COVID-19: Data Protection in Germany FAQs – our view

1. Does data protection limit the options companies have to combat the Corona virus?

This should generally not be the case. Data protection is a fundamental right, but – as all fundamental rights – it is no absolute right but must be balanced with other fundamental rights. The dimension of the Corona threat has made clear to all European governments that extraordinary measures are needed to protect the most important of all fundamental rights: life and health. The same balancing applies to companies, and with the threat increasing every day statements and guidance of data protection authorities more and more acknowledge the need and justification of exceptional measures. In our view, the following limits apply: 

• The measures must serve a sensible purpose with regard to the protection of the company’s employees’, business partners’ or wider public’s health. They must be appropriate. So, companies are not to collect personal data if they are not used, will likely not be used and need not to be used in connection with reasonable measures to combat the Corona virus. Example: it makes absolute sense to measure the temperature of visitors/employees entering a building and refuse access if they disagree or have a high temperature, but for controlling the access the data does not need to be further retained (granting access is usually a yes/no decision).

• Personal data collected for the Corona virus must not be used for any other purposes (unless there is a separate justification for it) and there must be technical and organisational measures in place to ensure this.

• Measurements must be applied in a non-discriminatory manner. Example: only measuring the temperature of people of a specific origin would clearly not be allowed.

Yes, personal data of employees may also be collected and processed if an infection has been detected (i.e. the employees have been tested positive or, as will be more and more relevant in the future, they are deemed to be positive under the guidance of the relevant health authorities). The employer may (and should have) a respective record of infected people (but access to this data should be carefully restricted).

The information may (and, as a duty of care under employment and contract laws, even must) be shared with relevant potential contacts, which can be reasonably identified. In many cases this will also require sharing the name of the relevant individual, but it does usually not allow the disclosure of the name or other information to the general public (because it is usually not required). However, it should include notifying everybody (other employees or even business partners) who may have had close contact with the infected person in the relevant period.