During the last year, due to the COVID-19 pandemic all over the world but also in Latvia, a lot of questions on the health data into the working places have been raised.
While we are trying to get back into a normal working environment, employers carry out collective test for COVID-19 in order to limit the diffusion of the infection into the organization, provide to employees health conditions and permit them to get back to work.
Frequently employers desire receives information on COVID-19 results carried out by all the employees by processing information on health data of each single employee.
In order to get a response to the relevant question on the right of the employer to process personal data of employees by processing information on their health conditions during the pandemic, the Authority provides a response on the question:
Does the employer have the right to receive positive results to COVID-19 tests of employees who have been tested by the laboratory?
The National Inspectorate indicates that information on the health status of a natural person, for example, if an employee has been infected by the virus or not, is a specific categories of data according to the General Data Protection Regulation (here in after Regulation), or the storage of those information in a electronic system constitute the personal data processing.
Information on the health status of persons (in this specific case employees) can be processed only pursuant to the procedure under the article 9 of the Regulation. Before starting the processing, it is necessary to understand if it will be justified. Consequently, the employer shall be able to justify on which legal basis pursuant to articles 6, paragraph 1 and article 9, paragraph 2 of the Regulation are processed names, surnames and COVID-19 tests results.
In addition to provide a legal basis, pursuant to article 5 of the Regulation, the data controller shall respect other conditions required into the Regulation, based on which any personal data processing shall be lawful, fair and transparent and only for the specific purpose and in the necessary measure.
The Data Inspectorate explains that the section 10, paragraph 2 of the Law on Rights of Employees provides that information on them can be shares only under his/her written consent or in cases specified by this Legislation. If the employee has not given the consent to a medical institution (for example a laboratory) in order to provide to the employer (direct) information on COVID-19 test, the employer has not any legal basis to receive those information, unless that the Section 10, paragraph 5 of the Law on Patient’s rights. Paragraph 14(5) of the Covers Act provides that, upon written request and written permission of the head of the medical institution, information on the patient shall be provided to the employer of the employee injured in an accident at work no later than within five working days of the request – for the purpose of investigation of the accident at work in accordance with the normative acts regulating the procedure for investigation and record-keeping of accidents at work.
Under this current situation, the Data State Inspectorate does not consider that the employer has a legal basis to process information on the employee’s health directly after the collective tests by obtaining results of a COVID-19 positive tests. At the same time, we recall the attention on the idea that those rights can appears to the employer only if an if an accident has been established.
Please notice that if those circumstances will change, the explanation prepared by the Data Inspectorate could change.