees. The processing of special personal data is therefore subject to a general prohibition. There are a number of (legal) exceptions to this general prohibition, but these unfortunately offer little or no guidance in these corona times.

Measuring temperature vs. commercial corona test

Meanwhile, the AP has at least somewhat abandoned the strict approach to measuring employees' temperatures. In principle, if the measured temperatures are not recorded, the AVG does not apply. This also follows from the AVG itself; after all, the AVG (simply put) only applies insofar as personal data are processed. If it only involves reading the temperature on a thermometer, without (the intention of) storing (passing on, registering) this measurement data and without automatic processing (gates opening, green light), the AVG does not apply. Consider the situation where your employees, visitors or customers have the possibility (N.B. so not an obligation) to measure or read their own temperature.

Because the AP has taken this position, you could possibly draw a parallel with facilitating commercial corona testing. However, then, as with measuring temperatures, this must be done on a voluntary basis and the results of the tests must not be captured, recorded, transmitted or otherwise processed in any way. Indeed, as long as that data is not processed, the AVG does not apply.

In practice, however, this will not be so simple. This is because when an employer offers employees the opportunity to take a commercial coronary test, the employees will have to ask for it with the result that the employer will become aware of and process medical data (e.g., the complaints from which the employee suffers). In addition, an employee will quickly feel that he must then let the employer know what the results of the test were. Moreover, as an employer, you want to know if an employee is infected in order to take measures. Consider quarantining people with whom the employee has been in contact or requiring a test when an employee has symptoms. The latter is not actually allowed, but is desirable to prevent more infections.

Consideration

For employers, it is necessary to make a trade-off between full compliance with privacy laws on the one hand and preventing health hazards in the workplace on the other. Are the (mandatory) tests really necessary and can't you ensure a safe and healthy workplace by other means?

If there really is no other way, then as an employer you should (dare to) make the decision to facilitate (and in some cases require) commercial testing. Especially when a large proportion of employees cannot work from home and interact with others while working. For employers in that situation, it is desirable - and the employees are probably only happy to do so - to protect other employees, customers or third parties from possible contamination, to contribute to the containment of the spread of corona and to reduce their own risks (e.g., the risk of 14 days of mandatory closure of the company due to insufficient measures or a large amount of contamination).

I do note, however, that with the advent of the corona rapid test and the rollout of seven rapid test lanes, the question is whether commercial corona testing still provides sufficient benefit. That remains to be seen.

Do you prefer personal advice? Feel free to call us or send us an e-mail. We are happy to be at your service!