Poland: Personal data protection amid #coronavirus

The response to the COVID-19 outbreak has infiltrated nearly every aspect of daily life. Polish laws have not been immune to the epidemic’s impact either, with the government recently announcing a draft of the so-called Anti-Crisis Shield designed to amend a number of acts in order to support businesses. Amid the fight against the coronavirus, in the statement of 12 March, the President of the Personal Data Protection Office (UODO) declared that the personal data protection regulations must not stand in the way of the coronavirus response. Read the article below to learn more about the protection of personal data in the face of the coronavirus epidemic.

GDPR still applie

There is no doubt that data protection should be no barrier to managing the coronavirus spread, however, one must bear in mind that all personal data protection regulations, including GDPR (and administrative fines), still apply, regardless of how difficult and unprecedented the current situation is. The statement issued by UODO’s President was meant as guidance only and it does not change the fact that personal data requirements must still be complied with.

However, there are still no specific regulations for business who worry about the legal processing of personal data in managing issues concerned with the coronavirus.

Are employers allowed to take a worker’s temperature?

There has been growing concern over whether employers are allowed to take the temperature of a worker or a person not employed thereby and, if so, what rules should they follow.

Body temperature data represent data concerning health – one of special categories of person data the processing of which is prohibited, in accordance with Article 9(1) of GDPR. Data concerning health may be processed only in cases specified in Article 9(2) of GDPR.

Without going into theoretical detail, we believe that personal data may be processed in connection with body temperature measurement in the case of both employees and other persons so long as the below rules are followed.

Taking an employee’s temperature

We believe that the legal basis for the measurement of a worker’s temperature is Article 9(2)(b) of GDPR, stating that the processing of the personal data is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorized by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject. The relevant obligation of the employer in the field of employment law is provided for in Article 207 of the Labor Code.

It should also be noted that the draft bill on amending the act on emergency solutions designed to prevent, counteract and combat COVID-19, other infectious diseases and emergency situations caused thereby, and amending selected other acts, dated March 13, 2020, includes Articles 3a, which provides that:
“in order to counter the spread of COVID-19, the employer has the right to:
1) request an employee to confirm whether or not he/she has recently been to a region affected by COVID-19;
2) request an employee to undergo the necessary medical examinations where there is a reasonable belief that he/she is infected with COVID-19 or has recently been to a region affected by COVID-19; medical examinations represent health care services as defined in Article 9;
3) screen an employee for symptoms of COVID-19 before allowing him/her to work, especially through body temperature measurement;
4) introduce additional workplace sanitary regulations or occupational health and safety regulations;
5) request an employee to go to a regional affected by COVID-19 only when necessary and with the employee’s consent, in accordance with Article 3a.”

The above-quoted provision would be a valuable addition to the Polish labor law as it would settle all the doubts surrounding temperature measurement by employers.

Taking a non-employee’s temperature

In our opinion, employers are allowed to measure the temperature of a person not employed by them on the basis of such person’s explicit and freely-given consent, in accordance with Article 9(2)(a) of GDPR. Written form of the consent is not required.

As far as body temperature measurement is concerned, we see a growing popularity of thermal imaging cameras, which may be used without the need to process personal data.

Whatever the method of processing, you should remember about fulfilling the obligations in the field of personal data processing resulting from GDPR, especially the obligation to provide relevant information to the person whose data are processed.

In case you have any questions, do not hesitate to contact us.