FAQ on the website of the Dutch DPA in relation to Corona

Not long after the Italian Supervisory Authority published guidance for employers on COVID-19 related data processing, the Dutch Data Protection Authority has followed and issued brief guidance in one of the FAQ items on its website.

In the following weeks the Dutch DPA has adjusted its Guidance various times, and after sharply condemning temperature checks, the Dutch DPA made a "U-turn" and aligned its position with that of many other Supervisory Authorities.

In a nutshell, temperature checks are not in scope of the GDPR if only the temperature value is taken from the device and nothing else is done with it. However, of the temperature values are recorded and / or processed in an automated system, then the activity is subject to the GDPR.

For the non-Dutch speaking privacy practitioners we have prepared an unofficial translation of this FAQ item, which can be found here.

Am I allowed to check my employees for Coronavirus?

As an employer, you hardly ever have the right to register and record medical data of your employees yourself. However, you can call in the occupational health and safety service or company doctor to check for corona.
That said, circumstances depending, it can be permitted to deploy access controls based on temperature checks, if the outcome of the temperature checks is not recorded or otherwise processed. Furthermore, it is especially important to follow the current advice of your local health service (GGD) and the National Institute for Public Health (RIVM).

Special category personal data

Health data are special personal data and are therefore extra protected. As an employer, you should not normally step in the shoes of a doctor by drawing conclusions about the health of individual employees. For example, by keeping a record of where employees have been on holiday. Or by recording their temperature. You can find more information in our file 'My sick employee'.

Company doctor

Your employees can, of course, go to the company doctor or occupational health and safety service. If he or she suspects that your employee has the Coronavirus, he or she will contact the regional GGD as a matter of urgency. In consultation with you, the Municipal Health Service (GGD) can then take measures for on the shop floor.

Follow the advice of the Municipal Health Service and the National Institute for Public Health and the Environment (RIVM).

We're facing a special situation right now. The new Coronavirus is a contagious disease that is spreading worldwide and against which major measures are being taken. It is a task of the government in collaboration with the GGD to prevent the further spread of the Coronavirus. Also in the workplace. Therefore, follow the current advice of your regional GGD and RIVM.

{Unofficial translation of guidance on the Dutch DPA's website on temperature checks, updated May 2020}

Temperatures and health check

During the corona crisis, as an organisation, you may want to apply access control measures, and in that context take the body temperature of your employees, visitors or customers before they are granted access to your premises.

Or, you are an entrepreneur carrying out a "contact profession" or active in the hospitality industry. In that case, you will have to do a health check with your customers, also known as a check interview.

What is and is not allowed in these situations to prevent corona infections?

Temperatures during corona

1. Temperatures are not allowed as this typically entails the processing of medical data. That falls under the data protection laws, the General Data Protection Regulation (GDPR).

2. The GDPR does not apply if only the temperature value is taken from the device and nothing else is done with it. That is, if the temperature is not recorded and does not end up in an automated system.

3. See further: Why is temperature checking as access control typically fall in scope of the GDPR?

Processing medical data

4. Someone's temperature is a medical condition. And that's an extraordinary piece of personal data. It is usually prohibited to process special personal data, unless there is an exception in the law.

5. The only exception that could apply in this situation is if the person you want temperatures gives explicit consent. But beware: permission does not always apply, because it will often not be free. For example, you cannot ask consent if you are an employer.

Is temperature useful?

6. In addition to privacy concerns, there are doubts about the effectiveness of temperatures. The RIVM indicates that only a small proportion of infections show an increased body temperature. This means that the majority of infections do not appear at temperatures.

Health check during corona

7. Are you an entrepreneur with a contact profession? Or entrepreneur in the hospitality industry? Then you need to ask your customers a number of questions before they are allowed to visit you. This is also called a health check or check conversation.

8. Please note that you may ask your customers about their health, but do not register the answers. You may also not ask these questions when making an online reservation.

Explore More Insight