Can employers take employees’ temperatures before they enter the workplace?
As the measures adopted to avoid the spread of COVID-19 are loosened, employees can gradually return to their workplaces. The Office for Personal Data Protection (OPDP) has dealt with the question of whether employers are authorised to take their employees’ temperatures as a precondition for entering their workplace.
An elevated body temperature is one of the typical symptoms of COVID-19. But information about body temperature can be classified as sensitive data on the health condition of employees. As such, its processing constitutes an interference with privacy and possibly with other rights of employees, e.g. should they subsequently be prevented from entering the workplace.
To avoid any doubts, the OPDP has announced that under the current exceptional circumstances, taking employees’ temperatures before their entering the workplace can be considered personal data processing in the employer’s legitimate interest as it helps to ensure that the employer meets its labour law obligations aimed at preventing risk to employees’ health. The Labour Code stipulates a duty for employers to create safe and harmless working environment and working conditions through suitable organisation of occupational safety and health protection and by adopting risk-prevention measures.
However, the employer should always keep the measures adopted up to date with regard to the nature of the workplace, the number and concentration of employees and possibly other persons present at the workplace, as well as the current development of the pandemic. In case of any doubts, the OPDP recommends to consult medical professionals.
Furthermore, the OPDP added that taking employees’ temperatures would not always be considered personal data processing under the GDPR, such as in cases where the temperature taken is not recorded in connection with the name or other data of specific persons allowing for their identification. For instance, if there was a sensor in place taking temperatures of the persons passing through and merely reporting elevated temperatures detected by the sensor, without recording any data, personal data would thus only be processed in relation to specific employees detected by the sensor. These could then be dealt with by an authorised employee.
In conclusion, the OPDP emphasises that after the state of emergency ends, these extraordinary measures will no longer be justified. Employers should cancel them and only reintroduce them should the situation get worse again, e.g. in case of a new wave of the pandemic.