Covid19

Data Protection Authorities for France and the Netherlands have weighed in on the use of temperature taking in the fight against the spread of COVID-19.

Netherlands’ Autoriteit Persoonsgegevens:

“We hear that all kinds of organizations use different means to check people quickly for fever. Not only with a thermometer, but also with thermal cameras”

“That’s not allowed. This is a serious offense under [GDPR] . If this happens, we will enforce.”

“We don’t want to wake up in a few months in a society with a kind of Chinese situation, in which the employer is constantly watching you and can even see your care data and have all kinds of consequences.”

  • Employers may not check people’s temperature and process their health data.
  • Consent as a legal basis is not possible in an employment relationship, because an employee may feel pressured to give permission.
  • Only a doctor should do health tests and process the medical data of personnel.
  • You may not check temperature of visitors or vendors either. Consent here is not possible because there is no equivalence here either. The visitor will feel compelled to agree.
  • Employees of companies that measure temperature should report this to the works council and to the data protection officer.
Spain’s Agencia Española Proteccíon Datos:

“Temperature taking of people to determine the possibility that they may access work centers, shops, educational centers or other types of establishments or equipment represents a particularly intense interference with the rights of those affected. On the one hand, because it affects data related to people’s health, not only because the value of body temperature is a health datum in itself but also because, from it, it is assumed that a person suffers or not [from] a specific disease, such as coronavirus infection.”

  • A possible denial of access to an educational, labor or commercial center, especially in public and seen by others, can have a significant impact on the person affected.
  • Because Coronavirus is often asymptomatic, there may be other, less invasive ways to accomplish the purpose.
  •  Consent to temperature taking as a condition to entering a space is not freely given.
  •  Legitimate interest is not a potential legal basis for this.
  •  Data collected through temperature must not be used for any other purpose.

Details from Autoriteit Persoonsgegevens and Agencia Española Proteccíon Datos.