DPA case 07121-1 / 2020/387 – Order (Slovenia, 2020)

The IP received a request whether at the time of the pandemic, an employee may be required to notify an employer about the infection with the corona virus. The purpose of such notification would be to ensure safe working conditions in the unit where the employee performs their work. The IP was of the view that the employer may request that employees inform the employer about the infection, if the NIJZ deems it necessary. Such information falls under the special category personal data under Article 9 GDPR. The processing of such data is prohibited unless one of the exceptions referred to in Article 9(2) GDPR applies. In the event of the COVID-19 pandemic, which threatens both the individual and public health, these exceptional circumstances may require measures that interfere with the processing of special category personal data. The IP held that the measures that otherwise interfere with the processing of special category personal data may be in the interests of protecting the vital interests of employees, the legitimate interests of the company, and in the public interest. If such a member of the medical staff decided that an obligation to process the health data exists, the explicit consent cannot be a suitable basis for processing since the legal basis derives from the above mentioned rules and labor law. The principle of proportionality should always be respected and only the data that is necessary to achieve the purpose should be processed. However, this information must be adequately protected by the employer. In principle, statistics (eg, only information on the occurrence of an infection in a particular company, class, floor, etc.) are sufficient to provide further information, without other information that enables the individual to be identifiable. Therefore, there is no reason to collect such data in all organizations and companies, since in principle such information is provided through the NIJZ epidemiological service. Should the NIJZ epidemi