Corona vs. workplace privacy

In recent days, I have been getting a lot of questions from employers about what data they are allowed to process from employees regarding coronavirus. May I note employees' symptoms? May I check the temperature of employees? May I note that an employee is in the risk group (and obese, for example)?

In most cases, the answer to those questions is "no. Nicer I cannot - unfortunately - make it. Another question is whether it is really necessary to process all that health data on your employees. Often, as an employer, you can refer to the LCI guideline - which lists the symptoms of coronavirus - and prohibit employees from showing up at work if they have any of those symptoms. I also suspect that (when checking the temperature) you are already too late when an employee has a fever and besides, some don't even get a fever. Then again, I'm not a doctor but a lawyer. Shoemaker, stick to your last. Therefore, below some more explanation of the privacy rules we face in the corona situation.

Legal framework

The applicable privacy rules are set forth in the General Data Protection Regulation (hereinafter "AVG"). The AVG provides that personal data may only be processed in accordance with predetermined purposes - and to the extent necessary. In doing so, it must also be checked whether there is a legal basis for the processing. In the absence of such a basis, consent must in principle be sought from the data subject.

The latter, however, is tricky in the relationship between an employer and a (future) employee. After all, the starting point is that, given the power relationship with the employer, an employee can never give freely given consent to the employer. In addition, stricter rules apply when processing health data. Health data are therefore designated as special personal data in the AVG. In principle, an employer is not allowed to process employees' special personal data. In fact, the processing of special personal data is subject to a general prohibition due to its sensitive nature. There are a number of exceptions to this general prohibition, as formulated in the AVG and in the UAVG General Data Protection Regulation ("UAVG").

Ban on processing health data; what exceptions are there?

The AVG provides that European Union law or the law of a member state may provide for an exception to the prohibition of processing special personal data in the areas of employment and social security law. These exceptions may be located in sector-specific legislation or in the UAVG.

The UAVG has a number of exceptions to the ban on processing health data. For example, health data may be processed by employers for the purpose of claims that depend on the employee's state of health. Think of the right to sickness benefits. There is also an exception when an employer processes an employee's health data for the purpose of reintegrating the employee. Such as the provision of (disability-related) employment services.

However, it is, in my opinion, difficult to argue that the processing of health data in the context of the coronavirus can be classified under the aforementioned exceptions. In principle, such processing is not carried out for the purpose of reintegrating the employee, nor for the employee or employer to claim benefits or other provision.

Another possibility is to invoke sector-specific legislation and, in particular, the Working Conditions Act (here: "Arbowet"). Indeed, under the Working Conditions Act, the employer is obliged to ensure a safe working environment and to take appropriate (preventive) measures to that end. This is in conjunction with articles 7:658 and 7:611 of the Dutch Civil Code (hereafter: 'BW') which relate to the (civil) duty of care of the employer in a general sense. However, according to the Personal Data Authority ("AP"), these provisions are not specific enough in other cases. Indeed, in the case of alcohol and drug testing, according to the AP, there must be a specific law defining the conditions under which alcohol and drug testing may be carried out. Perhaps the same parallel can be drawn with the current coronavirus: the Occupational Health and Safety Act does not specifically provide for such a situation."[1]

Resume

Since consent in the relationship between the employer and the employee does not really go and Article 30 UAVG does not allow for processing health data of employees because of the coronavirus, I see the Occupational Health and Safety Act, in conjunction with the Civil Code, as the only possible basis. Of course subject to the comments I have made in this regard. So basically it is not allowed and I do not recommend processing employee health data. Especially since in most cases less far-reaching options are at hand. Such as properly instructing employees, taking extra hygiene measures and refusing employees if they have the known symptoms.

If, as an employer, you nevertheless make use of the Occupational Health and Safety Act/BW basis, then you do run the risk that the AP (given its strict interpretation of the AVG/UAVG) judges that there is a violation of the AVG. As a result, the AP may impose (high) fines.

If you, as an employer, make this consideration, it is in any case wise to have a sound policy regarding the processing of (corona)health data, making a clear distinction between the different functions within the organization and in which functions health data must necessarily be processed (because of safety in the workplace). Appropriate safeguards can be put in place by having the temperature checks carried out by an occupational physician, for example. After all, an occupational physician has confidentiality and will carefully process the information obtained through the tests. Moreover, a company doctor will only share the necessary data with an employer, such as to what extent there is an elevation or fever. As a result, as an employer, you do not process employees' health data yourself. The above, of course, in connection with the required consent of the Works Council with the policy regarding the processing of (corona)health data and the prior inventory and minimization of privacy risks (DPIA).

Want to know more or consult about what makes sense for you? Please feel free to contact me. I am at your service.

Stay up to date on legal implications of coronavirus?

• Go to pvdb.co.uk/corona
• Follow us on LinkedIn

[1] A second stumbling block to the processing of health data under the Occupational Health & Safety Act and the BW is the lack of clarity about the direct effect of article 9 paragraph 2 under b AVG - which provision thus offers the possibility to get out of the ban on processing special personal data. If this provision does indeed have no direct effect, then, for the time being, the Working Conditions Act and the BW cannot be invoked for being able to process health data by employers outside the exceptions mentioned in Article 30 UAVG.