Protocol dated 14/03/2020 for companies
The obligation imposed on the worker to report to the employer the possible presence of symptoms indicative of the possible contagion from Coronavirus corresponds to the right of the employer - provided for in the shared protocol regulating measures to combat and contain the spread of the Covid virus- 19 in the workplace on March 14, 2020 - to subject staff to body temperature checks before entering the workplace.
Upon the outcome of this check, workers whose temperature should be higher than 37.5 degrees will be prevented from accessing the company and they will be provided with masks and sent to their own doctor to follow their instructions.
From a privacy point of view, the body temperature of the worker represents a personal data relating to his health, and consequently its detection is a treatment operation which, as such, requires the performance of specific requirements, also reported in the Protocol:
1) The employer must define the appropriate security and organizational measures to protect data according to privacy by design methods pursuant to art. 25 of the Regulation.
It is necessary that, even in the emergency context and compatibly with the urgency that has arisen, the company has an internal procedure suitable for dealing with the epidemic in compliance with the rights of the interested parties.
In fact, in planning the collection of information on staff body temperature, the employer must:
identify the subjects responsible for detecting the temperature by authorizing them specifically and providing them with the operating instructions to be respected for the protection of the information they collect;
provide that the temperature is recorded only if the threshold is exceeded, to document the reasons that prevented access to the company premises.
2) The employer must provide each worker with specific information pursuant to art. 13 of EU Regulation 679/2016, also orally, omitting the information that the worker is already in possession of, that is, those already present in the privacy information provided to him at the time of hiring or updated during the employment relationship.
The information to which the Protocol refers is therefore specific for the processing of data which consists in detecting the staff temperature for the purpose of containing the Coronavirus and to this limited operation.
Finally, the Protocol establishes that the confidentiality of information relating to the possible contagion from Coronavirus must be ensured not only in the event of temporary removal due to the temperature threshold being exceeded, but also:
in the event that the worker notifies the personnel department of having had contacts, outside the company context, with subjects who have tested positive for COVID-19
in the case of removal of the worker who develops fever and symptoms of respiratory infection during work, and his colleagues.
Account should also be taken of the principle of data minimization, according to which it is appropriate to collect only the necessary, adequate and relevant data with respect to the prevention of contagion from COVID-19.
In detail, the employer who requests the worker to declare if he has had contacts with people who tested positive for Coronavirus, must not request additional information regarding the person tested positive. In the same way, the employer who requests a declaration on origin from areas at epidemiological risk, must refrain from requesting further information about the specific place in question.