The Coronavirus raises privacy-related questions for many employers. Can employees be forced to undergo (medical) examination by, for example, scanning for fever "at the gate"? Can you talk to employees about symptoms they are experiencing? May infections be recorded?
Author: Marjoleine van Leerdam
The AVG states that the digital or paper documentation (processing) of employee health data is prohibited, unless there is an exception (art. 9 AVG) and a basis (art. 6 AVG). Furthermore, if there is an exception, the processing must meet the requirements of proportionality and subsidiarity. In other words, the processing must be effective for the purpose to be achieved.
One of the exceptions is that employers may process health data if this is necessary for the performance of legal obligations in the field of employment law. Consider, for example, the obligation to continue to pay wages during illness. Employers need to know whether an employee is ill (= health data) in order to fulfill this obligation. However, employers may not register more than the fact that the employee is sick. The processing of further information about the nature of the illness is reserved for the company doctor. Thus, this exception must be interpreted in a limited way.
The question on the minds of many employers is whether preventing the further spread of the Coronavirus can be considered an exceptional situation. After all, this would make it possible to record information about health complaints and possible infections and (instinctively) keep a better grip on the situation.
The Personal Data Authority (AP), the Dutch privacy watchdog, is critical on this point. In response to questions about the Corona virus, the AP indicates that special personal data may only be processed by employers in "very exceptional cases. From this it can be deduced that, according to the AP, the legal duty of employers to ensure a safe working environment does not extend to the extent that employers may process all kinds of health data in the event of a virus outbreak. Moreover, there are often (better) and more proportionate alternatives available. Examples include taking hygiene measures and calling in the company doctor earlier.
The AVG (as well as the prohibition) does not apply if the health data is not documented or if there is no personal data at all. In other words, the AVG per se does not prohibit verbal discussion of symptoms of illness or documentation of health data that cannot be traced back to a specific person.
While at first glance this would seem to leave room for asking employees about symptoms of illness outside of the AVG and perhaps even checking "at the gate" for fever, however, that fly does not quite fly.
Even if the AVG does not apply, it is still true that the employee has a right to privacy and that an employer may not simply infringe on this right. Employers are expected to process (privacy) sensitive information only if the employer's interest in doing so outweighs the employee's general fundamental right to privacy and if it is necessary (effective) to achieve the intended purpose.
As the number of infections in the Netherlands mounts, employers are increasing the urge to collect information from employees about possible symptoms of illness. For example, employees of chemical company DSM are having their temperature measured upon entry, and energy supplier Engie has asked dozens of employees to work at home because one of their colleagues may be infected with the Corona virus.
In order not to violate the employee's right to privacy, the advice is to at least consider the following concerns when taking such measures:
- Checking for fever
According to the AP, the AVG prohibits taking the temperature of employees using, for example, fever scanners. Employees may therefore refuse the scan, according to the AP.
While there are ways to think of ways to check for fever outside the rules of the AVG (think, for example, of deploying external "checkers" who have no ability to identify employees and are instructed to send employees home, without further processing the test results), taking fever readings does not, for the time being, appear to be sufficiently effective on its own to justify the invasion of employee privacy.
Tip: Consider alternatives such as allowing employees who have recently been to high-risk areas to work at home and/or encourage employees to contact the local GGD, family or occupational physician when experiencing any symptoms.
- Talking about symptoms of illness
Employers may talk to employees about symptoms of illness. This is not prohibited under the AVG. However, this information may not be recorded digitally or included in personnel files, for example. Nor can employees be required to provide such information.
Tip: realize that a conversation about disease symptoms is very (privacy) sensitive, try to avoid and limit it.
- Register infections
In principle, keeping a list of (potentially) infected employees is not permitted. This involves the processing of health data to which the prohibition in the AVG applies.
Tip: Are employees infected with Corona virus? If so, weigh carefully whether maintaining a list of infections is necessary to ensure a safe work environment. It is likely that the Occupational Safety and Health Administration can be called in to handle the health records, and the Occupational Safety and Health Administration can provide the employer with the necessary, non-medical, information.
- Informing colleagues about an infected colleague
Sharing health information among themselves ("Ms. Jansen is infected with the Corona virus") also falls under the prohibition from the AVG. Sharing this information is not permitted. However, it is possible to indicate in general terms and without disclosing which person is concerned, that there is an increased risk that, for example, requires new measures to be taken. If an employee self-discloses health information or asks the employer to share information about his or her health with colleagues, this does not violate the AVG. However, this information must be prevented from being stored (digitally).
Tip: Keep in mind that communications about possible infections do not release details from which the identity of the potentially affected person can be deduced.
Source: TeekensKarstens attorneys notaries
This article can also be found in the Coronavirus dossier
