COVID-19: Measures towards Employees

Companies can collect and store the health data of their employees through self-report or questionnaires on whereabouts and symptoms. They can conduct occasion-based surveys after business trips or contact with persons with a suspected infection. In the event of a positive finding or confirmed contact with a person who has tested positive, it must be permissible to process information about the employee concerned. However, it should not be permissible to compulsorily request information on travel destinations and health status from all employees. It is also not permissible to collect general information about flu symptoms or even to have colleagues provide this information.

Taking the temperature of employees at the entrance to the premises and other medical measures (for example throat swabs for saliva samples) can be justified under narrow conditions with sect. 26  para. 3 Federal Data Protection Act. A fever measurement can be considered permissible if the results are only used for an entry control with a binary access decision or if the measures are purely voluntary without an obligation to use them.

On the other hand, it would be critical if a compulsory fever measurement were to be carried out for all employees and a detected high temperature would lead to immediate measures (if only because the temperature is not a definitive criterion for determining an infection.)

Measures involving further data processing may be justified above all when employees enter special areas where disclosure of the infection would possibly lead to a standstill of the company (boardroom, production lines).

Other measures currently under discussion are to be viewed extremely critically, for example the tracking of infected persons by mobile phone in order to better identify contact persons or the naming of specific addresses of infected. At best, such measures could be carried out by government agencies authorised to protect public health, but not by individual companies.