Belgian DPA releases Guidance and FAQs on Cookies and Trackers

23. April 2020

On Thursday, April 9th 2020, the Belgian Data Protection Authority (Belgian DPA) has issued a guidance along with frequently asked question on the subject of cookies and other tracking technologies.

The key points presented by the guidance revolve around the definitions of cookies, what needs to be presented in a cookie policy, how the consent of data subjects needs to be obtained and which requirements it needs to fulfill, as well as the storage period of a cookie on a user’s device.

The Belgian DPA made it clear that of the utmost importance is the transparency of the cookie usage. That entails that the users need to be informed about the scope of each individual cookie used. This should be done through a cookie policy on the website. The cookie policy needs to be written in a language the targeted users of the website can understand, as well as be easily accessible, e.g. through a hyperlink.

Specifically, these cookie policies need to include and inform about:

  • identification of the cookies used;
  • their purposes and duration;
  • whether third-parties have access to such cookies;
  • information about how to delete cookies;
  • the legal basis relied upon for the use of cookies;
  • information about individuals’ data protection rights and the ability to lodge a complaint to the competent data protection authority;
  • information about any automated decision making, including profiling.

In order to be able to use cookies, the consent of the user needs to be obtained. The Belgian DPA stated in their guidance that the consent has to be obtained for the use of all non-essential cookies, which means all cookies that are not necessary for a user requested function of the website. A necessary cookie would be, for example, the cookie to remember the item in a user’s cart, or cookies that enable booking communication with a user.

The consent especially needs to be:

  • obtained for the use of all non-essential cookies, as well as all social media plugins;
  • informed, specifically, prior to giving their consent to the use of cookies, users must be provided with information regarding the use of cookies: The information that needs to be given to the data subjects are the entity responsible for the use of cookies, the cookies’ purposes,  the data collected through the use of cookies, and their expiration. Users must also be informed about their rights with respect to cookies, including the right to withdraw their consent;
  • granulated, whereas in a first instance, users need to decide between what types of cookies they want to give consent to, and in a second instance, users can decide exactly which cookies they want to give consent to;
  • unambiguous and provided through a clear affirmative action.

Further, it is also important to keep in mind that the Belgian DPA has confirmed that cookie walls are unlawful, and that companies must show proof of obtained consent through keeping logs.

The Belgian DPA has also given guidance on the lifespan of cookies. Cookies should not have unlimited lifespans, but rather follow basic data protection rules: once a cookie is no longer necessary for the purpose or it has fulfilled its determined purpose, it needs to be removed. If the cookie cannot be deleted from the controller’s side, it is important to give the users the information on how to do it themselves.

Overall, the Belgian DPA’s guidance has given controllers a clear way to maneuvering their cookie usage, and has provided a new list of FAQs in case of further questions. In this regard, the Belgian DPA has made sure that cookies and their use are easy to comprehend and handle, hopefully helping data protection compliance within the subject.

The Video-conference service Zoom and its Data Security issues

20. April 2020

Amidst the Corona crisis, the video communications service Zoom gained enormous popularity. The rate of daily Zoom users skyrocketed from 10 Mio in December 2019 to 200 Mio in March 2020. As it outshined many of its competitors, Zoom labels itself as “the leader in modern enterprise video communications”. However, the company has been facing a lot of public criticism because of its weaknesses in data security and lack of awareness in data protection matters.

Basic data security weaknesses unfolded little by little starting in March 2020:

  • Zoom had to admit that it was wrongly advertising to provide full end-to-end encryption for all shared contents like video, audio or screen sharing.
  • Security experts revealed several bugs that could have allowed webcam and mic hijacking and the theft of login credentials.
  • An online Tech Magazine reported that Zoom leaked thousands of their users’ email addresses and photos to strangers.
  • Video-conferences which users did not protect with a password, enabled “Zoombombing”, a phenomenon in which strangers hijacked videocalls and disrupted them by posting pornographic and racist images as well as spamming the conversations with threatening language. In response, Zoom introduced the Waiting Room feature and additional password settings.

At the same time, Zoom’s data privacy practices came under scrutiny:

  • Zoom shared web analytics data with third-party companies for advertising purposes without having a legal basis or notifying users about this practice. In response to criticism, Zoom revised its privacy policy and now declares that it does not share data from meetings for advertising.
  • The company also shared more analytics data of its users with Facebook than stated on Zoom’s privacy policy, even if the user did not sign in with their Facebook account. Zoom introduced an update in which this sharing is terminated.
  • The New York Times revealed that Zoom used a data mining feature that matched Zoom users’ names and email addresses to their LinkedIn profiles without the users knowing about it. Zoom then enabled automatic sharing of the matched LinkedIn profiles with other meeting members that were subscribers of a LinkedIn service for sales prospecting (“LinkedIn Sales Navigator”). In response to criticism, Zoom removed this feature permanently.
  • Zoom hosted a feature called Attention Tracking, which let the meeting’s host know when an attendee had clicked away the meeting window for more than 30 seconds. In the meantime, Zoom disabled the feature.

The security and privacy issues of Zoom have led various public authorities and companies internationally to ban their workers from using the service.

On 1 April 2020, Zoom’s founder and CEO Eric S. Yuan announced a 90-day plan to significantly improve their data security in an effort to build greater trust with their users. This plan includes freezing the introduction of new features, enlarge their cybersecurity team and engage outside help from security advisors.

Apple and Google join forces during Corona Pandemic

17. April 2020

Apple and Google two of the biggest internet giants announced that they will partner on the development of a COVD-19 contact tracing technology.

According to a statement, both of them published on their blogs, aim of the partnership is to develop an App respectively a technical tool which should support the protection of people and to help combat the virus. Furthermore, the tracing technology should help governments and health agencies reduce the spread of the virus.

Apple and Google want to develop a Bluetooth technology which can be used on iOS and Android devices as well as that it can be implemented in Apps of other providers via an API (Application Programming Interface) – which should be published in May.

The tracing technology, using the Bluetooth function and encryption, is designed to detect the distance between two devices in order to identify potentially vulnerable people who have been in close contact with a person tested positive for corona. Therefore, the devices should exchange temporarily ID numbers. In case, one person is tested positive he or she should change the status in the used app in order to inform all persons to which the data subject had contact in the past two weeks.

Both, Apple and Google, ensure that they take data protection requirements seriously. According to the provided information the data should firstly be stored on the respective devices and deleted automatically after two weeks. The data should only be uploaded to a server after change of status to tested positive and obtaining consent of the data subject. The exchanged ID numbers are planned to be uploaded to a list anonymously. In order to increase trust, it is planned to publish the software source codes. This would allow everyone to understand how the data is handled. In addition, this is to ensure that no data will be used for advertising purposes.

Consequences of the 2017 Equifax Data Breach

16. April 2020

It has been almost two years since the consumer credit reporting agency Equifax suffered a massive Data Breach.

Back in May 2017 Equifax has been hacked, but the operators first noticed the breach much later, at the end of July 2017 and informed the public on the beginning of September 2017.

The disclosure of sensitive data from approximately 143 million, not only US based consumers, was to be feared (we reported).

After the breach Equifax invested $ 200 million on the data security infrastructure and found itself in the middle of class action suits.

Now, two years after the hack, Reuters reports the settlement of a lawsuit in connection with which Equifax pays $ 19.5 million to Indiana and also the Chicago Daily Law Bulletin reports a $ 1.5 million settlement between the city of Chicago and Equifax.

Besides Indiana also Massachusetts filed a lawsuit against Equifax, which is reported to be settled as well – the amount of the settlement is not yet known.

CNIL publishes new Guidance on Teleworking

14. April 2020

The French Data Protection Authority (CNIL) has released a guidance on teleworking on April 1st, which is intended to help employers master the new working situation. In particular, it is supposed to bring clarity on the IT requirements in order to ensure a safe and well-functioning remote working environment.

In particular, the guidance touches on these following points to form a basis for coping with teleworking from an employer’s perspective:

  • It is recommended that employers formulate an IT Charter or internal regulation on how to use the teleworking systems which are to be followed by the employees,
  • Necessary measures have to be taken in case the systems have to be changed or adapted to the new situation,
  • It should be ensured that employee work stations have the minimum requirements of a firewall, anti-virus software and a tool blocking access to malicious websites,
  • To keep from being exposed on the internet and ensure security, a VPN is recommended to be put in use.

Furthermore, the CNIL has also given guidance on the cases where an organization’s services are mainly performed over the internet. In such cases, it recommended to follow a few necessary requirements in order to make sure the services can be delivered safely and smoothly:

  • Web protocols that guarantee confidentiality and authentication of the processes (such as https and sftp), and keeping them up to date,
  • Double factor authentication,
  • No access to interfaces of non-secure servers,
  • Reviewing logs of access to remotely accessible services to detect suspicious behaviors,
  • Ensuring that the used equipment follows latest security patches.

The CNIL also offered some best practices for employees to follow in cases of working remotely, to give both sides pointers on how to deal with the changing situation.

Specifically, employees are being recommended to ensure their WIFI is secure by using encryption such as WPA 2 or WPA 3, along with a secure password. In addition, the CNIL recommends work equipment given by the employer, as well as using a VPN provided by the company. In the case of using own devices, a firewall and an anti-virus software are the necessary requirements to ensure security of the equipment, as well as updating the operating system and software to the newest patches.

Lastly, the CNIL warns of increased phishing attempts in relation to the COVID-19 outbreak.

Overall, the guidance and best practices the CNIL has published indicate a need for continuous and active vigilance in regards to teleworking, as well as the sharing of personal data in the process.

This guidance is in line with our past assessment of the remote working situation, which you are welcome to check out in the respective blogpost in our Series on Data Protection and Corona.

Series on Data Protection and Corona – Part 8: Social assessment of the importance of data protection

30. March 2020

The Corona crisis is not only a challenge for the health system, the economy and each and every one of us. People in the so-called ‘systemically important’ professions have been working at their physical and psychological limits for days and are constantly exposed to the virus and its consequences.

The economic damage to be feared has so far only been guessed and is causing additional concern. The issue is currently omnipresent. Everyone is worried about infecting themselves or others and whether you, your family, friends and acquaintances will survive the crisis economically or in terms of health.

In these times, it is understandably difficult to continue dealing with data protection. Quite a few people, especially in times of the coronavirus, simply don’t want to deal with the “annoying” data protection issues and some even see data protection as an additional hurdle, for example when it comes to remote work.

Social assessment of data protection

In the last few days we have made every effort to explain to you the data protection regulations and measures as well as the special features of the current situation. Finally, we would like to mention the general social attitude towards the topic of data protection and want to point out the important role even in times of the coronavirus.

Already at the beginning of March, the German newspaper FAZ published an article on the results of a survey, which contained the results of a representative survey conducted by the market research company Innofact on behalf of Usercentrics. The result of this study was that a large part of the German population is prepared to accept restrictions on data protection and thus the right to informational self-determination in order to combat the corona crisis. In addition, the majority of the respondents also advocate the expansion of data retention (for example, of flight and travel data) in order to be able to track the spread of the pandemic. Moreover, more than 50% are prepared to disclose their health data voluntarily.

When the Robert-Koch-Institute (RKI) announced that it had received several terabytes of anonymised data from a German telecommunications provider in order to trace movement patterns of the users and thus assess the effectiveness of the measures imposed to date, there were also hardly any voices critical of such data transfer. This may be due to the fact that the data was anonymised. In other countries, however, data has not been transfered anonymously. In China, South Korea and Taiwan, for example, phone-tracking technologies and mobile phone apps were used to break down movement patterns to individuals.

A similar but slightly different way, based on the cooperation of the persons, has been established by the Austrian Red Cross. The Red Cross has developed the app “Stopp Corona” (article in German). Users of the app are supposed to track who they have been in contact with and, in case of an infection, also addthis information in the app to automatically inform the contacts of the last 48 hours about the infection and ask them to isolate themselves. According to the Red Cross, the data processing will take place anonymized. The app is available for Android devices in Austria since Tuesday, 24.03.2020. It remains to be seen whether and with what success this and similar apps can help in the spread of the pandemic.

Are these findings new?

But are these findings really new, or do they just appear in a different light due to reference to the corona crisis?

The majority of the population uses the social media services Facebook and Instagram. In addition, messengers such as WhatsApp continue to enjoy great popularity in society and are just as popular worldwide as Google Maps. What all these services have in common is that they have all been in the media because of conflicts with data protection regulations. Users must therefore be aware that they reveal a great deal about themselves personally, their interests, hobbies, whereabouts, etc. This is willingly accepted in order to take advantage of the supposedly free benefits they gain by using the above-mentioned services. However, the operators of these services are all too happy to be compensated with the voluntarily provided data of users, for example in order to place advertising tailored to the individual.

The realization that personal data is provided more or less voluntarily is therefore no news. In the current situation, the undoubtedly important purpose of combating the pandemic only seems a welcome excuse, because it seems ‘desirable’ to put data protection before a higher goal.

But even if certain measures, especially when data is used anonymously, seem to be useful in combating the corona virus, even now interventions in the informational self-determination of each individual should only be made after careful consideration, so that each person can continue to develop freely within the framework of his or her freedoms and rights. That is why, even in times of the corona crisis, it is important to preserve the data protection requirements of the GDPR and local data protection and other laws which carry the idea of informational self-determination, also and above all when sensitive data such as health data are to be processed.

This blogpost concludes the daily contributions of the Series on Data Protection and Corona. From time to time, we will of course add new contributions from the field to this series and will of course continue to keep you informed about data protection news that have no connection to Corona.

For more up-to-date information (in German) you are welcome to follow us on Twitter.

We wish you only the best, stay healthy and protect yourself and others.

Series on Data Protection and Corona – Part 7: Online Learning Tools and potential Data Protection Concerns

27. March 2020

In the process of the spreading COVID-19 pandemic, more and more schools are closing to keep the school staff and children safe. However, this results in the duty of the parents to keep their children educated and preserving their motivation to learn and study.

Online learning tools and platforms have seen a rise in the past few years, as the demand for additional learning rises, as well as the requirement for the schools and students to adapt to a digitalized process gains in importance. In the wake of the current spread of the Coronavirus, these tools may help parents brave the daunting task of suddenly being in charge of their children’s education.

However, it is important to keep in mind that with online learning tools also comes issues and challenges in regards to the protection of the personal data of the children. Not only are registration data a requirement for the use of the tools, in addition a lot of them need to collect the student’s learning data, e.g. learning time, evaluation of tasks or exams as well as social interactions if they are sharing it with, for example, their class.

In the following, we would like to shed some light on different data protection aspects and things to look out for, in two different constellations. On the one side, the use of independent third party apps or tools and on the other, tools procured or offered by the schools and teachers.

Independent Providers

In the case of independent third party providers, there is a big range of online learning tools available. Each of them has a different array of personal data they collect, and it is very important to read privacy notices if you do not want the personal data of your child potentially used for marketing purposes, or transferred to third countries.

The good thing in regards to third party learning tools is that in most cases, only the e-mail address is required for registration. That allows the option to leave the real names and information of your children blank, instead allowing for the use of pseudonyms to shield from potential unwanted data processing and keep anonymity.

Especially in regards to providers based in Germany, the data protection standards are quite high, and therefore pose less of a threat to the child’s personal data. However, even with high standards in their country of origin, there are tools like Studysmarter, which allow in their privacy notice (available in German) for the learning data of the users to be processed for the enhancement of the tool. Furthermore, many of these online learning tools use applications through Google or Facebook, which likely transfer their data to the USA, and thus might be accessible to the American government.

In most of the cases of third party online learning tools, the third parties are the controllers of the data collected. However, some tools like for example Antolin are processors due to the constellation of the platform’s setup. In such cases, the teacher acts as an admin for the students’ accounts, and keeps control of the data collected. That ensures an additional safeguard in the processing of the children’s personal data, since the teacher controls through instructions and customizable online classrooms what data is processed.

Schools

Opposed to the above, schools have increasingly started to develop and offer their own online learning tools, or collaborate with third parties to provide more individualized online learning options. This leads to the positive fact that, since the school is still the controller of the collected personal data, the same safeguards are in place as during a regular school attendance.

In Germany, in such a case the processing is based on the school’s institutional authority to provide education. Because of that, the legal grounds for the processing are Art.6 I lit.e GDPR, Art.6 III sentence 1 lit.b GDPR which refers to the respective state’s school laws and school data protection laws. Therefore, the data protection in such cases is bound to specialized legal obligations.

However, since the school and the teacher usually are the ones administrating their online learning platforms, there is less chance for the students to stay anonymous. In order to fulfil their educational duty and to grade or help the students in specific cases, the teacher needs to be able to identify each student and the class they belong in. Parents might have to keep an eye on the social exchange with classmates over these learning tools as well, since personal data, which is not necessary for the educational duties of the school, does not fall under their processing competence.

In that regard the Datenschutzkonferenz (DSK) in Germany has released an orientation guide on online learning tools that schools are recommended to follow in order to stay GDPR compliant. The guide touches in detail on the different aspects of the processing of students’ personal data, and gives pointers on how school are supposed to process personal data collected in online learning tools.

Overall, it is important for parents and children to be informed by the controller in the terms of Art.13 GDPR in order to be sure about the type of processing taking place, and make sure the necessary consent has been requested in case of profiling or marketing purposes.

Where possible, it is recommended to give the least amount of personal data required, especially if the online learning tool is not handled by the child’s school but rather by a third party provider. In addition, parents should look out for third country transfers, as the safeguards in other countries do not necessarily compare to the standards in their country of origin.

We also recommend keeping an eye on your child’s usage of the tool and monitoring their handling of their own personal data.

The series on data protection and corona will be continued with the last blogpost of the series on the subject of social assessment of the importance of data protection.

For more up-to-date information (in German) you are welcome to follow us on Twitter.

We wish you all the best, stay healthy and protect yourself and others.

 

Series on Data Protection and Corona – Part 6: Data Sharing Practices to Fight the Corona Pandemic

26. March 2020

The newest developments of public lockdowns in many countries and states show that the Coronavirus is an unprecedented challenge to governments, administrations and law enforcement across the whole world. In an attempt to contain the spread of the pandemic, governments are seeking out all the possible options that are available to them. One promising option may be to make use of existing data by sharing, comparing and evaluating them to gain insights into how to best address the current challenges. It becomes apparent that countries take different approaches to allowing and using data sharing as a means to fight the pandemic.

Today’s blogpost will take a look at how data sharing is practiced around the world and what this might mean for the privacy of individuals.

Data Sharing by Public Authorities to Public Authorities

The Executive Committee of the Global Privacy Assembly (GPA) published a statement on 17 March 2020, calling for the sharing of personal data as necessary by organisations and governments, even across borders.

The GPA is a data protection entity comprising more than 130 international data protection authorities (DPAs) on the national and state level. Among many others, the accredited members include the DPA of Japan, USA, Canada, Mexico, Australia, Israel, Hong Kong, Argentina and all EU countries.

In its statement, the GPA makes clear that the data protection rules will not be a hinderance to effectively tackling the Corona pandemic. In fact, across all member jurisdictions, the data protection laws allow the processing of personal data in the public interest (e.g. Art. 6 para. 1 s. 1 lit. e  and Art. 9 para. 2 lit. i GDPR). In the current crisis, the DPAs all over the world will help facilitate swift and safe data sharing to fight Corona, whilst still maintaining the privacy rights of individuals proportionately.

Data Sharing by Private Entities to Public Authorities

In the meantime, private entities all over the world have started to share personal data with public bodies in an effort to fight the pandemic. The extent of these data sharing practices largely depend on the national data protection laws that the respective countries have in place. Since the level of data protection still varies greatly in different jurisdictions, the data sharing practices vary greatly also.

In several EU countries like Germany and Austria, telecommunications companies have started sharing anonymised mobile location data of customers with governmental agencies in order to trace the movement patterns of mobile phone users. The German governmental health agency Robert-Koch-Institue (RKI) for example, received more than 5 Gigabyte of anonymised data from Deutsche Telekom. The RKI will use the data to model the flows of movement which shall provide the researchers new insights into the spread of the virus.

The European Data Protection Board (EDPB) affirms in its statement from 19 March 2020 that within the jurisdiction of the GDPR, personal data protection rules do not apply to data which has been appropriately anonymised. Even the processing of non-anonymised location data by public authorities is possible if a EU Member State introduces national legislation to safeguard public security pursuant to Art. 15 para. 1 ePrivacy Directive (2002/58/EC). However in this case, a Member State must also put in place adequate safeguards to individual rights such as the right to a judicial remedy, as well as abide by the proportionality principle.

In other countries like Taiwan, South Korea and Israel, telecommunications companies and credit card companies are already sharing non-anonymised mobile location data and payment data with their governments, in order to track cases, cut transmission chains and enforce quarantines.

The authorities in Taiwan, for instance, make use of the mobile location data far more rigorously than the authorities in Western countries, as they have established the so-called “electronic fence” which is fed with data from telecommunications providers. This system monitors the mobile location data constantly and informs police and local officials if people in mandated home quarantine move away from their addresses or turn off their mobile phones. In the event of such an alert, the authorities will contact or visit these people within 15 minutes. Quaratine violators in Taiwan will face a fine of up to 1 Mio Taiwanese Dollars (31.000 Euros).

Israel is mainly using mobile location data to trace people who came in close contact with known Coronavirus carriers, and send them text messages ordering them to self-isolate immediately. However, the authorities shall also track whether a virus carrier is adhering to quarantine rules. Last week, the Israeli government approved of emergency regulations that allow the domestic security agency Shin Bet the processing of non-anonymised location data for a limited period of 30 days, with the permission of the attorney general.

As governments are taking measures against the spread of Corona, some more and some less intrusive to the privacy rights of individuals, time will tell whether the measures have worked effectively in containing the pandemic.

The series on Data Protection and Corona will be continued tomorrow with a blogpost on “Data Protection and Online learning tools”.

For up-to-date information (in German) you are welcome to follow us on Twitter.

We wish you all the best, stay healthy and protect yourself and others.

Series on Data Protection and Corona – Part 5: Data Protection compliant remote work

25. March 2020

The corona virus (SARS-CoV-2) is currently omnipresent. In order to slow down the spread of the virus, many companies, offices and employers are switching to having their staff work remote. But even in times of pandemic crisis and in the home office, the conditions for compliance with existing data protection laws must be in place and need to be considered. The responsibility of the company or employer (as a controller) and thus, if applicable, the personal liability of the management still remains.

For the period working at home, the employer should establish strict and transparent rules to clarify his rights and obligations as well as for his employees, regardless where and on which end device the employees work. Therefore, each employer should take appropriate and proportionate measures in order to make sure, that he and his employees will act in compliance with the requirements of the GDPR during the whole period of state emergency within the EU.

Due to the fact, that data processing at home carries a higher risk of data loss and data breach. It is recommended to consider the following measures below and further, to agree in such measures in writing, especially in order to avoid unnecessray misunderstandings and liability issues:

  • to provide employees with business terminal (mobile) devices for work in the home office, in order to be able to update the devices on regular terms or for setting up firewalls and anti-virus protection and unauthorized access,
  • to prohibit the use of private devices and, as far as possible, to technically prevent this.

The measures above can be implemented in the company or office, further precautions and instructions are required in the employee’s home workplace, such as:

  • the employer should set up a guidline on the handling of documents and how they are to be deconstructed (e.g. shredding and not misued as scap paper),
  • employees should be aware of measures to protect confidential data and information. Third party access, such as privacy filter or a password-protected screen saver in order to avoid “shoulder surfing” etc.,
  • the employee should prevent the viewing and access by third parties, such as aligning the monitor, using a privacy filter or setting up an automatic, password-protected screen saver,
  • the workplace should be in a separate room,
  • employees who do not live alone should always lock their mobile devices or laptops when leaving,
  • business related documents or mails should not be forwarded to private mail accounts or mailboxes,
  • employees should set up secure passwords (the password should contain at least 8 characters, consisting of a combination of letter, numbers and special characters).

The series on data protection and corona will be continued tomorrow with a blogpost regarding the statement of the Global Privacy Assembly on “Data Sharing Practices to Fight the Corona Pandemic”.

For up-to-date information (in German) you are welcome to follow us on Twitter.

We wish you all the best, stay healthy and protect yourself and others.

Series on Data Protection and Corona – Part 4: Processing of health data in context of preventive measures against corona infections

24. March 2020

Stopping the spread of the corona virus as far as possible, or at least slowing it down, is the top priority these days. For this reason, as far as possible many employers instruct their employees to work remote from home in order to reduce the risk of infection. However, this approach does not work for all businesses, such as the pharma industries, utilities (e.g. power plants) or grocery stores, food retailer and supplier. Therefore, there is a strong interest of such businesses that neither the present employees nor visitors (or customer) are infected with the virus.

In terms of infection prevention purposes, information on the state of health of individuals are an important means to help preventing people from getting infected with the virus and thus “flatten the curve”. Such health information fall under the so-called special categories of personal data according to Art. 9 of the EU General Data Protection Regulation (GDPR) and hence are subject to a particularly high level of protection. Therefore, when requesting information about an employee’s or visitor’s health, there are a number of things to be considered.

What are health data?

First, it needs some more clarification on the term ‘health data’: According to Art. 4 No. 15 GDPR, health data are personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status.

The term health data thus not only covers disease-specific information about the data subject, such as a viral infection or drug consumption, but already the general statement as to whether someone is healthy or not. Information that may not directly indicate an individual’s state of health in the first place is also to be considered health data if, in fact, the context in which the information is to be used leads to a conclusion about an individual’s health condition.

When can health data be processed?

It remains to be clarified when health data can be processed for infection prevention purposes under the GDPR. First of all, it is very likely that consent to the processing of health data for infection prevention purposes cannot be obtained freely given and would thus be invalid in nearly all practically relevant cases. However, without the consent of the data subject the processing of health data is only permissible in the exceptional cases according to Art. 9 para. 2 GDPR.  In the following this blog post therefore rather focuses on the options that are available without consent regarding the group of employees and visitors.

When is the employer allowed to collect and process health data of employees with regard to the corona virus, according to the GDPR?

Health data can be processed in the context of employment in the non-public sector to the extent that it is necessary for reasons of public interest in the area of public health (Art. 9 para. 2 lit. i) GDPR and local EU member state law, such as section 53 of the Irish Data Protection Act 2018 or § 22 para,. 1 lit. c) of the German Federal Data Protection Act) and/or to the extent that it is necessary for the fulfillment of rights and obligations in the context of the employment (Art. 9 para. 2 lit. b) GDPR together with a local EU member state law, such as the Irish Safety, Health and Welfare at Work Act 2005) as, e.g., the Irish and Hungarian Data Protection Authorities both stated (for the list of authority statements see our previous blog post part 1).

However, the employer has a duty of care, particularly with regard to the protection against the corona virus, which applies not only to the individual employee, but also to all employees as a whole. Accordingly, the employer is obliged to take proportionate measures to protect the health of its employees during working hours. In particular, this also includes measures against diseases such as the corona virus that are  notifiable under the local infection protection laws of EU member states.

Please note that, in accordance with the principle of data minimization, only the information that consists the strictly necessary health data is to be collected and processed. Therefore, it is recommend that employers should make use of other preventive measures (e.g. by teaching employees on infection prevention or providing them with hand disinfection or protective clothing) before considering means of data processing. Moreover, such health data is to be treated strictly confidential, both for the protection of the individual employee and to maintain the industrial peace and the operation of the company. If the employer should process personal data which are not health data, he can – after careful examination – also rely on Art. 6 Para. 1 lit. f) GDPR.

Does the employee have to report an infection?

The employee is also obliged to inform the employer of a corona infection, because of his fiduciary duty to the employer. This principle of loyalty also authorizes the employee to disclose personal data of other individuals in the business environment with whom he has had contact. This disclosure to the employer and the following assessment and storage of such information by the employer can be based on a legitimate interest of the employer under Art. 6 para. 1 lit. f) GDPR as well as on Art. 6 para. 1 lit. c) GDPR.

When is a company allowed to collect and process health data of visitors of its premises?

Since companies regularly welcome visitors and guests, there is also a strong interest of companies in taking precautionary measures to contain the virus. If health data would need to be processed for this purpose, this can be done after careful examination on the basis of Art. 9 para. 2 lit. i) GDPR and, if any, local EU member state law (such as mentioned above). In the case of other measures in which personal data other than health data are processed, the employer may rely on his legitimate interest pursuant to Art. 6 para. 1 lit. f) GDPR (cf. BfDI).

What measures are permitted with regard to the containment of the corona virus?

Examples of permissible measures “against” employees:

  • measures without data protection reference, such as hygiene regulations, general instructions (e.g., to stay at home if symptoms occur), cancellation/postponement of business trips, instruction to work remote from home, regularly inform about relevant news about the virus,
  • request for information on infection in case of justified suspicion,
  • requesting infected employees for information about contacted persons in the company environment,
  • request for information about whether they have been to a risk area after vacation or business trips,
  • processing of such information that have been proactively communicated by the employee, e.g. that there has been contact with a (potentially) infected individual,
  • obtain consent to store emergency contacts and private contact details for notification purposes, in case of emergencies and operational changes due to the corona virus.

Examples of non-acceptable measures “against” employees:

  • mandatory comprehensive questionnaires to the entire workforce (e.g. series of unreasonable surveys),
  • interviewing other workers to see if anyone of the staff has symptoms.

Examples of permissible measures for visitors or guests of the company:

  • measures without data protection reference, such as hygiene regulations, restriction of visiting possibilities, a notice to postpone the visit if having symptoms,
  • request for information on infection in case of justified suspicion,
  • requesting infected visitors or guests for information regarding contacted persons in the company.

Examples of unacceptable actions towards visitors or guests of the company:

  • general (comprehensive) request for health information without justified suspicion.

The series on Data Protection and Corona will be continued tomorrow with a blog post on Data Protection compliant remote work.

For up-to-date information (in German) you are welcome to follow us on Twitter.

We wish you all the best, stay healthy and protect yourself and others.

Pages: Prev 1 2 3 4 5 6 7 8 9 10 ... 44 45 46 Next
1 2 3 4 46