Data protection in Corona times: What employers and employees need to know

Companies have a duty of care and concern towards their employees. At the same time, they are dependent on information about the health of their employees, especially in the current climate. This can lead to problems with regard to data protection, because health information is particularly worthy of protection. In the following, we highlight the rights and obligations of employers and employees in dealing with the Corona virus. Brigitte Münch, Legal Counsel & Member of the Executive Board of LEANmade, explains what information is and is not allowed in terms of data protection in Corona times.

Data protection in Corona times: Rights and obligations for employers

1. Do I have to report a possible infection of an employee to the authorities? No. Only physicians, hospitals and other public or private healthcare institutions and laboratories must report infected patients to the authorities. There is no reporting requirement for other employers. Reporting a suspected case or case of illness to health authorities could even constitute disclosure of health data without a legal basis and could be punished.
2. Do I need to inform the company's employees about an infected employee in the company? Only with the consent of the person concerned. The employer has a duty of care towards its employees. The staff should therefore always be informed of a suspected or confirmed case of infection. However, naming the person concerned is only permissible if he or she has expressly consented. Access to the information must be restricted to the necessary circle of colleagues. The information must also not have any consequences for the employment relationship. In any case, an employee must be comprehensively informed about the intended disclosure and further processing. We strongly recommend obtaining documented consent for this purpose. Of course, the processes for processing cases of illness within your company should comply with the requirements of data protection and thus be followed.
3. Do I need to identify and inform contacts of an infected employee? No. If you have alerted employees in your company to the possibility that a colleague may have contracted the virus, you have fulfilled your duty as an employer to the employees. A company is not required to collect further data to determine who has come into contact with whom.
4. Am I allowed to ask employees about a (possible) infection? Only if the company is subject to a special legal obligation, such as in the health sector or the catering industry. The question about the health of employees is basically a private matter. If you do ask, employees are not obligated to answer the question correctly.
5. Do I have to inform business partners about a (possible) infection within my company? No, the data protection regulations do not oblige you to do so. The legal obligation to provide such information exists only for physicians, hospitals and comparable medical professions. However, if there is a risk of contagion, an obligation to provide information may arise from the general duties of care between contractual partners. If a company informs its business partners of a suspected case, it should note that the name of the possibly infected person must not be mentioned and that the same principles apply as when informing its own employees.

Rights and obligations for employees

1. Do I have to inform my employer about a (possible) infection with the coronavirus and/or answer his questions about a (possible) infection? In principle, no. Exception: If the employee or employer is subject to a legal obligation. This is the case, for example, with doctors and hospital staff or in the hospitality and catering industry. If an employee is asked, they must be informed of their specific duty to provide information. However, in this specific situation of the spread of the coronavirus, employees from other sectors who are not subject to a specific duty to inform should also inform their employer about a (possible) infection in order to protect colleagues and customers.
2. Do I need to tell my employer that I have been in a high-risk area for the past few weeks? No. Each employee is free to disclose this information to his or her direct supervisor and/or the Human Resources Department in the interest of colleagues, suppliers and customers. The disclosure of the information by the employee must not have any negative consequences for the employment relationship.
3. Where do I have to report a (possible) infection? Information about a possible infection should follow the usual procedures in case of illness, i.e. if the employee decides to inform about his/her health condition, he/she should inform the direct supervisors and/or the responsible HR representative. The information that the employee discloses to his or her employer is health data, which is particularly protected by law. This also means that any further information to other colleagues outside the direct reporting line and the HR department requires his explicit consent.

Source and further information: Brigitte Münch, LEANMade AG