In light of the current COVID-19 crisis and the uncertainties connected therewith, many employers wonder how they can best protect their staff. Where possible, employees are encouraged to work from home. However, there are several businesses and tasks for which a remote workspace is not an option. A measure regularly proposed and implemented in these cases is compulsory temperature testing for employees at the entrances to a site or building, with a subsequent refusal of entry for employees with an elevated temperature or refusing to test.
In Germany, this approach poses several risks under German data privacy law.
From a data privacy point of view, temperature testing constitutes the processing of health data. Health data belongs to the special category of personal data, also known as sensitive data, that requires an elevated level of protection. For this reason, compulsory temperature testing has been criticized in legal literature, with the main argument being that temperature testing is not a suitable means of detecting COVID-19 infections, as individuals suffering from the virus did not necessarily suffer from fever.
Recently, the first German data protection authorities have voiced their opinions:
- In a brief statement, the data protection authority of Baden-Württemberg confirmed that employers have a duty of care with respect to their employees, which includes an obligation to reduce health risks at the work place. However, this does not authorize an employer to actively collect health data from employees.
- The data protection authority of Rhineland-Palatinate went into more detail: It explicitly denies the permissibility of temperature testing, pointing to both the aforementioned doubts as to the suitability of such tests, as well as to various alternative and less intrusive measures. According to them, this applies even where employees do not oppose the tests.
- We expect that other data protection authorities will follow suit in the coming days.
With this background in mind, we would advise that employers be cautious with respect to compulsory temperature testing in Germany, and use other ways to ensure the health and safety of their employees. For instance, the following measures have been proposed by the German data protection authorities:
- Emphasize that employees should visit their doctor as soon as they feel flu-like symptoms.
- Point out all countries that have been qualified as risk territories, and ask that employees come forward if they have recently visited one of those countries.
- Request that employees notify their employer if they have been in contact with a person diagnosed with COVID-19.
- In the event that an employer has reasonable doubt as to an employee’s ability to perform his or her tasks, employers may consider requesting that such employee be examined by a company doctor.
While there are, of course, no precedents yet, it seems unlikely that fines imposed by data privacy authorities (if any) will be very high, taking into account the wide-ranging uncertainties, rapidly changing recommendations and obligations of employers, employees, and also private persons in the era of COVID-19, and also the intentions of employers inclined to require employee temperature checks to protect their staff.