The right of employers to receive information on the results of collective employee Covid-19 testing in context of personal data processing

The Data State Inspectorate noted that information on a person’s health is considered a special category of personal data under General Data Protection Regulation, thus obtaining and storing such information constitutes personal data processing. In this regard the employer must be able to prove on which legal basis referred to in GDPR his request for processing of Covid-19 testing data of its employees is based on. 

In regards to national law, Section 10 (2) of Law on the Rights of Patients states that information regarding a patient may only be disclosed with his or her written consent or in other cases explicitly prescribed by this Law. For instance, according to Subparagraph 14 of Section 10 (5) provides a right to disclose patient information to employer if there has been an accident which has occurred at the workplace. Section 2 of the Cabinet Regulation No.950 “Procedures for Investigation and Registration of Accidents at Work” states that an accident is an extraordinary incident which has occurred in the workplace within one working day or shift, after which health disorders have been caused to a person or the probability of health disorders occurring exists (risk of infection), or the death of the person involved has occurred. 

Considering the above infectious disease is considered to be an accident in workplace only if such illness is related to a specifically identifiable extraordinary event during the performance of work and this event directly correlates to the employee’s illness. Falling ill with an infectious disease in itself is not considered an accident in workplace. Therefore, the Data State Inspectorate concluded that currently employers have no right to obtain and process personal data directly from laboratories after a collective Covid-19 testing of its employees. Such right exists only if a specific accident in the workplace has been identified or with prior employee’s consent which complies with provisions of GDPR and Law on the Rights of Patients.