COVID-19: Data Protection in Germany FAQs – our view
Written By
Partner
Germany
I'm a technology, copyright and data protection lawyer. My ambition is to provide the best and most suitable advice to clients and, in particular, to guide them through their technology transactions, IT and data projects in a pragmatic, solution-driven and innovative manner.
Partner
Germany
As an experienced lawyer in our Privacy and Data Protection Practice and our Technology & Communications Sector Group in Frankfurt and Düsseldorf, I advise our clients on all kinds of data protection, IT, online, and copyright matters.
Related
Practices
Sectors
- Defence & Security
- Automotive
- Aviation & Aerospace
- Energy & Utilities
- Financial Services
- Retail and Consumer
- Life Sciences and Healthcare
- Technology & Communications
- Media, Entertainment and Sport
Trending Topics
Countries
Offices
1. Does data protection limit the options companies have to combat the Corona virus?
This should generally not be the case. Data protection is a fundamental right, but – as all fundamental rights – it is no absolute right but must be balanced with other fundamental rights. The dimension of the Corona threat has made clear to all European governments that extraordinary measures are needed to protect the most important of all fundamental rights: life and health. The same balancing applies to companies, and with the threat increasing every day statements and guidance of data protection authorities more and more acknowledge the need and justification of exceptional measures. In our view, the following limits apply:
- The measures must serve a sensible purpose with regard to the protection of the company’s employees’, business partners’ or wider public’s health. They must be appropriate. So, companies are not to collect personal data if they are not used, will likely not be used and need not to be used in connection with reasonable measures to combat the Corona virus. Example: it makes absolute sense to measure the temperature of visitors/employees entering a building and refuse access if they disagree or have a high temperature, but for controlling the access the data does not need to be further retained (granting access is usually a yes/no decision).
- Personal data collected for the Corona virus must not be used for any other purposes (unless there is a separate justification for it) and there must be technical and organisational measures in place to ensure this.
- Measurements must be applied in a non-discriminatory manner. Example: only measuring the temperature of people of a specific origin would clearly not be allowed.
Yes, personal data of employees may also be collected and processed if an infection has been detected (i.e. the employees have been tested positive or, as will be more and more relevant in the future, they are deemed to be positive under the guidance of the relevant health authorities). The employer may (and should have) a respective record of infected people (but access to this data should be carefully restricted).
The information may (and, as a duty of care under employment and contract laws, even must) be shared with relevant potential contacts, which can be reasonably identified. In many cases this will also require sharing the name of the relevant individual, but it does usually not allow the disclosure of the name or other information to the general public (because it is usually not required). However, it should include notifying everybody (other employees or even business partners) who may have had close contact with the infected person in the relevant period.
6. May a company ask employees or visiting business partners for their travel history?
This is a rapidly evolving question. There had been guidance of data protection authorities that it is not allowed to ask for general travel history, but only for travel history with respect to "risk areas" as defined by the relevant body (in Germany the Robert Koch Institute). However, the development of the spread of the virus has shown that this may be too short-sighted. The risk areas change rapidly and whether an area is considered risky at a certain time may only be determined 1 or 2 weeks later. Meanwhile there are general international travel restrictions in place. In this context, we think there is an argument at the moment that it should also be allowed and even be appropriate to collect all relevant travel history (subject to strict access restrictions and further technical and organisational measures) – this may change if the spread of the virus further progresses throughout the whole world and locations become less relevant.
7. May a company ask its employees or visitors about COVID-19 symptoms of relatives or housemates?
There is no specific guideline from the DPAs yet. However, given that the risk of becoming infected in families resp. the household is rather high we think that companies may also ask employees/visitors whether relatives (if they live together) or housemates are infected or have COVID-19 symptoms (see above) provided they need this information (e.g. the company decides that this group of individuals should stay at home/work from home – in that case it may even be sufficient to add this to the list of scenarios in which employees should work from home; another example: this information is used for access control). In most cases a yes/no answer should be sufficient.
