Coronavirus: privacy in the company among scanners and self-certifications

But, in the emergency, some companies have also adopted measures such as the obligation for the employee and the visitor of the company to be inspected through thermal scanner that collects and stores “special categories of personal data” (e.g. body temperature), or to self-certify in writing that they have not recently visited areas at risk, but also that they have not met people from these areas or even that they have not had a temperature equal to or higher than 37.2 in the last two weeks.

But if on the one hand, as confirmed by the opinion of Italian Supervisory Authority, the need to safeguard the safety and health of citizens allows a compression of their confidentiality for extraordinary reasons and public interest, the same cannot be said for companies.

Firstly, private entities, such as companies, do not have the exemption from the obligation to request the data subject's consent; secondly, the principle of minimisation of processing, that is the collection of the minimum and necessary amount of data, is ignored.

Thus, what is the utility of inspecting the person through a thermal scanner where it collects and keeps 'particular data' or through the specific self-certification, and what is the benefit of the consequent collection of personal data compared to a simpler communication addressed to a series of unidentified recipients?

The GDPR regulation requires pursuing a purpose with as little personal data processing as possible, if not even avoiding it. This, in this specific case, could well be done with a simple replacement of the self-certification form with a communication to employees, or with a notice posted at the entrance of the company inviting anyone who has stayed in areas at risk or present symptoms not to enter the premises.

Moreover, it is necessary to evaluate all the other legal profiles that could arise from the collection of data through scanners and self-certifications. In particular, the latter require an assessment of the legal value of the document, as well as the need to demonstrate the truthfulness of the information provided.