Data Protection in Lithuania during Covid-19

On March 17, 2020 Article 49 of the Labor Code of the Republic of Lithuania (hereinafter - the Labour Code) was amended as follows “when the Government of the Republic of Lithuania declares an emergency situation or quarantine in order to ensure the health protection of employees and third parties, the employer must offer in writing to work remotely to such employee whose health condition endangers the health of other employees. The employer’s offer to the employee to work remotely must include the reason, time period and legal basis for such offer.”

The Lithuanian State Data Protection Inspectorate has provided an explanation, that such provision essentially means, that if an employee has an illness that threatens to other employees health, such employee should inform the employer about the fact of such illness which endangers the health of other employees, but indicating only the fact of the illness or that there are circumstances that he might have been infected with such illness. Therefore, in order to comply with the principle of data minimisation, the employee provides to the employer only such information which would obligate the employer to enable the employee to work remotely. And the employer in the offer to work remotely should not indicate the certain employee's illness as the reason for remote work, but should choose instead a less intrusive reason for an employee’s privacy, such as the health protection of other employees.

The Lithuanian State Data Protection Inspectorate also informs that employers may process certain personal data of employee’s related to the current coronavirus (COVID-19) situation and that it is in compliance with the GDPR.

An employer has the right to ask it’s employees or visitors whether they have symptoms of COVID-19 or have been diagnosed with COVID-19. This information is important for the employer in assessing whether additional protective measures are needed, such as requiring staff who have worked together or who have been in contact with a sick / symptomatic person to undergo quarantine, to provide with a possibility for remote work or a health check. However, it is to notice that the right of access to this information does not imply that employers can document the information received or compile relevant data files. Employers should also refrain from collection of temperature measurements and medical records of employees and visitors. This cannot be regarded as the employer's duty.

• Whether the employee was traveling to a "state of risk";
• Whether the employee was in contact with a person traveling to a "state of risk" or suffering from COVID-19;
• Whether the employee is at home due to quarantine (without giving a reason) and the quarantine period;
• Whether the employee is ill (without specifying a specific disease or other cause);
• Employers may also process personal data relating to the employee, such as the fact of remote work and other restrictions to the employee's work.
• Provision of information to public authorities: Employers may provide information to public authorities if there is a clear basis for doing so. For example, for statistical purposes (in such case the provision of identification of a particular data subject must be avoided).
  

The Lithuanian State Data Protection Inspectorate has issued the recommendation for the teleworking. If due to teleworking the employer collects more personal employee’s data, then usual, he has to inform employees accordingly (transparency principle). If employer decides to monitor employees (to monitor e-mail correspondence, conversations, employee’s actions while using the employer’s PC or mobile device, etc.) the employer has to perform the PIA, to inform employees accordingly, to prepare necessary policies. It is recommended to establish and announce clear guidelines for teleworking. The employers are advised to evaluate and to designate particular allowed secure working tools, devices and systems (secure teleconferencing, connection to employers servers, etc.).