DPA GUIDELINES COVID-19

COVID-19 DPA GUIDELINES

In 18-3-2020 the Hellenic Data Protection Authority (DPA) published Guidelines, taking into consideration the extremely urgent and unpredictable need raised due to the appearance of COVID-19 which has created special circumstances in the field of the protection of personal data.

Concerning the relevant questions asked by employers such as if temperature measurement of the incoming employees is allowed or filling a questionnaire referred to employees’ and their family’s health status, travel record in a foreign country with high risk of COVID-19 infection is legal etc. or if they should inform their employees of the identity and health status of an already infected colleague, DPA responds that any processing of personal data, especially under the current crucial unpreceded circumstances, must not be regarded as forbidden beforehand.

Nevertheless, any processing must be carried out under the principles of the GDPR Regulation and particularly under the principle of restriction of data processing in accordance with the principle of proportionality as well as the principle of confidentiality of information by following the technical and organizational means that are essential for the processing.

DPA highlights that the processing of personal data, for example measuring the employees’ temperature by the time they enter their workplace, is consider to be legitimate in case any other method available is evaluated as ineffective by the controller. In any event, DPA is against any systematic, continuous and wide-range collection of personal data which leads to profiling and constant renewal of data concerning employees’ health.