France’s Data Processing Authority CNIL weighs in on Coronavirus and GDPR.
Employers should NOT:
- Collect in a systematic and generalized manner, or through individual inquiries and requests, information relating to the search for possible symptoms presented by an employee/agent and their relatives.
This means:
- No mandatory readings of the body temperatures of each employee
- No mandatory questionnaires on symptoms
Employers SHOULD:
- Implement actions to prevent professional risks, and provide information and training.
This means:
- Educate and invite its employees to self-check.
- Provide means for reporting symptoms.
- Promote remote working methods and encourage the use of occupational medicine.
If an employee reports an illness, an employer may record:
- The date and identity of the person.
- The organizational measures taken (confinement, teleworking, orientation and contact with the occupational doctor, etc.).
— Employees must inform their employer of any suspected contact with the virus.
— Health authorities may collect health data.