COVID-19: Guidance for Employers in Finland

At the time of writing, there are no mandatory obligations for employers that relate specifically to COVID-19. However, employers should ensure that they are taking necessary steps to protect their employees and their obligations arising from related legislation (e.g. Occupational Safety and Health Act 738/2002) must carefully be observed. All employers have health and safety obligations towards their employees in addition to an extensive duty of care. Employers should keep employees informed about health risks that may arise when carrying out their duties and ensure that working practices do not create undue risks to employees. Following the COVID-19 pandemic, employers should pay particular attention to the relevant measures in order to fulfil work safety obligations and to protect the personnel. In practice, the required measures will depend on various factors such as the industry, sector and/or field of business where the employer is operating, and as such, case-by-case assessments should occur. Similarly, situational assessments and evaluations (in addition to any possible adjustments) should also be made when returning to the workplace during, and following, the COVID-19 pandemic.

As such, employers should carry out ongoing risk assessments and consider any factors that may make employees particularly susceptible to infection. Employers should also consider circulating up-to-date information on good hygiene practices and provide any necessary equipment to facilitate this, such as hand sanitisers. For example, we recommend issuing a reminder on the actions that employees can take to help stop viruses such as COVID-19 spreading. Such advice may include:

• maintain a physical distance of 1–2 meters from other people whenever possible;
  
  
• cover your mouth and nose with a tissue or your sleeve (not your hands) when you cough or sneeze;

• put used tissues in the bin immediately;
  
  
• wash your hands with soap and water often – use hand sanitiser gel if soap and water are not available; and
  
  
• try to avoid close contact with people who are unwell.

We further recommend notifying employees where they can access more information if they are concerned, such as from the Finnish Institute for Health and Welfare and the national COVID-19 telephone service. 

Can employers request or require information from an employee about potential or actual exposure to the virus?

The question of whether an employee can be asked to sign a declaration about where they have been and/or their exposure to the virus, or be required to provide information to an employer in order for the employer to provide confirmation to a customer sits firmly in the crossover between data privacy and employment.

Any such data must be processed in line with the applicable privacy requirements. Information about an employee's health (such as whether the individual has been diagnosed with the virus or is suffering from any symptoms) falls within the scope of special categories of personal data under Article 9 of the GDPR and accordingly additional requirements and obligations apply to the processing of such data. Despite the GDPR being EU-wide legislation, the position is complex from a European data privacy perspective. Employers will find that the type and extent of the information they can compliantly process, and the legal basis for doing so, varies from country to country.

Finland’s legislation permits the processing of personal data for the purpose of treating and preventing serious infectious diseases, such as COVID-19. However, Finnish employment law is very strict when it comes to the possibility of employers processing employees' personal data, especially health data. The Act on Privacy in Working Life also allows processing of employees' personal data only if it directly necessary for the employment relationship (the "necessity requirement"), and no exceptions can be made to this requirement, even with the employee’s consent. Article 9 (2)(b) of the GDPR enables employers to process health data in order to carry out the obligations and exercise the specific rights of the controller or data subject in the field of national employment law. Under the Finnish Occupational Safety and Health Act, employers are required to take care of the safety and health of their employees by taking the necessary measures. Complying with occupational safety obligations can thus be considered a valid legal basis for processing health data under the GDPR and directly 'necessary' under the Act on Privacy in Working Life. However, there are several additional aspects to consider.

• In Finland employees cannot be obliged to share their health information with their employer for preventive reasons, unless prescribed in sector specific legislation. As such, it is advisable for employers to introduce COVID-19 precautions on a voluntary basis wherever possible. For instance, it is a good practice to publish guidelines on measures to take when a COVID-19 infection is suspected.
  
  
• If employees experience symptoms of COVID-19, they can also be advised to consult an occupational health care professional. The occupational health care professionals shall evaluate whether absence from work is required.
  
  
• Publicly revealing information relating to an employee's health in the workplace is prohibited. However, based on the information received from occupational health services the employer may inform other employees of the infection or potential infection in general terms, and assess whether workplace safety requires issuing wider instructions, for example, to work from home or to cancel meetings and seminars.
  
  
• Unlike health information, information on an employee's whereabouts and, thus potential exposure to COVID-19 does not necessarily fall within the scope of special categories of personal data. Processing information about employees' travels and contacts with people who have travelled in certain areas can be justified in light of the necessity requirement. Employers may also recommend the use of a contact tracing mobile app (the Koronavilkku app, produced by the Finnish health authorities) which enables employees to obtain up-to-date information on their possible exposure to infection. Additionally, general information on whether an employee has been quarantined is not classified as health data unless it includes specific health-related reasons for the quarantine.
  
  
• In any operations involving employee personal data, it is paramount to only collect and process data which is necessary for ensuring a safe working environment. For instance, it is seldom necessary to process detailed information on employees' relatives and friends or even travel locations. The same outcome can often be reached by processing more generic data and "yes or no" answers (including, for example, "Have you travelled in epidemic areas as classified by the Finnish authorities (list)?", and, "Have you been in contact with anyone who has recently travelled in these areas").
  
  
• When it comes to processing employee health data or other personal data connected to COVID-19 precautions, it is also important to:

o only store the data for a limited period of time

o only allow access to a limited number of people

o only allow access to health data for people who are authorized through their job description; and

o protect the data with adequate security measures

Employers may also face situations where a customer/client requires travel or health information relating to their employees when visiting the customer/client's site.

• Where this applies, the employer should as a starting point seek to provide generic reassurance to the client / customer.
  
  
• If this does not suffice, employers should consider whether there are grounds for the employer to provide certain information to the third party. Employers could also consider advising employees that they can provide information to third parties, if requested and if they are happy to do so.
  
  
• Unless there is a clear legal obligation on the employer to do so, (which may exist in sector specific laws), employee consent is likely to be the only applicable legal basis for sharing such information with third parties. To be valid, consent must be freely given.
  
  
• Employers must not oblige employees to provide this information to third parties and should consider carefully what, if any, further action to take if the employee refuses to do so. There is a risk that where the employer requires employees to attend client sites, any employee consent to the provision of information in order to access those sites would not be freely-given and would therefore not be valid.

Further to the above, the position regarding European data privacy rules and how they impact information relating to COVID-19 is developing. The European Data Protection Board adopted a statement on the processing of personal data in the context of the COVID-19 outbreak on 19 March 2020 and the Finnish Data Protection Ombudsman has issued general information on the situation (see here). A number of EU governments have issued further guidance and more still are considering whether emergency legislation may be required, particularly if the situation escalates. The position will need to be kept under review as the situation evolves and further guidance becomes available.

What should employers do if an employee is absent or infected?

Infected employees

If an employee is infected with COVID-19, it is recommended that the responsible health authorities should be notified in order to seek guidance on how to best protect the health of the workforce.

The safety delegate(s), or safety committee (if applicable) should be informed and a work environment risk impact assessment and action plan should be performed. If an infection is discovered at the work place the employer should inform the employees generally about the possible infection and give necessary instructions taking into account the restrictions of the data protection regulation referred to above.

Employees on sick leave are entitled to sick pay or sickness allowance, and employees ordered to remain home from work, ordered into isolation or quarantined to prevent COVID-19 by the decision of a doctor defined in the Communicable Diseases Act are entitled to sickness allowance on account of an infectious disease in accordance with statutory rules (Section 82 of the Communicable Diseases Act 1227/2016 and Chapter 8, Section 1 of the Health Insurance Act 1224/2004) (link). If an employer has paid a salary to the employee for the period of absence, the allowance may be paid to the employer.

In addition to the priority of health protection, employers should develop a plan going forward as to whether and how operational processes can be maintained.

Potentially infected employees

When an employee has not become ill, but the authority has ordered him or her into isolation or quarantine, in principle the employer is not obliged to pay his or her salary. However, in such a case it is recommended to verify this under any applicable collective bargaining agreement. Naturally, the employer can decide to pay his or her salary, in which case equal treatment of the employees should be taken into account. In such circumstances, the employer may be entitled to receive the abovementioned allowance.

Where there is a reason to believe that an employee poses a risk to the health of other employees, for example, because they have been travelling or had close contacts with an infected person, the employers are recommended to request the employee to undergo a medical examination.

Bulk absentees

Employers can consider several measures if the business is threatened by COVID-19 and employees' absences. The available measures should always be assessed on a case-by-case basis considering, for example, the terms of employment (including collective bargaining agreement and co-operation obligations). Some examples of available measures are the requirement of emergency work, the use of agency hired labour, and the implementation of remote working, (which is highly recommended by the Government). Using careful case-by-case consideration, depending for example on the terms of employment, the employer can assess the possibility of giving the employee alternative work in accordance with his or her employment contract.

In addition to the priority of health protection, employers are recommended to develop a plan going forward as to whether and how operational processes can be maintained in case of bulk absences.

Refusal to work or travel

Employees are obliged to perform work and unlawful absence from work due to fear or an abstract risk of infection may constitute grounds for termination. Thus, employees cannot refuse to attend work. In order to fulfill occupational safety responsibilities, employers should, for example, continuously monitor the working environment and assess the risks at the workplace in order to prevent dangers and risks that are harmful to employees' health. Employers must also ensure that the risk of infection is restricted. Due to the above-mentioned health and safety obligations, employers need to observe authority instructions and travel restrictions and then update their workplace instructions, if needed.

We recommend that an employer’s insurance coverage is checked regarding additional costs caused by the virus. 

What are employers' obligations where offices are partially or fully closed?

In the case of workplace closure, employees will generally remain entitled to full salary and benefits in accordance with their employment contract, applicable laws and collective bargaining agreements. Where possible, employees should be instructed to continue to perform their work duties remotely. Therefore, it is recommended that employers prepare properly with e.g. with proper remote working arrangements and policies where possible.

If the employer’s ability to provide work is reduced due to workplace closure, the employer may lay off employees if the economic and production-related criteria of the Employment Contracts Act are met. However, it should be noted that if an employee is prevented from working due to a fire, an exceptional natural event or another similar event affecting the workplace beyond the control of the employee or the employer assessed on a case-by-case basis, the employee is entitled to pay for the period of impediment, (up to a maximum of 14 days).

Where can employers and employees access local and national advice?

General information and recommendations are available here:

• The Finnish Institute for Health and Welfare recommendations and updates
  
  
• Finnish Government website on restrictions during the coronavirus epidemic
  
  
• Ministry of Foreign Affairs website and the Finnish Border Guard website on current entry restrictions and travel recommendations
  
  
• Medical Helpline 116 117 telephone service: On Medical Helpline 116 117, registered nurses from the acute healthcare services in your region will assess whether you need emergency care services or urgent care services, in accordance with the regional instructions they are following. In case of emergency, please call 112.
  
  
• The Social Insurance Institution of Finland website on how the coronavirus epidemic affects KELA's benefits and services.

Last reviewed: 05 March 2021