The outbreak of Novel Coronavirus (COVID-19) has become a worldwide pandemic. Based on the World Health Organization’s declaration that this is a public health emergency of international concern, the Finnish Institute for Health and Welfare actively monitors the situation and reports to other authorities, such as the Ministry of Social Affairs and Health. Finland authorities constantly evaluate the risk level of the virus spreading within Finland . Understandably, this may be creating great concern and unrest for you and amongst your workforce. Below we answer some key questions to clarify employers' legal obligations and support you in protecting your business and people.
What are employers' obligations in respect of COVID-19?
At time of writing there are no mandatory obligations for employers that are specifically in relation to COVID-19.
However, Finland has declared a state of emergency due to the coronavirus situation. The measures outlined by the Government are and will be implemented in accordance with the Emergency Powers Act, the Communicable Diseases Act and other relevant legislation. The measures outlined include the closure of schools, educational institutions and universities, restrictions on public meetings and gatherings, mobility and visits to health care units, and increases to social welfare and health care capacity that will naturally have at least indirect impacts on Employers. Finland’s national borders were closed on 19 March 2020 and these measures will remain in force until 13 April 2020.
Employers should ensure that they are taking necessary steps to protect their employees. All employers have health and safety obligations as well as an extensive duty of care towards their employees and the employer should keep employees informed about health risks that may arise in carrying out their duties and to ensure that working practices do not create undue risks to employees.
As such, employers should carry out ongoing risk assessments and consider any factors that may make employees particularly susceptible to infection. Employers should also consider circulating up-to-date information on good hygiene practices and provide any necessary equipment to facilitate this, such as hand sanitisers. For example, we recommend issuing a reminder on action employees can take to help stop viruses like coronavirus spreading. Such advice may include:
• Cover your mouth and nose with a tissue or your sleeve (not your hands) when you cough or sneeze
• Put used tissues in the bin immediately
• Wash your hands with soap and water often – use hand sanitiser gel if soap and water are not available
• Try to avoid close contact with people who are unwell
We further recommend notifying employees where they can access more information if they are concerned, such as from the Finnish Institute for Health and Welfare  and the national COVID-19 telephone service .
Can employers request or require information from an employee about potential or actual exposure to the virus?
The question of whether an employee can be asked to sign a declaration about where they have been, their exposure to the virus, or be required to provide information to an employer in order for the employer to provide confirmation to a customer sits firmly in the crossover between data privacy and employment.
Any such data must also be processed in line with the applicable privacy requirements. Information about an employee's health (such as whether the individual has been diagnosed with the virus or is suffering from any symptoms) is sensitive personal data and accordingly additional requirements and obligations apply to the processing of such data. Despite the GDPR being EU-wide legislation, the position is complex from a European data privacy perspective. Employers will find that the type and extent of the information they can compliantly process, and the legal basis for doing so, varies from country to country.
The Finnish employment law is very strict when it comes to employers' possibilities to process employees' personal data and especially health data. The Act on Privacy in Working Life also allows processing of employees' personal data only if it directly necessary for the employment relationship ("necessity requirement"). Article 9 (2)(b) of the GDPR enables employers to process health data for carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of national employment law. Under the Finnish Occupational Safety and Health Act, employers are required to take care of the safety and health of their employees by taking the necessary measures. Complying with occupational safety obligations can thus be considered a valid legal basis for processing health data under the GDPR and directly necessary as required by the Act on Privacy in Working Life. However, there are several additional aspects to consider.
• In Finland employees cannot be obliged to share their health information with their employer for preventive reasons, unless prescribed in sector specific legislation. Due to this, it is advisable to take COVID-19 precautions on voluntary basis as far as possible. For instance, it is a good practice to publish guidelines on measures to take when suspecting a COVID-19 infection.
• If employees feel symptoms, they can also be advised to consult an occupational health care professional. The occupational health care professionals shall evaluate whether the absence from work is required.
• It is prohibited to publicly reveal information on an employee's health on a workplace, but based on the information received from occupational health services the employer may assess if workplace safety requires issuing wider instructions, for example, to work from home or to cancel meetings and seminars.
• Unlike health information, information on an employee's whereabouts and, thus potential exposure to COVID-19 does not necessarily constitute sensitive personal data. Processing information about employees' travels and contacts with persons who have travelled in certain areas can be justified in light of the necessity requirement. In addition to this, general information on whether an employee has been quarantined is not health data unless it includes specific health-related reasons for the quarantine
• In any operations involving employee personal data, it is paramount to only collect and process data which is necessary for ensuring a safe working environment. For instance, it is seldom necessary to process detailed information on employees' relatives and friends or even travel locations. The same goal can often be reached by more generic data and "yes or no" answers ("Have you travelled in epidemic areas as classified by the Finnish authorities (list)?", "Have you been in contact with anyone recently travelled in these areas").
• When it comes to processing employee health data or other personal data connected to COVID-19 precautions, it is also important to:
o Only store the data for a limited period of time
o Only allow access to a limited number of people
o Only allow access to health data to people who are authorized through their job description
o Protect the data with adequate security measures
Employers may also face situations where a customer/client requires travel or health information relating to their employees when visiting the customer/client's site.
• Where this applies, the employer should as a starting point seek to provide generic reassurance to the client / customer.
• If this does not suffice, employers should consider whether there are grounds for the employer to provide certain information to the third party. Employers could also consider advising employees that they can provide information to third parties, if requested and if they are happy to do so.
• Unless there is a clear legal obligation on the employer to do so, and these may exist in sector specific laws, employee consent is likely to be the only applicable legal basis for sharing such information with third parties. To be valid, consent must be freely given.
• The company must not oblige employees to provide this information to third parties and consider carefully what, if any, further action to take if the employee refuses to do so. There is a risk that where the employer requires employees to attend client sites, any employee consent to the provision of information in order to access those sites would not be freely-given and therefore not valid.
Further to the above, the position regarding European data privacy rules and how they impact information relating to COVID-19 is developing. The European Data Protection Board has adopted a statement on the processing of personal data in the context of the COVID-19 outbreak on 19 March 2020 (https://edpb.europa.eu/sites/edpb/files/files/news/edpb_statement_2020_processingpersonaldataandcovid-19_en.pdf) and the Finnish Data Protection Ombudsman has issued general information on the situation (https://tietosuoja.fi/artikkeli/-/asset_publisher/tietosuoja-ja-koronaviruksen-leviamisen-hillitseminen). A number of EU governments have issued further guidance and more still are considering whether emergency legislation may be required, particularly if the situation escalates. The position will need to be kept under review as the situation evolves and further guidance becomes available.
What should employers do if an employee is absent or infected?
If an employee is infected with COVID-19, it is recommended that the responsible health authorities should be notified in order to seek guidance on how to best protect the health of the workforce.
The safety delegate(s), or safety committee where such has been implemented, should be informed and a work environment risk impact assessment and action plan should be performed. If an infection is discovered at the work place the employer should inform the employees and other relevant quarters only generally about the possible infection and give necessary instructions taking into account the restrictions of the data protection regulation referred to above.
Employees on sick leave are entitled to sick pay or sickness allowance and employees ordered to remain home from work, ordered into isolation or quarantined to prevent coronavirus from spreading by the decision of doctor defined in the Communicable Diseases Act are entitled to sickness allowance on account of an infectious disease in accordance with statutory rules (Section 82 of the Communicable Diseases Act 1227/2016 and Chapter 8, Section 1 of the Health Insurance Act 1224/2004) . The allowance may be paid to the employer in case it has paid salary to the employee from the period of absence.
In addition to the priority of health protection, the employer should develop a plan going forward as to whether and how operational processes can be maintained.
Potentially Infected Employees
When the employee has not become ill, but the authority has ordered him or her into isolation or quarantine, in principle the employer is not obliged to pay salary. In such a case it is recommended to verify this under any applicable collective bargaining agreement. Naturally, the employer can decide to pay salary, in which case the employees' equal treatment shall be taken into account. Also in this case the employer may be entitled to receive the abovementioned allowance.
Where there is a reason to believe that an employee poses a risk to the health of other employees, for example, because they have been travelling or had close contacts with an infected person, the employer is recommended to request the employee to undergo a medical examination.
The employer can consider several means in case the business is threatened by COVID-19 and employees' absences. The available means should always be assessed on a case-by-case basis considering, for example, the terms of employment (including collective bargaining agreement and co-operation obligations). Some examples of available means are the requirement of emergency work, use of agency hired labour and remote working. Using careful case-by-case consideration, depending for example on the terms of employment, the employer can assess the possibility of appointing the employee alternative work in accordance with his or her employment contract.
In addition to the priority of health protection, the employer is recommended to develop a plan going forward as to whether and how operational processes can be maintained in case of bulk absences.
Refusal to work or travel
Employees are obliged to perform work and unlawful absence from work due to fear or abstract risk of an infection may constitute grounds for termination. Thus, employees cannot refuse to attend work. In order to fulfill its occupational safety responsibilities, the employer shall, for example, continuously monitor the working community and assess the risks at the work place and thus prevent dangers and risks that are harmful to employees' health. The employer must ensure that the risk of infection is restricted. Due to the above-mentioned health and safety obligations, the employers need to keep an eye on the authority instructions as well as travel restrictions and carefully observe these and update their workplace instructions, if needed. Currently the Finnish Ministry of Foreign Affairs advises not to travel abroad. The company's insurance coverage is recommended also to be checked regarding additional costs caused by the virus.
What are employers' obligations where offices are partially or fully closed?
As a starting point, the employees will remain entitled to full salary and benefits in accordance with their employment contract and applicable laws and collective bargaining agreements. Where possible, employees should be instructed to continue to perform their work duties, but from home. Therefore, it is recommended for the employers to be prepared with e.g. proper remote working possibilities and policies where possible. However, if the employee is prevented from working due to a fire, an exceptional natural event or another similar event affecting the workplace beyond the control of the employee or the employer assessed on a case-by-case basis, the employee is entitled to pay for the period of the impediment, for a maximum of 14 days.
The Finnish labour market organisations have prepared a proposal for the government on temporary measures to secure business, labour markets and adequate living income and the government partially approved those measures on 20 March 2020 to be implemented. The measures include temporary substantial changes to the current employment legislation in the private sector, some of which are suggested to be applied until the end of the year 2020. The approved proposals include a shorter (minimum) negotiation period in a co-operation procedure when an employer who regularly employs at least 20 employees is considering layoffs and a shorter (minimum) notification period when notifying an employee of the layoff. To the extent that the proposed temporary measures require changes to the current legislation, the normal legislative process will apply. Despite the emergency situation and high priority of these matters, the legislative process can take weeks.
Where can employers and employees access local and national advice?
General information and recommendations are available here:
- The Finnish Institute for Health and Welfare
- Ministry of Foreign Affairs
- Medical Helpline 116 117
- The Social Insurance Institution of Finland
Last reviewed 20 March 2020
 https://www.kela.fi/web/en/sickness-allowance-amount-and-payment and https://www.kela.fi/web/en/sickness-allowances-infectious-disease.