Since the WHO declared COVID-19 (Corona) a pandemic on 11.03.2020, the political measures to contain the virus have intensified across all countries. Employers are facing the dilemma of having to maintain normal business operations on the one hand, while at the same time complying with their duty of care towards their employees. In order to minimize the risk of infection within their business premises, they depend on additional information. Which employee has recently been in an area that is deemed risky? Do some employees already have the first disease related symptoms? Has any of my employees been confirmed carrying COVID-19? How do I communicate a COVID-19 case within my company? May I disclose names? As these questions concern personal data, the data protection regulations of the GDPR apply. Processing data is made even more difficult as health data (i.e. special categories of personal data within the meaning of Art. 9 (1) GDPR) are affected. Such data may only be processed under strict conditions. According to a statement of the EDPB, the GDPR does not hinder measures taken in the fight against COVID-19. Despite these "exceptional times", the protection of the data subjects' personal data must be ensured. The personal data of some employees may be processed – even without their consent – in accordance with Articles 6 and 9 GDPR either to comply with legal obligations or to protect vital interests.

In the last few days, the first European supervisory authorities have published statements on the issue of "Data protection and COVID-19". For a preliminary overview, we have compiled for you the rough positions of the individual supervisory authorities:

Data Protection Authority May the employer collect travel-related data from employees? May the employer collect data on COVID-19 symptoms from employees? May the employer collect data on the infection with COVID-19 from employees? May the employee disclose data concerning an infected person within the company?
Belgium No No No Identity must not be disclosed; the fact that there is a COVID-19-case in the company may be disclosed.
Denmark Yes Yes, however, limited to the necessary scope; prior information regarding purpose and extent of data processing may be necessary. Yes, prior information regarding purpose and extent of data processing may be necessary. Only if the information is necessary for preventive measures (e.g. with regard to persons who have had personal contact with someone infected with COVID-19). Information that makes identification possible should not be disclosed.
Finland No, unless the employee has provided the information voluntarily. No, unless the employee has provided the information voluntarily. No, unless the employee has provided the information voluntarily. Identity must not be disclosed; the fact that there is a COVID-19-case in the company may be disclosed.
France Yes No, this is the responsibility of the health authorities. Yes, prior information regarding purpose and extent of data processing may be necessary. Yes, however the data processing must be limited to the necessary scope.
Germany Yes May be justified in individual cases; prior information regarding purpose and extent of data processing may be necessary. Yes, prior information regarding purpose and extent of data processing may be necessary. Only if the information is necessary for preventive measures (e.g. with regard to persons who have had personal contact with someone infected with COVID-19).
Hungary No; exceptionally, questionnaires can be used if the employer has a reason to believe that an employee might be infected with COVID-19. No; as an exception, questionnaires can be used if the employer has a reason to believe that an employee might be infected with COVID-19. If the employer has reason to believe that an employee is infected with COVID-19, he can collect information on the result of a COVID-19 test; further health data may not be processed. N.A.
Iceland Yes Yes, prior information regarding purpose and extent of data processing may be necessary. Yes, prior information regarding purpose and extent of data processing may be necessary. Only if the information is necessary for preventive measures (e.g. with regard to persons who have had personal contact with someone infected with COVID-19).
Ireland Employer may ask employees to give notice if they have travelled to areas deemed risky. Questionnaires can only be used in case of increased risk. Employer may ask employees to report symptoms. Questionnaires can only be used in case of increased risk. Yes, prior information regarding purpose and extent of data processing may be necessary. Identity must not be disclosed; the fact that there is a COVID-19-case in the company may be disclosed to the extent necessary for the health authorities' ability to work.
Italy No, unless the employee has provided the information voluntarily. No, unless the employee has provided the information voluntarily. No, unless the employee has provided the information voluntarily. Only if the information is necessary for preventive measures (e.g. with regard to persons who have had personal contact with someone infected with COVID-19).
Lithuania Yes Yes, prior information regarding purpose and extent of data processing may be necessary. Yes, prior information regarding purpose and extent of data processing may be necessary. Identity must not be disclosed; the fact that there is a COVID-19-case in the company may be disclosed.
Luxembourg Yes No; systematic processing (e.g. questionnaires) or individual requests are prohibited. Yes, prior information regarding purpose and extent of data processing may be necessary. Identity must not be disclosed; the fact that there is a COVID-19-case in the company may be disclosed.
Netherlands No, unless the employee has provided the information voluntarily. No, unless the employee has provided the information voluntarily. No, unless the employee has provided the information voluntarily. Identity must not be disclosed; the fact that there is a COVID-19-case in the company may be disclosed.
Norway Yes, employees can ask questions related to COVID-19. Yes, employees can ask questions related to COVID-19; prior information regarding purpose and extent of data processing may be necessary. Yes, employees can ask questions related to COVID-19; prior information regarding purpose and extent of data processing may be necessary. Only if disclosure is necessary to ensure "a safe working environment"; disclosure to third parties is not permitted.
Poland Yes Yes, prior information regarding purpose and extent of data processing may be necessary. Yes, prior information regarding purpose and extent of data processing may be necessary. N.A.
Spain Yes Only if no other measures (such as home office) come into consideration. Yes, prior information regarding purpose and extent of data processing may be necessary. Only if the information is necessary for preventive measures (e.g. with regard to persons who have had personal contact with someone infected with COVID-19).
United Kingdom Yes May be justified in individual cases; prior information regarding purpose and extent of data processing may be necessary. Yes, prior information regarding purpose and extent of data processing may be necessary. Only if the information is necessary for preventive measures (e.g. with regard to persons who have had personal contact with someone infected with COVID-19).

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.