COVID-19 | To screen, or not to screen, that is the question
Many employers, feeling responsible for the health of their employees, contractors and customers, have taken the voluntary initiative to prevent the spread of coronavirus in their workplaces.
One of the first dilemmas that have emerged in the context of the fight against COVID-19 is whether employers can perform temperature screenings for both their employees and other persons entering their workplace.
There is heated discussion among lawyers on this subject. On the one hand, it would be common sense to approve preventive temperature checks. Indeed, the only purpose of such checks (which, after all, involve additional organisational complications for the employer), is to ensure safe working conditions and prevent epidemics.
On the other hand, information on body temperature concerns the private health condition of a person and as such is treated as sensitive data, subject to special protection under data protection legislation.
It is difficult to unequivocally resolve this dilemma, especially bearing in mind that data protection authorities have so far displayed a negative attitude towards intrusive personal sobriety monitoring of employees.
In this situation, a clear position of the Personal Data Protection Office (UODO) could prove very valuable.
In response to numerous (according to the statement of 12 March 2020) queries, the President of UODO stated that “personal data protection regulations may not be an obstacle to taking effective coronavirus control measures” (https://uodo.gov.pl/pl/138/1456).
If this sentence was the end of the matter, employers could feel relieved. However, a more in-depth analysis of the statement by UODO shows the dilemma has not been ultimately resolved.
So, what is the precise meaning of the President of UODO’s declaration?
The President of UODO has stated that:
- the issues of processing health data arising from actions to prevent COVID-19 spread are regulated by special legislation, including, in particular, the so-called special law (*);
- the legislation in question does not conflict with data processing rules and is without prejudice to the GDPR;
- the legislation in question (including the special law) provides solutions for employers to take specific action, resulting from the recommendations of both the Chief Sanitary Inspector and the Prime Minister;
- Article 17 of the special law provides that the Chief Sanitary Inspector or the state provincial sanitary inspector acting under his authority, may issue i.a. decisions requiring employers to take specific preventive or control measures andto cooperate with other public authorities and the National Sanitary Inspectorate bodies;
- with regard to action to be taken by employers, one should firstly keep up to date with the announcements of the National Sanitary Inspectorate;
- the Prime Minister, at the request of a provincial governor, after notifying the minister competent for economy matters, has the right to issue instructions for employers regarding COVID-19 control. Such instructions, issued in the form of an administrative decision, are to be immediately executed upon delivery or announcement and do not require justification;
- these provisions are in line with the GDPR, which also provides for situations relating to the protection of health and prevention of the spread of contagious diseases (letter i) of Article 9(2) and letter d) of Article 6(1));
- in accordance with recital 46 of the GDPR, the processing of personal data should also be regarded to be lawful where it is necessary to protect an interest which is essential for the life of the data subject, for instance when processing is necessary for humanitarian purposes, including for monitoring epidemics and their spread.
Finally, in his statement, the President of the UODO reiterates that any problems related to the control and prevention of coronavirus spread should, in the light of the above-mentioned rules, be reported to the Chief Sanitary Inspector as a matter of priority and asks all those interested in the details of coronavirus control actions to “address their queries to the Chief Sanitary Inspector being the competent authority in this matter”.
What is the conclusion?
The statement of the President of UODO seems to confirm an obvious fact, i.e., that the provisions of the special law allowing the relevant services to take, or order to be taken, actions to prevent the spread of COVID-19, are not in conflict with the protection of personal data.
However, this statement does not answer the key question of employers, namely whether they can, without waiting for an order to be issued by the relevant services acting on the basis of the special law, carry out temperature screening of their staff and all those entering the workplace.
Moreover, the position of the President of UODO can be seen as a suggestion that employers should follow the instructions and guidelines of the relevant authorities, including the Chief Sanitary Inspector, and comply with decisions obligating them to take certain preventive actions (e.g. body temperature screening), whilst not independently taking any preventive actions without any explicit order.
How can this dilemma be resolved?
In this situation, all we can do is to call upon the services competent under the special law to issue precise guidelines for employers, in particular with regard to temperature screening. This would be the easiest way to resolve the dilemma of whether or not an employer can perform temperature screenings, which as the moment is still open to question.
An employer without knowledge of the potential exposure of employees to coronavirus cannot take effective actions. Therefore, the dilemmas of recent days relate to whether the law allows the gathering of necessary information about the state of health not only of employees, but also of those people visiting workplaces. Is it possible to change the organization of work due to the threat of coronavirus? In its communication published on February 26, 2020, the National Labor Inspectorate presents a rather conservative position. On the part of the Personal Data Protection Office, there is no guidance on the interpretation of personal data protection regulations to date. Meanwhile, the situation is developing dynamically and there are increasing questions from employers and employees, which, hopefully, will be answered soon by the public institutions.
*Act on Special Arrangements for the Prevention, Control and Management of COVID‑19, Other Infectious Diseases and the Resulting Emergencies, dated 2 March 2020.