France’s Data Processing Authority CNIL weighs in on Coronavirus and GDPR.

Employers should NOT:

  • Collect in a systematic and generalized manner, or through individual inquiries and requests, information relating to the search for possible symptoms presented by an employee/agent and their relatives.
This means:
  •  No mandatory readings of the body temperatures of each employee
  • No mandatory questionnaires on symptoms

Employers SHOULD:

  • Implement actions to prevent professional risks, and provide information and training.
This means:
  • Educate and invite its employees to self-check.
  • Provide means for reporting symptoms.
  • Promote remote working methods and encourage the use of occupational medicine.

If an employee reports an illness, an employer may record:

  • The date and identity of the person.
  • The organizational measures taken (confinement, teleworking, orientation and contact with the occupational doctor, etc.).

— Employees must inform their employer of any suspected contact with the virus.

— Health authorities may collect health data.

Read CNIL’s full briefing on Coronavirus-related data.