10/03/2020. Professionals wonder about the possibilities of collecting and using, outside of any medical care, data about their employees/agents, or even about external persons (visitors, customers, suppliers, etc.) , to determine whether they have certain symptoms of coronavirus, have probably been exposed to it or have moved to a risk area. Since the collection of personal data, including health-related data, may fall into the private domain, the CNPD wishes to recall some rules in this context.
A stakeholder may, as part of its health and safety obligations, record:
– The date and identity of the person suspected of having been exposed
– The organisational measures taken (containment measures, teleworking, contact with the occupational health service, etc.)
In this way, the actors will be able to communicate to the health authorities, at their request, the elements related to the nature of the exposure, necessary for the possible medical or medical treatment of the exposed person.
If private and public actors can implement measures to limit the spread of the virus (e.g. limit movement or observe hygiene measures), such measures should take into account respect for the privacy of affected persons.
Actors should refrain from systematically and widely collecting, or through individual consultations and requests, information related to the search for possible symptoms presented by an employee/outside person and his/her family members.
For example, actors should refrain from:
– Requiring their employees to give a daily statement about their body temperature or to fill out pre-established medical sheets or questionnaires.
– Have visitors or other outsiders sign a pre-established statement certifying that they have no symptoms of coronavirus or have not recently traveled to a risk area, etc.
For confidentiality purposes, any data processing carried out in the context of preventing the spread of the virus must be carried out in such a way as to ensure data security, in particular with regard to health data. Therefore, the identity of the persons concerned should not be disclosed to third parties or their colleagues without clear justification.