The coronavirus has held the Netherlands in its grip for more than two weeks. Businesses and organizations inside and outside the vital sectors need to be constantly and rapidly responding in order to identify and deal with the impact of the virus. Are employers allowed to collect data on the spread of the virus in order to monitor the continuity of the business operations? Is it allowed to check the temperature in the workplace? Unfortunately, the reaction of the Dutch DPA (Autoriteit Persoonsgegevens (‘AP’)) to the coronavirus leaves much to be desired in terms of both speed and content. This leads to confusion and uncertainty. Take, for example, the question of whether the temperature of employees may be checked. Earlier, the AP definitely said ‘no’, on Monday 23 March the AP said ‘yes, in the healthcare sector’, but now this is no longer reflected on the website. The question now is whether this is a deliberate action by the AP. Is it not allowed to check the temperature (after all)? Checking the temperature should be tolerated in 'the vital sectors'.
Two weeks ago, the AP´s first reporting on checking employees´ temperature was strict: As an employer, you should normally not take the place of a doctor by drawing conclusions about the health of individual employees. For Example [...] by recording their temperature. Unfortunately, at the moment we do not live in times of ‘normally’, but in times of the coronavirus. Employers are responsible for the health and safety of all their employees in the workplace. In these special times, this duty of care requires that, where possible, they prevent employees from being infected by a colleague who has the virus. For this reason, it may be desirable to check the temperature at the entrance and not allow workers with fever to enter the workplace. It is not so much about recording the temperature, because ‘'certainty through statistics’ and sufficient to send a person home.
Last Monday, 23 March, the AP turned out to have adjusted its position: in the healthcare sector, checking the temperature is allowed in the workplace. However, four days later this was removed from the AP´s website.
This raises questions about the position of the AP. Why has the exception for the healthcare sector disappeared from the website? Is this a matter of advancing insights? A changed position of the AP? Or was this crucial information accidentally lost during the realization of the new corona file on the website? In these hectic times in which everyone hungers for information, the AP is also expected to draw a clear line. Precisely because the AP has the power to impose fines and very recently caused a lot of commotion by imposing a very high fine on the Royal Dutch Tennis Association (KNLTB), whereby the (strongly criticized) interpretation of the standard was made public by the AP shortly before the decision to impose a fine. The example illustrates that there appears to be a reason to follow (changes in) the interpretation of the standard by the AP closely.
With regard to checking the temperature in the workplace, the widening of the AP´s position was welcomed. Nevertheless, it was odd that, in the view of the AP, checking can (apparently) only be permitted in the healthcare sector. After all, the government has communicated what the ‘vital sectors’ and professions are that we now need to keep society running. A further widening of the position of the AP to these sectors and professions would therefore be reasonable. Please provide a brief summary of preconditions: for example, employees must be clearly informed in advance about the new access policy to the workplace because of the coronavirus; the temperature of employees may be checked by a designated employee (this does not have to be the company doctor); a clear maximum temperature is set and anyone who appears to have this temperature may not enter the workplace and is requested to go home; the results of the check are not recorded/retained (but of course indeed the fact that an employee is not available for work).
It may be difficult for the AP to loosen the reins and make this clearly known precisely because it concerns the processing of health data (a special type of data for which, in principle, the ban on processing applies with limited exceptions) in the workplace (where the employee is in a vulnerable position because of the relationship of authority) and there are obvious privacy risks. However, in times of crisis, flexibility and creativity are expected from everyone. Also from the supervising authority.
If you have any questions regarding Dutch DPA (Autoriteit Persoonsgegevens (‘AP’)) in times of the coronavirus, please contact Hester de Vries.
