Data Protection Authorities for France and the Netherlands have weighed in on the use of temperature taking in the fight against the spread of COVID-19.
Netherlands’ Autoriteit Persoonsgegevens:
“We hear that all kinds of organizations use different means to check people quickly for fever. Not only with a thermometer, but also with thermal cameras”
“That’s not allowed. This is a serious offense under [GDPR] . If this happens, we will enforce.”
“We don’t want to wake up in a few months in a society with a kind of Chinese situation, in which the employer is constantly watching you and can even see your care data and have all kinds of consequences.”
- Employers may not check people’s temperature and process their health data.
- Consent as a legal basis is not possible in an employment relationship, because an employee may feel pressured to give permission.
- Only a doctor should do health tests and process the medical data of personnel.
- You may not check temperature of visitors or vendors either. Consent here is not possible because there is no equivalence here either. The visitor will feel compelled to agree.
- Employees of companies that measure temperature should report this to the works council and to the data protection officer.
Spain’s Agencia Española Proteccíon Datos:
“Temperature taking of people to determine the possibility that they may access work centers, shops, educational centers or other types of establishments or equipment represents a particularly intense interference with the rights of those affected. On the one hand, because it affects data related to people’s health, not only because the value of body temperature is a health datum in itself but also because, from it, it is assumed that a person suffers or not [from] a specific disease, such as coronavirus infection.”
- A possible denial of access to an educational, labor or commercial center, especially in public and seen by others, can have a significant impact on the person affected.
- Because Coronavirus is often asymptomatic, there may be other, less invasive ways to accomplish the purpose.
- Consent to temperature taking as a condition to entering a space is not freely given.
- Legitimate interest is not a potential legal basis for this.
- Data collected through temperature must not be used for any other purpose.
Details from Autoriteit Persoonsgegevens and Agencia Española Proteccíon Datos.