This article was published in 2020. Laws, case law and regulatory guidance may have changed since then. Contact us for up to date advice.
Introduction
In the fight against the coronavirus (COVID-19), companies and institutions want to measure the body temperature of employees or visitors. What rules apply? What does the privacy regulator, the Dutch Data Protection Authority (AP), think about it? When does the General Data Protection Regulation (GDPR for short) apply? What can you do to limit any infringement of privacy as much as possible? One thing is certain: measuring temperature is not simply allowed under the GDPR.
Body temperature of employees or visitors
By measuring the body temperature of employees or visitors, organisations can find out whether an employee or visitor has a fever. That is one of the symptoms of infection with the coronavirus. But because body temperature says something about a person’s health, this data may not simply be processed: strict rules apply. Only doctors may carry out such tests and process the data; employers may not. According to the regulator, this means that organisations may not take the temperature of their visitors and/or employees. Employers may not measure or record the temperature of employees either. At least, this was the initial response of the Dutch Data Protection Authority.
Not much later, the Dutch Data Protection Authority announced that only employers in the healthcare sector may check their employees for symptoms of illness.
A little later, on 24 April, the Dutch Data Protection Authority published a clear statement on its website about measuring the body temperature of employees. The regulators: “An entrepreneur may not play doctor. Only a doctor may carry out health tests and process the medical data of staff”, according to the regulator.
When does the GDPR apply to measuring body temperature?
Let us be clear from the outset: not every processing is processing within the meaning of the GDPR. This means that the GDPR does not necessarily apply if you wish to measure the body temperature of your employees, visitors or customers before they are given access to, for example, the office, the shop or the hospital.
The GDPR applies if there is wholly or partly automated processing of personal data. In addition, the GDPR may also apply to the manual processing of personal data. This is the case if the personal data is or will at some point be included in a filing system. In other words, the intention is that the results of the measurements are recorded somewhere.
Does it merely concern reading the body temperature, without you wishing to store this data anywhere or pass it on to third parties? Then there is no processing of personal data within the meaning of the GDPR. In that case, measuring body temperature, or reading the measurement, does not fall within the scope of the GDPR. This means that it does not fall under the supervision of the Dutch Data Protection Authority either. The GDPR therefore does not apply if you merely give employees, visitors or customers the opportunity to measure their temperature without processing these results within the meaning of the GDPR.
However, if you pass on the result of the body temperature measurement internally or externally in order to grant or refuse someone access to your buildings, the GDPR does apply. For example, gates that open or close, or a green or red light based on the results of the body temperature measurement, fall under the GDPR. As an organisation, you are then bound by the rules of the GDPR.
Get informed
Would you like to know what these privacy rules mean for your way of working? Feel free to contact us for sound advice. Contact us without obligation.