The European Data Protection Supervisor has issued guidance on data protection and body temperature taking.
Key takeaways:
- Basic body temperature checks designed to measure body temperature only, operated manually and not followed by registration, documentation or other processing of individuals’ personal data are, in principle, not subject to the regulation.
- Other systems of temperature checks, operated manually or automatically, followed by the processing of individuals’ personal data are subject to the regulation.
- Depending on the processing capabilities of the systems used, additional data protection safeguards need to be implemented.
- Institutions should design body temperature checks such that the amount of collected personal data is minimized.
- Temperature checks carried out on a mandatory basis should not be based solely on automated processing. Human involvement should be provided at relevant stages of the temperature checks.
- Review the necessity and proportionality of such measures regularly, in light of the evolution and scientific understanding of the epidemic.