Poland: Coronavirus (Sars-Cov-2): What Kind of Data can be collected from the Employees in the face of an Epidemic?
While coronavirus is gaining more and more ground, employers in Poland try to figure out what means should be undertaken so their employees stay safe and their companies work as regular. It’s especially important for the employers in retail as their employees usually have direct contact with hundreds of customers.
The employers have become particularly interested in questioning the employees about certain aspects of their lives, that could help them prevent virus spread within their work establishments. The employers prepare questionnaires, where they ask whether the employees have stayed in the areas infected by the virus or have experienced any of the alarming symptoms such as high fever or cough.
In the light of the above the question appears – is the collection of such data allowed pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (GDPR) and provisions of the Polish Labour Code?
Collection of unrecorded data
First of all it should be underlined, that GDPR is applicable only in case the collected data are recorded. When the data are not recorded, for instance when the answers to the given questions are not written down or saved otherwise, GDPR is not be applicable. In such scenario, admissibility of data collection would have to be considered only on the ground of Polish Labour Code.
In this context it is important to note, that under the Labour Code, the employer is obliged to protect the health and life of employees by ensuring safe and hygienic working conditions and the employees are obliged to cooperate with the employer on that matter. Therefore, it can be stated, that the above-mentioned responsibilities justify the demand of data that could help to prevent virus spread.
Collection of recorded data
What was written above does not mean however, that the recording of the data is not allowed. Even in case data have been recorded and GDPR is applicable, its provisions could provide a possible legal basis for data processing. The legal basis will differ depending on the kind of data, that will be processed – whether those will be ,,regular” data, such as the information about staying in the contaminated area or ,,sensitive” data concerning health, such as experiencing fever.
As far as the ,,regular” data are concerned, the legal basis for their processing could be Article 6 item. 1 letter e of GDPR, i.e. when processing is necessary for the performance of a task carried out in the public interest – in this case protection of general health. When it comes to the ,,sensitive” data concerning health, legal basis for their processing could be art. 9 par. 2 letter i of GDPR i.e. when processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy.
Summing up, on the ground of Polish Labour Code as well as on the ground of GDPR there are legal basis that could allow the employers to gather information that would help them prevent Coronavirus spread. In any case however it should be kept in mind, that data demanded by the employer should be adequate, relevant and limited to what is necessary in relation to the purpose for which they are processed, which in this case is the protection against the epidemic.
For more information on these articles or any other issues involving labour and employment matters in Poland, please contact Prof. Arkadiusz Sobczyk (Partner) of A. Sobczyk & Wspolpracownicy at arkadiusz.sobczyk@sobczyk.com.pl or visit www.sobczyk.com.pl.
