DPA case 07121-1/2020/390 – Dismissed (Slovenia, 2020)

The Information commission (the IP) received a request for advisory opinion on what personal can be obtained from a doctor regarding an employee’s sick leave. In particular, it has been asked what information the doctor is required to disclose to a licensed detective acting on the behalf of an employer, to monitor employees. First, the IP recalled that the processing of employee’s personal data by the employer is based on Article 6(1)(c) GDPR. In this regard, Article 48 of the Slovenian Act (No. 21/13, 78/13 - afterwards, 47/15 - ZZSDT, 33/16 - PZ-F, 52/16, 15/17 - dec. US, 22/19 - ZPosS and 81/19, hereafter ‘ZDR-1’), provides that workers’ data may be processed and shared with third parties only if it is prescribed by law or when it is necessary for the exercise of the rights and obligations arising from or in relation to the employment relationship. Then, the IP explained that the control of the sick-leave can be necessary for the exercise of rights arising from the employment relationship. Indeed, Article 110(1) of the ZDR-1 provides that an employer may end the working contract if the employee does not follow the doctor’s instructions during his sick leave. Also, the employer is allowed to hire a detective to obtain information about abuses of rights by employees. Specifically, the detective may obtain on the behalf of the employer information on the instructions given by the doctor in relation to the sick leave. However, the doctor is not obliged to provide the data. Lastly, the IP pointed out that the employer is also allowed to obtain information on the reasons why the worker reduced and adjusted his working schedule (eg sickness, injury outside work, occupational illness, injury at work) for the compensation wage calculation through the Health Insurance Act.