DPA case 07120-1/2020/345 – Violation Found (Slovenia, 2020)

The individual requesting the opinion is an employee at a primary school that required its employees to obtain a signed statement specifying whether or not they belonged to an "at-risk" group of workers who would be unable to carry out their work on a school premises due to the SARS-CoV-2 (COVID-19) crisis. Alongside the statement, employees were asked to include evidence supporting it, such as personal health records. Does the GDPR permit employers to obtain and store data regarding their employee's health in the form of signed statements or personal health records? According to the IP, for the purposes of Article 9(2)(b) GDPR, employers are only entitled to process (ie obtain and store) general information on their employee's health for employment purposes, such as a statement declaring their inability to work in a specific workplace. Article 9(2)(b) GDPR does not permit the processing of more specific health data, such as personal health records. However, there may be some exceptions to this, such as an employee's estimated time of leave, or if the employee has a particular movement regimen determined by the doctor.