Data Protection and COVID-19

Summary

Irish employers are faced with an increasing array of issues related to COVID-19, many of which will involve the processing of their employees’ personal data. In response, the Data Protection Commission (the DPC) has recently issued guidance on the considerations that should be taken into account when handling personal data in this context.

General Considerations

Firstly, the DPC states that data protection law does not obstruct the provision of healthcare or the management of public health issues. However, any processing of personal data should be necessary and proportionate, and should be in line with guidance from the public health authorities.

Legal Basis for Processing

It is important to bear in mind that the GDPR applies to all such processing as normal, and that therefore the employer as data controller must have a legal basis to carry out the processing. The DPC states that the following bases may be relevant in the context of COVID-19:

• processing is necessary for reasons of public interest in the area of
  public health. This basis would be relevant where an organisation is
  acting on the guidance of the public health authorities; and

• processing is necessary for the purposes of carrying out the
  obligations of the controller - in particular, the DPC notes that
  employers have a legal obligation to protect their employees, which
  provides a basis for processing personal data.

Protection of Employee Rights

The DPC emphasises that employers processing personal data must:

• be transparent about the measures they are implementing;

• maintain the security and confidentiality of the data;

• only process the minimum amount of data; and

• document any decision-making processes to ensure accountability.

Specific Issues

The DPC have helpfully set out their guidance on a number of the issues which employees are likely to encounter in the context of COVID-19, including:

• Asking for details of an employee’s illness

  Employers would be justified in requiring employees to inform them if they have a medical diagnosis of COVID-19 in order to allow necessary steps to be taken.

• Employees with confirmed case of COVID-19

  The employer should contact the public health authorities as a matter of urgency for guidance on the steps to be taken.

• Disclosure to other employees

  Employers should not disclose the name of an affected individual to their other employees but should instead inform them that there has been a case, or suspected case, of COVID-19 in the organisation and request them to work from home.

Conclusion

The DPC’s guidance provides useful, practical information for employers who are dealing with issues around COVID-19. We will continue to monitor guidance issued by the Irish authorities.