Employer data relating to COVID-19

Employer data relating to COVID-19

 "There are rumours that some of my colleagues have tested positive for COVID-19 in the company where I work. To what extent is our employer entitled to disclose information about the health of its workers? " F, Onex

Generally speaking, as part of the employment relationship, the employer necessarily has access to personal information about its employees, such as their private address or the reason for any absences. The employer may also have access to certain more sensitive data about an employee, such as health data.

To protect employees' personal data against improper use, the Federal Data Protection Act (DPA) sets out the legal framework for the processing of any information relating to an identified or identifiable person. When the data in question relates to the health of the person concerned, it becomes 'sensitive' data, which makes the conditions for its communication more stringent: in particular, no one may communicate sensitive data to third parties without being able to show a justifiable reason, which makes it possible, where appropriate, to make an infringement of the person's personality lawful. The most obvious justification is the consent of the data subject; if the data in question is sensitive, this consent must be explicit, in the sense that the data subject must be clearly informed, in particular about the purpose of the processing of information concerning him or her.

An overriding interest overriding the data subject's interest in not having his or her personal data disclosed may also constitute a justifiable reason. The concept of overriding interest is, of course, open to interpretation: in the case of a communicable disease, the employer's obligation to protect the health of its employees could be weighed in the balance. It might, for example, be necessary to inform a company's employees that they have been in contact with a sick colleague in order for action to be taken. However, caution is called for, particularly when the information is sensitive, and the consent of the person concerned should be sought wherever possible.

Therefore, even if there is a valid reason, the employer must comply with certain principles when processing personal data. In particular, they must clearly indicate the purpose of the data processing and any intervention must be proportionate to the circumstances. Consequently, if it is possible to announce within the company that a person is infected without disclosing his or her identity, this is the preferred method.