The taking of temperature and other health data to be treated by companies in the workplace

In order to guarantee the health of employees and prevent the spread of COVID-19 in work centres, companies have been obliged to take a series of measures that must take into account the applicable regulations on personal data protection.

In view of the gradual return to normality that is taking place during this phase of de-escalation, many companies are trying to resume their normal activity and, therefore, many employees are also returning to their usual jobs.

As a result, such companies are obliged to implement a series of measures in order to guarantee the safety and health of the work centres, measures which must take into account at all times the applicable regulations on the protection of personal data, since they are applicable in their entirety and contain certain provisions for cases of epidemics such as the present one.

Although the company can find the legitimate basis for processing health data of its employees, considered as special category according to Article 9 RGPD, in compliance with a legal obligation, as would be the case of Law 31/1995 on Prevention of Occupational Risks, under which the employer must ensure the safety and health of all its workers in their workplace, such data processing must be carried out in compliance with all the guarantees, principles and security measures provided for in the RGPD and the LOPDGDD, ensuring therefore that the measures to be implemented to combat the spread of the virus in the workplace involve the processing of the necessary and appropriate data, without being able to exceed in any case, to comply with such purpose.

Among the most popular measures to be implemented by the companies, the taking of temperature before accessing the facilities has been especially highlighted.

The AEPD has already issued a statement in which it expressed its reservations about the application of this measure, and AddVANTE advises against the use of this practice for the following reasons

Firstly, the taking of a person’s temperature is a health data, considered a special category of data in accordance with Article 9 of the RGPD, which requires a series of additional guarantees in its treatment by the person responsible, in this case the company.

On the other hand, with the scientific evidence available to date, taking a temperature does not seem to be an adequate measure to infer whether a person is infected by the virus or not, since it has been shown that there are a large number of asymptomatic infected persons who could therefore be carriers of the virus without having a fever; it may also be the case that a worker has a fever due to causes other than the coronavirus, so it does not seem to be the most appropriate measure to fulfil the purpose of combating the spread of the virus in the workplace.

Likewise, when implementing a new personal data processing activity, a risk analysis must be carried out in which the effectiveness, suitability and benefits of the measure for the data subjects are weighed against the interference with the rights of the data subjects. Given the impossibility of deducing whether someone is infected by the virus on the basis of his or her temperature, such a risk analysis would hardly give a positive balance, and the measure should therefore be rejected.

Another factor that makes it inadvisable to take temperatures is the failure to comply with the principle of minimising data as set out in Article 5(1)(c) RGPD, which states that data should be “adequate, relevant and limited to what is necessary” with regard to their purpose.

In addition, it is important to bear in mind that any unauthorised disclosure, dissemination or appropriation of employees’ health data could constitute an offence against their privacy, so it is advisable to handle as little data as possible in this category.

In this sense, the most recommendable thing on the part of the company and taking into account the degree of knowledge that is had on the virus to date and the recommendations of the sanitary authorities and considering all the exposed thing, would be the elaboration of a report in which the measures of prevention of propagation of the virus based on these recommendations are included (to maintain distances, assiduous washing of hands, masks, etc.). This report should be sent to all workers and signed by them, thus stating their commitment to comply with these guidelines and to inform their superior in the company if they have symptoms of the virus or suspect they have been in contact with someone who is infected.

In this way, the unnecessary processing of personal health data of workers is avoided and the company acts in accordance with Article 29 of the Prevention of Occupational Risks, according to which it is the responsibility of each worker to ensure their health and safety, as well as that of the rest of the people in their work environment, complying with the measures adopted by the company.

By way of conclusion, it can be said that taking into account the provisions contained in the applicable legislation on data protection, it seems highly inadvisable to take the body temperature prior to access to the workplace because it involves obtaining health data that would be difficult to comply with the purpose pursued, given the impossibility of inferring whether or not a person suffers from the coronavirus as a result of it, and would therefore not comply with the principle of data minimisation.

It would therefore be much more appropriate to draw up a report with guidelines for action based on the recommendations of the health authorities that must be signed by all the company’s employees, informing the company of the suspicion of being infected if this occurs.