The new FAQ of the Italian Data Protection Authority (hereinafter, the “Authority”) were published on 6 May 2020 on its website, containing information on the correct processing of personal data strictly related to the spread of the new Covid-19 virus (“Coronavirus “), supplemented on the following 14 May.
Recording of temperature
With specific reference to the occupational context, the Authority provides important clarifications on the employer’s ability to record the body temperature of employees, customers, suppliers or occasional visitors at the entrance of company premises or offices, preventing persons from access who have a temperature exceeding 37.5 °, as provided for by applicable law.
According to the Authority, the possibility of recording body temperature is provided for by the joint “Safety Protocol” (hereinafter, the “Protocol “) of the Social Partners and the Government, signed on 14 March 2020 and updated on the following 24 April.
Given that the recording of an identified person’s body temperature constitutes the processing of personal data, the Authority clarifies how the employer can record and register an excessive body temperature only where it proves necessary to document the reasons why an employee has been prevented from accessing the workplace.
It is not necessary to record the body temperature data of customers, suppliers or occasional visitors as it is not necessary, in relation to these persons, to document the reasons for any refusal of access. This clarification is provided in view of the “data minimisation principle” envisaged by Article 5.1 c) of Regulation (EU) 2016/679 (the “GDPR “) according to which “personal data must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed“.
Serological testing in the workplace
On 14 May 2020 the Authority supplemented the previously communicated FAQs in order to clarify whether an employer can carry out serological tests on its employees directly.
More specifically, it clarifies that only the company doctor or other health professional (i) can provide for serological tests to be carried out on employees, or (ii) can provide for the adoption of diagnostic tools if considered useful in order to limit the spread of the virus, while following instructions and guidelines issued from time to time by the competent health authorities, also in relation to the appropriateness and reliability of the instruments indicated. These provisions also apply to medical checks carried out in order to assess whether a worker should be allowed to return to his/her job duties after e.g. a prolonged absence due to illness.
According to the Authority, this follows from the specific wording of paragraph 12 of the Protocol (“12-Health surveillance/Company Doctor/Workers’ Safety Representative (RLS)“), emphasising the importance of health surveillance, which must be arranged not only in strict observance of the health and hygiene measures contained in directions handed down by the Minister of Health and by the competent authorities, but also by ensuring that information and training are provided to workers by the company doctor, in order to prevent the spread of infection.
If the company doctor is in a position to carry out those tests, he may communicate to the employer no more than his opinion as to whether or not the worker concerned is fit for work or otherwise.
The Authority emphasises that the employer
- is not entitled to process, in any manner, information and data pertaining to the diagnosis or medical history of the worker which derive, for instance, from having consulted the reports or the results of tests that the worker was required to take
- may, however, receive information about any limitations or restrictions determined by the company doctor for particular workers who are deemed fit for their job duties but are potentially at high risk of contagion.
Subject to the foregoing, the FAQs in question clarify that workers can sign up to special screening campaigns initiated and promoted by the competent health authorities, also through the employer where the latter has been directly involved by the local prevention department in promoting those campaigns, also by agreeing to cover the associated economic costs incurred by its own employees.
The Authority considers, in any case, that the company doctor, the employer and the Workers’ Safety Representative (RLS) or Territorial Workers’ Safety Representative (RLST) should – in the collaborative effort to adopt all regulatory measures required in order to contain the spread of Covid 19 – pay particular attention to applicable rules, to the guidelines and directions of the competent Authorities, and also to ensuring full compliance with personal data protection rules, guaranteeing the adoption of methods and instruments that can safeguard the confidentiality and dignity of data subjects concerned.
Other related insights:
