Practical solutions for Employers
Under Order no. 874/81/2020 on compulsory wearing of a protective mask, on conducting epidemiological screening and compulsory disinfection of the hands in order to prevent contamination with the SARS-CoV-2 virus during the state of alert („The Screening Order”), employers must conduct epidemiological screening by measuring body temperature and observing respiratory symptoms.
Article 4 paragraph 1 of the General Data Protection Regulation („GDPR”), „personal data” refers to „any information relating to an identified or identifiable natural person”. Based on this definition and the criteria set in Opinion 4/2007 on the concept of personal data issued by the Article 29 Working Party, someone’s body temperature is arguably information relating to a natural person if ‒ in conjunction with other information ‒ it can lead to distinguishing that person from others.
This means that a situation where data on body temperature results from conducting epidemiological screening and potential respiratory symptoms are being registered and outlined so that a connection between those data and an individual’s identity can be established ‒ could raise concerns as to observance of the GDPR in terms of personal data processing.
Without going into specifics related to these matters and in order to (i) avoid GDPR-related issues, (ii) avoid the time-consuming operation of keeping a ledger containing information on employees’ and visitors’ body temperature and, at the same time, to take into consideration (iii) the usefulness of procuring even a shred of evidence in case of an inspection by the authorities, a conceivable solution could be to write out a daily report stating that epidemiological screening was conducted as required by the Screening Order, without indicating the name, body temperature or symptoms of employees/visitors who have undergone epidemiological screening. However, in regard to visitors, the Screening Order requires the office/room/department which they intend to head to be registered in the report. In the event that certain employees have a body temperature higher than 37.3oC, it is advisable to state in the report that a certain number of employees, without identifying them, were refered to a general practitioner.