The exponential spread of COVID-19 has forced governments and employers to take strict measures to prevent the spread of the virus. Among other things, governments are tracking infection rates as well as their citizens' compliance with specific measures. At the same time, employers have to strike a balance between their duty of care and keeping their business running. This BK Briefing sets out certain measures taken by the Swiss government and employers, describes the implications these measures have on data protection and provides guidelines on how to handle the current situation in a data protection compliant manner.
Measures taken by the government and employers due to COVID-19
In order to prevent and contain the spread of COVID-19, protect so-called "risk-groups" and ensure that Switzerland retains its capacity to manage the pandemic, the Swiss government has, among others, introduced the following measures:
- Prohibition of gatherings of more than five people in public areas.
- Hospitals have a duty to report the number of patients who have COVID-19 and are in the care of the hospital.
Furthermore, the government generally recommends that persons do not leave their homes unless they need to visit the doctor, need to buy groceries, need to go to the pharmacy or to help someone else and they should only go to work if working from home is not an option.
Employers are walking a fine line between their duty of care on the one side, and their employees' duty of loyalty, and keeping their businesses running on the other side. Certain employers have implemented, in particular, the following measures:
- Medical checks of their employees, e.g. temperature checking.
- Installation of thermographic cameras.
- Placing a duty on employees to report a COVID-19 infection or any contact with an infected person.
General data protection implications
The imposed measures all entail various privacy implications that must be considered – even during a pandemic.
To protect public health, public and private institutions are processing individuals' health data to identify persons who are sick, may be sick or who are suspected of infecting others. Therefore, more health data is being processed than usual and shared with
the government or other third parties. Health data is considered sensitive personal data under data protection law, and individuals must at least be informed of the processing at the point of collection of their health data. Consent may even be needed for certain processing activities, i.e. the sharing of the data with third parties.
Implications of government measures
To ensure that people are not gathering in groups of more than five people, Swisscom has a duty to report certain location data to the government. Given the capabilities of big data analytics, even aggregated and anonymized location data may qualify as personal data. Therefore, in certain cases, such disclosures may interfere with the privacy of persons if the necessary security measures are not in place to ensure that the data remains anonymized.
According to applicable data protection law, federal government authorities may only process personal data if they have a statutory duty or right to do so. In the current situation, the government as well as private persons (such as Swisscom or employers) are relying on the Federal Act on the Protection against Infectious Diseases ("Epidemics Act"), the protection of public health and the state of emergency ("polizeiliche Generalklausel") to justify the measures they are taking.
Implications for employees' personal data
Within the employment relationship, certain measures may be justifiable to comply with the employer's duty of care. Employees must abide by certain standards due to their duty of loyalty and the employer's right to direct and instruct. However, employers may only process personal data of employees insofar as such data is necessary for the performance of the employment contract. Within this context, the general data protection rules apply.
- Due to the employers' duty of care towards their employees, employers may impose medical checks on employees, such as the taking of temperatures or the installation of thermographic cameras. Such measures must always be executed as carefully and proportionately as possible and it must be ensured that only the least invasive measures that lead to the required results are implemented, e.g. choosing temperature checks over installing thermographic cameras, taking of the temperature in a protected area or by allowing employees to take their temperature themselves etc. However, this must be assessed on a case-bycase basis.
- The employees' duty to disclose a COVID-19 infection or any contact with an infected person to the employer can be in line with employment law, due to the employer's duty of care, i.e. the duty to protect the health of employees who may have been in contact with that person or who belong to a so-called "risk group".
Even during a pandemic, privacy laws apply and personal data should be processed in compliance with applicable data protection law. This means the following guidelines should be followed when taking and executing the above-mentioned measures:
- Only personal data that is necessary to contain and prevent the spread of COVID-19 may be processed, and the processing must always be kept to the minimum necessary to fulfill the defined purpose. Therefore, only health data related to the virus may be processed when testing persons, e.g. temperature may be taken but not a full health check-up, and must only be processed if considered necessary to protect the health of others. In the context of an employment relationship, it is advisable that whenever possible, appropriate data on flu symptoms such as fever should be collected and passed on by the affected employees themselves.
- As far as possible, information collected should be shared in an aggregated and anonymized form. For example, Swisscom generally only shares aggregated and anonymized data with the government, and employers should record and store health data such as the employees' temperature on a pass or fail basis and, whenever possible, keep that data anonymized.
- Health data is considered sensitive personal data. Employers may not process health data of their employees against their will as it is, in general, not strictly necessary for the performance of their contract, unless the employer has an overriding interest or a duty to protect other employees.
- Health data may only be shared with third parties if the person has consented to the sharing or if an overriding private or public interest, such as public health, safety, or a legal obligation requires the sharing of the data.
- If a person's personal data is going to be shared with third parties, they must be transparently informed about this. For example:
- It is recommended that hospitals or telecommunication providers inform individuals of their duty to share the anonymized COVID-19 test results or location data with the government;
- Employers must inform their employees that if an employee opts to be tested for COVID-19, the employer may share the results, if possible, on an anonymized basis or subject to the infected employee's consent, with other persons for their safety.
- Personal data should only be accessed or shared on a strict need-to-know basis. Therefore, if a person has been tested for COVID-19 and that person reports this to his or her employer, the employer must not share this information throughout the entire company. Employers should ensure that such data is only shared with the persons that may actually be affected by the virus or with those overseeing the process within the company, e.g. Human Resources. Government authorities may only share personal data based on a statutory right or duty to do so, e.g. the Epidemics Act.
- Personal data should only be stored for as long as necessary to fulfil the purpose it was collected for. Personal data on persons that have or had COVID-19 should be immediately deleted, especially by employers, once this pandemic is over, unless a statutory storage duty applies.
In conclusion, data protection law also applies during a pandemic. Certain justification reasons can be raised such as the state of emergency and the protection of public health, to process personal data anyway. However, this is not advisable as it can lead to mistrust towards the government or the employer.
However, data protection and employment law do not prohibit the measures taken by the government or an employer to prevent and contain the spread of COVID-19 as long as they comply with the general data protection principles and the guidelines provided above.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.