Data Protection when taking body temperature in times of COVID-19

The regulations on the protection of personal data, in its Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (RGPD), relating to the protection of individuals with regard to the processing of personal data and the free movement of these data and repealing Directive 95/46/EC contain safeguards and rules necessary to legitimately allow the processing of personal data in the current health emergency. The RGPD recognizes as an exceptional situation, an epidemic, the legal bases they grant legitimacy are: the public interest, the vital interest of the interested party and another natural person, and in compliance with a legal obligation that legitimizes the employer to process data of its workers. We must emphasize that we are dealing with data processing of health and this treatment is not enough if there is a legal basis, but rather some of the circumstances established in article 9.2 of the GDPR and in particular in paragraph b) must apply. The Spanish Data Protection Agency (AEPD) understands that processing is necessary for the fulfillment of obligations and for the exercise of the specific rights of the data controller, in the case of the employer or the interested party, in accordance with health and labor regulations and, in particular, for the prevention of occupational risks. For example, an assumption is when a worker must inform their employer in case of suspected contact with the virus, in order to safeguard, in addition to their own health, that of other workers in the workplace. The employer must process such data in accordance with the GDPR, and appropriate security measures and proactive responsibility required by the treatment must be adopted. Given the health emergency situation, it should be noted that the application of personal data protection regulations allows the person responsible for the treatment take those decisions that are necessary to safeguard the vital interests of the interested parties or in compliance with legal obligations within the measures established by the applicable legal regulations. For all these reasons, those responsible for the processing of personal data must follow the instructions issued by the competent health authorities of the different public administrations. Therefore, we could say that an entrepreneur can take the body temperature of his employees on the legal basis of compliance with a legal obligation, but the reality is that it is not that simple. As we have mentioned before, the employer can subject employees to a health check without the explicit consent required by this type of data processing, subject to compliance with a legal obligation, specifically in the cases provided for in article 22.1 of the Occupational Risk Prevention Act. But we must understand that the legal obligation is generic and when control measures are applied to employees it must be based on proportional, necessary and limited.For this reason, implementing thermographic cameras or individual temperature measurement equipment, for health authorities (World Health Organization) taking into account that they issue official criteria, either as a recommendation or legal obligation, they have reported that there is a percentage of asymptomatic infected people who do not have fever, that fever is not always one of the symptoms present in symptomatic patients, in particular in the early stages of the development of the disease, and that, on the other hand, there may be people who have high temperatures due to causes other than the coronavirus. For this reason, the AEPD in its communication indicates that measuring the temperature should be applied only in accordance with the criteria defined by the health authorities, both in terms of its utility and its proportionality, that is, to what extent this utility is sufficient to justify the sacrifice of rights what individual measures entail and to what extent these measures may or may not be replaced, with equal effectiveness, by other less intrusive ones. We must highlight that the AEPD in its published document of Frequently Asked Questions on COVID-19, specifically the question of whether Can security personnel take workers' temperatures in order to detect cases of coronavirus? I answered as follows, “Verifying whether the health status of workers may constitute a danger to themselves, to other personnel, or to other people related to the company constitutes a measure related to the monitoring of the health of workers that, in accordance with the Occupational Risk Prevention Act, is mandatory for the employer and should be carried out by health personnel” .The AEPD changes its criteria on temperature measurement since it will only be the ideal measure if it is effective and is necessary for the prevention of occupational hazards of employees derived from COVID-19, otherwise we would be faced with a illegal treatment. For this reason, we can point out that the employer may take all those necessary, effective and proportional measures under the legal basis of compliance with a legal obligation for Occupational Risk Prevention, but as long as these measures are effective and as the health authorities have published the temperature measurement, we could say that it is not an effective prevention and protection measure effective to identify that a person may be infected by COVID-19. From TOURISM & LAW we want to look after your interests, as always we do, in order to ensure that current regulations are complied with and the employer carries out all his actions in the most appropriate way, in order to avoid possible future sanctions. I always say “the worst management is the one that is not done” and in that, no businessman can afford not to do what he should do.

Guadalupe Tejela (T&L Attorney)