What are the data protection implications of temperature checks as a Covid-19 precaution? This article investigates, with reference to a current investigation by the Hesse Data Protection Commissioner.
After the phase of coronavirus-related remote working, still in use in many companies, the question now arises as to what measures must and may be taken when returning to work onsite, to check whether an employee may have become infected with the coronavirus. One well-known measures is temperature checking. This is already being practised in many countries, but in Germany it is controversial, especially with regard to data protection issues. The Hesse state data protection commissioner recently tackled this issue in relation to retailers.
What is at stake?
After the corona-related forced closure of the retail trade, many shops have introduced an obligation to use mouth-nose-coverings when they reopen and a limit on the number of people who can be in the shop simultaneously. Some retailers have also introduced an obligatory temperature check to restrict access. If a temperature reading is abnormal (elevated temperature can indicate suspected coronavirus infection), the person may not enter the shop.
Subject of the examination of the State Data Protection Commissioner of Hesse
In this context, the Hesse State Data Protection Commissioner is currently examining, firstly, whether body temperature measurements are personal date at all, secondly, whether it is proportionate to collect this data, and thirdly, whether the data collected but not recorded is in fact stored, given that video surveillance footage is also available.
Personal data
Under Article 4(1) of the GDPR, personal data is any information relating to an identified or identifiable natural person. Although body temperature measurement is an individual characteristic of individuals, there is only a concrete reference to the person that person's name, at least, is known. If, as here where temperature checks relate to access to a shop, the temperature measurement is not assigned to an individual, no personal data is likely to be created, at least as long as payment (e.g. by credit card) does not associate a temperature measurement with a specific individual.
The situation may be different, on the other hand, for temperature measurements for employees, since employees' names are known and a direct reference to the measured body temperature can be established without further steps.
Parallel video surveillance
Furthermore, the Hesse data protection commissioner assessed whether parallel video surveillance and recording of individuals and checking their temperature can result in the storage of personal data. This could be the case if the temperature check is actually visible on the video. Recording body temperature by means of video cameras should therefore be avoided as far as possible.
Proportionality
In principle, personal data may also be collected to a certain extent in the employment relationship with the aim of protecting the health of the general public on the basis of s26 of the Federal Data Protection Act. To degree, this principle also applies to customers who wish to enter a retail outlet. In this context, however, the Hessian data protection authority has queried whether the invasion of privacy caused by temperature checks is still appropriate. Furthermore, it is questionable whether temperature checks are an effective measure to prevent or contain the spread of Covid-19. Although fever symptoms sometimes occur during illness with Covid-19, this is not always the case, and fever is not its ‘unique selling point': it is often a symptom of ‘normal' cold or flu. Ultimately, temperature checks may create a false sense of security, which may not be proportionate, given the data collected data.
Conclusion and outlook
To date the Hesse State Data Protection Commission assessment is not conclusive; they are initial thoughts and arguments and it remains to be seen how the authority will finally position itself. Furthermore, the assessment initially refers only to customers. Conclusions could, however, be drawn for employers who are considering carrying out temperature checks on their employees, relating both to the question of the existence of personal data and the proportionality of the measure. For the assessment of the latter, further scientific findings on Covid-19 virus may be decisive. At present, employers are advised to carry out temperature, if necessary only with employees' consent. In any case, recording this data and permanently linking it to named employees concerned is not advisable.
Originally published 04 August, 2020
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
