COVID-19: Assessing the Health of your Employees and Data Protection

As the COVID-19 pandemic continues to disrupt workplaces across Ireland and is likely to continue to do so for the foreseeable future, it is critical for employers to be aware of their confidentiality and privacy obligations towards their staff.

Privacy and data protection laws are of particular importance where an employer becomes aware that a member of staff may have contracted COVID-19. While the majority employers will be aware that they are obliged to provide a safe workplace environment and protect the health of their employees pursuant to the Safety, Health and Welfare at Work Act 2005, these obligations must be balanced against the privacy and data protection rights of the affected employee.

A practical example of this balancing act would be in a situation where an employer has been informed by a member of staff that he or she has contracted COVID-19, and the employer wishes to inform other employees of this development in order protect their safety in the workplace. Any data relating to this employee’s health, in other words the data relating to the fact that this employee has contracted COVID-19, is known as ‘special category data’ under both the GDPR and the Irish Data Protection Act 2018.

Special Category Data

Processing of special category data is generally prohibited subject to certain exemptions, one of which being that processing of special category data may be undertaken where necessary for public interest reasons in the area of public health. It is likely that given the current pandemic, employers may be permitted to use this exemption as a legal basis for processing health data of employees who may have contracted COVID-19 where necessary to do so in the public interest.

However, employers should take care in relying on this exemption, particularly as it only applies where measures are implemented by the employer to protect the fundamental rights and freedoms of an employee who may have contracted COVID-19. These measures should include, in particular, limiting access to the affected employee’s health data in order to prevent unauthorised consultation, alteration, disclosure or erasure.

For employers, it is therefore advisable from a practical perspective to limit the processing of an employee’s health data wherever possible. In the event that a member of staff informs his or her employer that he or she may have contracted COVID-19, the employer should inform staff that there has been a case or suspected case without naming the employee and ensure that any data relating to this employee’s health is processed only where necessary in a secure manner and for no longer than strictly necessary.

How we can help

If you have any queries or concerns, or would like to discuss the above in further detail, please feel free to contact Joe McVeigh or Lee Taren in our Privacy & Data Security Team.

This article is for general information purposes.  Legal advice must be obtained for individual circumstances.  Whilst every effort has been made to ensure the accuracy of this article, no liability is accepted by the author for any inaccuracies.