Zum Inhalt Zum Hauptmenü

Search form

Newsletter

Covid-19 infections – Which privacy aspects must companies take into account when processing health data?

Date: 
Thursday, 2 April 2020

Overview

Questions and answers:

Can a company collect data about a (potential) infection with Covid-19?

Both, in case of information on a suspected case and in a confirmed case, special categories of personal data are processed. Whether a company may process such health data of employees, customers, suppliers or other third parties is exclusively governed by Art 9 GDPR. In absence of a concrete legal provision, in practice, only (i) the express consent of the data subject (Art 9 Paragraph 2 lit a GDPR) or (ii) compliance with obligations under labour and social law (Art 9 Paragraph 2 lit b GDPR) can be considered to legally justify the collection of data in such a scenario. Thus, if a data subject voluntarily reports that it has symptoms or even a confirmed case of Covid-19, the information can generally be processed as part of the employer's duty of care to protect other employees who have been in contact with this person.

If health data is to be passed on to other employees in the company, the data minimization principle must be taken into account. In a first step, it is usually sufficient to inform employees on a general basis about the existence of a suspected case of infection in a particular department, location or floor. The data subject should still be treated anonymously. Only in a second step, the name may be disclosed to the employees who have directly been in contact with the infected person during the incubation period. A transfer of data to third parties - e.g. customers or suppliers - must therefore always take place without any reference to the data subject.

Alternatively, the explicit, voluntary consent of the affected person can be obtained. If this is not possible because the person concerned is physically or legally incapable of giving consent, Art 9 Para 2 lit c GDPR may also apply. As a result, processing may be necessary to protect the vital interests of the data subjects or other natural persons.

The mere temperature testing in entrance areas does, to the contrary, usually not lead to privacy issues as long as data is not processed by automated means or in a file system. Thus, as long as any testing is done live, only – and not within an CCTV area – the GDPR does not apply.

May a company disclose data about infected persons to an authority?

The authorities responsible under the Epidemics Act (e.g. district administrative authorities) may process health data in accordance with Sec 4 et seqq of the Epidemics Act in conjunction with Article 9 Para 2 lit i GDPR for reasons of public interest in the field of public health. Thus, data may be transferred to the authority at its request. In parallel, Sec 2 et seq of the Härtefallfondsgesetz also provide for a legal basis for data transfer as regards request for subsidy payments by SMEs.

How long may data on Covid-19 infections be stored?

Since neither the Epidemics Act nor the GDPR stipulates specific storage obligations for private companies in connection with notifiable diseases, the general data and storage minimisation obligation applies: Data may be stored solely for the fulfilment of the specific purpose. In practice, data on infected persons must therefore be deleted or irreversibly anonymised as soon as (i) identification of potentially infected other individuals has been completed, (ii) no more official enquiries are pending or (iii) the data is not required for the assertion, exercise or defence of legal claims.

Are specific security measures required?

When handling sensitive health data, the need-to-know principle is of upmost importance. In such a sensitive area, it must be ensured that only those persons in the company have access to personal data, who actually need it in order to fulfil the purpose. In addition, higher security standards must generally be implemented for sensitive data (e.g. encryption). During the establishment of respective procedures, it is currently required to think out of the box, especially when switching to home office. The necessary measures have to be adhered in this scenario, too. Thus, effective authorization concepts, access restrictions and establishment of secure communication channels is required.

In the Health Telematics Act (Gesundheitstelematikgesetz, "GTelG"), a rather pragmatic provisional relief has been implemented for health service providers for the period of the corona crisis: Sec 26 and 27 GTelG explicitly allow the transfer of health and genetic data via fax and e-mail. At the same time, the strict identification standards were reduced: name and social security number are now sufficient. This shall help to achieve the goal of prevent that people have to visit doctors and pharmacies for standard prescriptions of medicines which might cause further infections.

Does a company have to proactively inform affected data subjects?

Since informing employees, customers, suppliers or third parties is generally neither impossible nor involves disproportionate effort, any already existing privacy notices pursuant to Art. 13 and 14 GDPR shall be supplemented accordingly to reflect the new processing purpose. However, this can also be done pragmatically within the context of any general information to those concerned that is sent out anyway.

Which additional measures are to be implemented from a data protection perspective?

In addition to the "Hot Topics" already mentioned, the remaining GDPR obligations are of course not to be neglected either: Since the processing and transmission of COVID-19 suspected cases constitutes a new data processing, an amendment of the records of processing activities is required. Further, a data protection impact assessment will usually be obligatory, since sensitive health data of data subjects who require special protection (employees, patients, etc) is being processed. In addition, it is required to maintain already implemented processes and internal information flows in order to be able to properly deal with data breaches. Thus, the focus must be to maintain an high level of awareness in order to ensure adherence to the short 72-hours-deadline, which still applies.

Once the current crisis situation has abated, an increased number of requests for access, information and deletion by the infected persons concerned can also be expected. Accordingly, processes established in the company in this regard must be evaluated so that bottlenecks or missed deadlines can be avoided.

Home Office and Privacy

If a company switches to home office or teleworking, associated risks must be assessed and mitigated accordingly: If, as a result of the crisis, more employees than usual - or even all employees - access data from outside the company, this will usually be accompanied by a general increase in risk, which must be sufficiently taken into account when structuring technical and organizational measures. Thus, it must be ensured that employees keep data confidential and safeguard company and business secrets also when at home. In practice, this starts with keeping passwords confidential and extends to the sensitive handling of telephone calls and video conferences. At the same time, it must also be ensured that the systems used for this purpose are stable in terms of capacity and availability for the large number of external accesses that were not taken into account before the crisis. Due to the lack of availability of proper conference call providers and its services many companies currently use free internet-based alternatives. These can be useful and permissible for non-sensitive areas, such as abstract coordination within teams as to workload, internal coordination or in general for keeping in contact with colleagues. However, it is not advisable to use such channels to exchange (i) personal employee and customer data and/or (ii) information that is subject to trade and business secrets. From both the GDPR and IT security perspective these services usually do not meet the legal and technical requirements. Such services usually aim to be used between private individuals, only. Thus, the terms and conditions as well as license terms are frequently not fit to handle data processing by companies. The appropriate security measures provided for in the GDPR for personal data and the UWG for business secrets are usually not complied with.

Mobile operators: What needs to be considered in the context of the public warning system?

Pursuant to the newly created Sec 98a of the Telecommunications Act mobile operators can be obliged – in case of non-compliance also by decree - directly by the federal government to send end users public warnings about impending or spreading major emergencies and disasters via SMS. A respective legal basis according to Art 6 Para 1 lit c GDPR has been implemented. This also includes the processing of the corresponding basic (contact) data. If targeted information is required in individual cases - for example to search for contact persons for a sick person - location data may also be used.

Your contact persons:

 

Axel Anderl
Head of IP/IT and Data Protection Practice Group as well as the Digital Industries Group
T +43-1-533 4795-23
axel.anderl@dorda.at

Nino Tlapak
Expert for IP/IT and Data Protection as well as in the Digital Industries Group
T +43-1-533 4795-23
nino.tlapak@dorda.at



© 2020 · DORDA   PODCAST

we deliver clartity