May sensitive personal data, such as medical data, of employees who are (potentially) infected with Corona be used? We will briefly list the most important principles that currently apply in the Netherlands.
May sensitive personal data, such as medical data, of employees who are (potentially) infected with Corona be used?
Also during the Corona crisis the dilemma of the General Data Protection Regulation is evident. On the one hand, the AVG was not designed to create obstacles in the fight against the virus. On the other hand, the AVG does seem to do so in practice. In principle, the AVG prohibits the processing of data relating to health, among other things. Does this complicate the guidance of employees and hinder rapid intervention by employers to prevent further spread of the virus in the workplace?
The European Data Protection Board, the European privacy supervisor, emphasised in a recent statement that the AVG provides foundations for employers to be allowed to process data about Corona infections in the context of combating a pandemic. According to the EDPB, employers can rely on the performance of a task in the area of public health or the protection of vital interests.
However, the Dutch privacy supervisor, the Autoriteit Persoonsgegevens, has a very strict view on the use of health data in an employer-employee relationship. Employers may not ask the employee for the reason for his sickness report, nor may company doctors in principle share health data about the nature of the employee’s illness with the employer.
How can the EDPB’s statement be reconciled with the strict opinion of the Dutch privacy supervisor? Although the EDPB seems to leave the door ajar for the restrictive processing of health data in connection with Corona, it lacks a concrete translation into (Dutch) practice.
Below we will therefore briefly list the most important principles that currently apply in the Netherlands.
As an employer, are you allowed to check for Corona?
Also in the context of the Corona crisis, the Dutch privacy supervisor maintains for the time being, and in general, the position that the employer may not check the employee for Corona, and may not (even) ask him whether he has Corona.
As a Dutch employer, what are you allowed to do?
Although the privacy rules are still strict, the employer does have some other (limited) resources at its disposal that can be used to limit the consequences of Corona on the work floor as much as possible.
For example, the employer is allowed to:
- Send home an employee with a cold or flu symptoms, even in case of doubt, or to indicate that he should not come to work;
- Ask the employee to keep an eye on his health and, if necessary, temperature himself (also during work);
- In case of health problems, insist that the worker contacts the company doctor at an early stage;
- Ask the company doctor to have the employee checked (by the municipal health service) for Corona.
Exception for special categories of employers?
For care workers in hospitals and nursing home institutions, however, deviating measures now apply when they contribute to ensuring care for patients and older and vulnerable persons. For these sectors, the Dutch government already allows for more extensive control of employees on Corona. In addition, the testing policy has recently been broadened. Employees in care for the disabled, home care, youth care and the mental healthcare can also be tested.
These measures are in line with the aforementioned statement of the EDPB and are in line with the GDPR, as it stipulates that in the interest of the safety and quality of care, the vital interests of vulnerable others and the management of the institutions concerned, the processing of health data by the employer is permitted.
At this stage, the Dutch privacy supervisor does not comment on exceptional situations.
What to do if the employer knows that an employee is infected?
In the context of both the duty of care as an employer and in the public interest, you may report to the other employees that an employee has been infected, as long as you do not tell them who that employee is.
What does all this mean in practice?
Although the employer’s ability to process health data is still limited, except in exceptional situations, he does have some means at his disposal to limit Corona related risks in the workplace. For example, the employee may be required to carry out active self-monitoring and the employer may exclude the employee from the workplace if only on (possible) suspicion of Corona.
In addition, however, the company doctor continues to play an important role. It is therefore recommended that employees be advised to consult the company doctor themselves in the case of minor health complaints alone. Furthermore, the employer can ask the company doctor to periodically (by telephone) monitor the state of health of healthy employees, and ask him to monitor sick employees for Corona symptoms and, if necessary, have them tested. In this way, a suspicion or confirmation of a Corona infection can be identified as quickly as possible and the risk of further spread on the work floor can be limited.
Incidentally, the government’s Corona measures are still being developed. We will therefore monitor the privacy related changes for the employer and continue to share them with you.
