DPA case 0611-608/2021/9 – Violation Found (Slovenia, 2022)

The controller is an employer (company) that had dealt with a mass infection of COVID-19 at the company. To prevent this from happening again, the controller collected the full name and medical condition of employees who were positive with COVID (the data subjects). It then sent out an email to all of the other employees who may have been in contact with an infected employee, by informing them of the person who had been tested positive for COVID. Moreover, the controller did not keep a database of all persons infected with COVID and had informed all employees about their rights under Article 13 GDPR. The DPA started an investigation ex officio into the processing of health data and whether the controller was compliant with the GDPR. The DPA noted that informing employees who may have been in contact with an employee of the fact that they have been in contact with an infected colleague, was a preventive measure of public health protection. However, it found that the controller could have also informed these employees without disclosing the infected employees' full name. According to the DPA, the objective of preventing a mass-spreading could still have been achieved this way. Consequently, the DPA found that the controller unlawfully processed the infected employee's health data, pursuant to Article 9 GDPR, and violated the principle of data minimisation, Article 5(1)(c) GDPR. The DPA ordered, pursuant to Article 58(2)(d), to bring the controller's processing operations into compliance with Article 5(1)(c) GDPR and Article 9 GDPR, and thus to inform employees who had contact with a positive employee, without providing that positive employees' name.