Danish Data Protection Authority Datatilsynet weighs in on the Coronavirus and GDPR:
What an employer can ask the employee to disclose and what the employee is obliged to disclose are issues that are governed by employment law rules and any public law rules on health, etc.
- Subject to this, and when required, an employer can, if necessary, record and disclose information that is not specific enough to be considered health information. e.g.
- that an employee has returned from a so-called “risk area”
- that an employee is in the home quarantine (without stating the reason
- that an employee is ill (without stating the reason)
There will be circumstances where it would be permissible to record and disclose health information, e.g. that an employee is infected with new coronavirus. However, recording or disclosure must be factual, and limited to what is necessary. Consider:
- Is there a good reason to record or disclose the information?
- Is it necessary to specify the information?
- Can the purpose be achieved by “telling less?”
- Is it necessary to name the person infected and/or in the home quarantine?