The Autoriteit Persoonsgegevens (AP) has investigated two large companies that measure the temperature of their staff because of corona. The AP found that both companies, including a multinational, were violating the General Data Protection Regulation (AVG).
The AP's investigation shows that the two employers investigated are processing health data on their employees. That is not permitted in this case.
A body temperature is personal data if that temperature can be traced to a specific person. At both organizations, this is true. This is because the organizations can find out who has a normal or excessive temperature.
A body temperature says something about a person's health. Therefore, it is not only personal data, but also health data. And health data is special personal data, for which special rules apply.
It is usually illegal to process special personal data unless an exception from the law applies. One possible exception is if someone gives express consent.
One of the two companies asks workers' permission to take their temperature immediately prior to the measurement. Yet that permission does not apply.
Verdier explains, "People should be able to give consent freely. But employees will often feel pressured to give consent to their employer. Moreover, refusing consent should not have adverse consequences. At this company, employees who refused were not allowed in. As a result, temperature measurement in this way is therefore not allowed."
The AP has urged both organizations to improve matters. In some time, the AP will audit the organizations again to determine if the way temperatures are set has changed.
For more information on in what ways temperatures are and are not allowed, see file Temperatures during corona on the AP website.
