COVID-19 and health data protection

 

1. THE EMPLOYER MAY NOT, IN PRINCIPLE, COLLECT HEALTH DATA RELATING TO COVID-19

In principle, the employer may not take measures likely to infringe on the privacy of its employees, in particular by collecting health data or information relating to the search for possible symptoms (art. 9 of the GDPR and art. 6 of the Data Protection Act).

In this regard, the National Commission for Data Protection and Liberties (CNIL-France) has just specified, in its recommendations on Covid-19 published on March 6, 2020, that it is impossible for the employer to implement, for example:

  • body temperature readings of its employees;
  • the collection of medical information via forms or questionnaires.

These bans also apply to visitors.

2. THE COLLECTION OF HEALTH DATA BY THE EMPLOYER REMAINS HOWEVER POSSIBLE IN THE FOLLOWING CASES

     a) When the data are voluntarily provided by the employee

As the person responsible for the health and safety of its employees (art. L. 4121-1 of the Labour Code), the employer may raise awareness among its employees and invite them to communicate, if necessary via dedicated communication channels, personal information related to possible exposure to Covid-19. In this case, it is recommended that the employer collects the express consent of the employee, in order to legitimize the collection of his health data (Art. 9.2 (a) of the GDPR).

In any event, insofar as it is the employee’s responsibility to safeguard the health and safety of others and of himself in the workplace (art. L. 4122-1 of the Labour Code), the employee is required to inform his employer spontaneously in the event of suspicion of contact with Covid-19.

The processing of this information must then be limited to the sole management of suspected exposure to the virus.

     b) When collection is requested by the health authorities

If health authorities were to request the collection of employees’ health data from employers, those could then base the lawfulness of their collection on “processing necessary on grounds of public interest in the field of public health, such as protection against serious cross-border threats to health” (cf. art. 9.2, i of the GDPR and its recitals 46 and 52).

3. RECOMMENDATIONS

In the event of a report of possible exposure to Covid-19 by an employee, it is recommended to the employer:

  • to record (1.) the data provided by the employee (such as the date of exposure to Covid-19 or the identity of the person suspected of having been exposed) as well as (2.) the organisational measures taken (e.g. containment, teleworking, contact with occupational medicine specialist);
  • to store such data for a period not exceeding the duration of the purpose for which they are processed (Article 5 of the RGPD);
  • to amend the Employee Privacy Policy accordingly;
  • to take into account this treatment in the Treatment Registry ;
  • to adopt all measures to ensure appropriate security of such health data.

Our last newsletters

Russian counter measures. Recent developments ( 12 january 2023 update)

Governmental Commission on Foreign Investments revised rules on the sale of assets and the payment of dividends On 30 December 2022, Russian Governmental Subcommission of the Commission of the Ministry of Finance on Foreign Investments (the – Commission) published revised rules and criteria for authorization of the sale of assets in Russian companies involving persons […]

Moscow Desk

+

Sanctions against Russia. Recent Developments (21 December 2022 update)

This December, the EU introduced a series of restrictive measures targeting Russia. Council of the EU approved the ninth package of sanctions. Additionally, the European Commission proposed framework that would amend the Lisbon Treaty and harmonize criminalization of violation of sanctions at the level of the Union. Finally, the EU introduced a price cap for […]

Moscow Desk

+

Russian counter measures. Recent developments (21 December 2022 update)

Russia has adopted a series of new measures. Namely, the President introduced new restrictions concerning certain transactions involving credit organizations and joint-stock companies that are not credit organizations. The Russian Central Bank issued decision expanding the scope of application of type C accounts. Moreover, the Ministry of Finance issued clarifications on the scope of transactions […]

Moscow Desk

+

Sanctions against Russia : recent developments (18 October updates)

EU Adopts New Package of Sanctions Targeting Russia On 6 October 2022 Council of the European Union adopted an eighth package of sanctions targeting Russia following the recent actions attempted by the Russian Government as part of the special military operation in Ukraine. Besides the extension of the personal sanctions list, EU introduced the following […]

+

Russian counter measures. Recent developments (29 september 2022 update)

Procedure for the Approval of Transactions with Shares in a Russian LLC Adopted On 19 September 2022 Russian Government introduced amendments establishing a procedure for approval of transactions involving shares in Russian limited liability companies. Such transactions are considered as controlled operations and are to be approved by the Governmental Commission for the Control of […]

Moscow Desk

+

Sanctions against russia. Recent revelopments (13 september update)

CONTROL OF TRANSACTIONS WITH SHARES IN AN LLC On 8 September 2022, Russian President issued Decree No. 618 “On Special Procedure for Execution of Certain Transactions (Operations)” (the “Decree”). The decree provides for new rules, specifically for transactions involving transfer of shares in Russian LLCs as well as transactions involving Russian banks under sanctions.  We […]

Moscow Desk

+

Russian counter measures. Recent Developments (19 August 2022 update)

Russia has adopted a series of new measures. Namely, the President introduced new restrictions concerning transactions with shares in certain Russian companies. The Government added new jurisdictions to the list of unfriendly states. At the same time, the Russian Central Bank suspended some of its previously adopted restrictions. For more information on sanctions targeting Russia, […]

Moscow Desk

+

Sanctions against Russia. Recent Developments (9 August update)

On 21 July 2022, Council of the EU adopted a seventh package of sanctions targeting Russia. The new package establishes new bans and exemptions for sectoral sanctions. It also targets new persons and entities, including Sberbank. Additionally, the US expanded their individual sanctions. Below is an overview of the latest sanctions. For more information on […]

Moscow Desk

+

Russian counter measures : recent developments (update July 12, 2022)

Russia has adopted a series of new measures. Namely, the President and the Government introduced new measures that mainly facilitate operations involving foreign currency. Laws on legalization of parallel importation and on additional powers of the President became effective. Certain legal initiatives were rejected or put on hold. Specifically, the review of the draft law […]

Paris, Moscow Desk

+

Sanctions against Russia. Recent developments.

On 22 February 2022 Russian President Vladimir Putin signed laws ratifying agreements with the Donetsk and Luhansk People’s Republics (DNR and LNR) recognizing them as independent states. On 24 February 2022 President Putin announced a “special military operation” in Ukraine. Sanctions were adopted against Russia further to these actions of Russia (please see our previous […]

Moscow Desk

+