Employers across the world are facing extremely difficult challenges in keeping their workplaces safe for their employees, contractors and visitors during the COVID-19 pandemic.

Although the prevailing instinct is likely to be to protect and to prevent the spread of the virus at all costs, under data protection laws this still needs to be weighed against the privacy rights of employees. Depending on where their employees are located, employers may have to favor privacy over virus detection. This blog sets out a few of the key issues and a snapshot of how they are dealt with across five European jurisdictions (the UK, France, Germany, Italy and the Netherlands), the US and three Asian jurisdictions (China, Hong Kong and Singapore) as of April 3, 2020. It examines the position under labor and data protection laws without exploration of wider State powers that may be exercised in some jurisdictions.

Can we ask our employees to self-declare COVID-19 symptoms?

• Yes in the US, UK and Singapore. These jurisdictions permit an employer to require self-reporting but, in the UK, an employer would need to explain the reason for the self-reporting to the workforce, i.e. it is required to protect the health and safety of others.
• In China and Hong Kong, requests can be made but unless their employment contract specifically requires it, employees cannot be required to report their symptoms to employers. Please note that it is, however, possible for Chinese employers to report cases of non-compliance by their employees to certain state authorities (e.g. police and disease control agencies) which do have powers to enforce the declaration of symptoms.
• In Germany, employers can request that employees self-declare COVID-19 symptoms but they cannot compel this.
• In France, employees must inform their employer in the event of suspected contact with the virus. However, employers can only request (i.e. they cannot force) employees to provide further information in relation to their exposure. Employees who have symptoms of an illness are not required to divulge to their employer the reason for their sickness leave, or their symptoms.
• In Italy, self-reporting would be permissible but only via a company doctor.
• In the Netherlands, employees cannot be required to self-declare, as employers are not allowed to ask about the nature and cause of an employee’s illness.

Can we temperature test on entry to a workplace?

• In Singapore and the US, temperature testing can be required by employers given the widespread nature of infection. In Germany, this is also permissible provided that it is undertaken by a health care professional.
• In China, Hong Kong, the Netherlands and the UK, employees can be requested but not compelled to take temperature tests (although if agreed contractually with the employee, in Hong Kong and China, testing may be compelled). In the Netherlands and the UK, the tests would need to be undertaken by a healthcare professional. As a matter of standard practice, it is the norm for property management companies in China to manage testing and reporting in relation to employees of office buildings which they manage. In China, a failure to take the test could be reported to the authorities.
• In France, employers cannot collect information such as the results of a temperature test and cannot administer the test themselves.

Under what circumstances can the employer divulge information about affected employees?

• In the UK, France, Italy, Germany and the Netherlands, employee consent, particularly in acute circumstances like these, is very unlikely to be deemed “freely given”. Therefore, (except in the Netherlands, please see below) disclosure of the identity of an infected employee to others should only be undertaken on the grounds that it is necessary to provide a safe workplace or to meet public health requirements (both of which must be prescribed at an EU member state level). This is considered an extreme intrusion into an individual’s private life with the possibility of stigma and recrimination and so is generally only possible to those who are likely to have been in close contact with the infected employee. All decisions related to obtaining and sharing health data in the UK, France, Italy, Germany and the Netherlands in these circumstances should be carefully documented in a  data protection impact assessment, which weighs the benefit to society against the intrusion to the individual’s privacy and sets out the measures that reduce that impact to the minimum necessary. As the consequences of infection recede, the justification for overriding the normal confidentiality of health conditions will diminish so privacy officers need to keep all these measures under review.
• In the Netherlands, employers are not allowed to inform others of the employee’s infection. The healthcare professional will inform the regional GGD (i.e. the local health organization for preventive healthcare). Subsequently, the GGD can take measures in respect of the workplace involved in consultation with the employer.
• In Hong Kong, although consent would be necessary before divulging health information, the limits of this type of sharing would be similar to those described above in relation to European jurisdictions.
• In the US, China and Singapore, it would be necessary to obtain employee consent unless disclosure without consent is permitted by an exception in any applicable data protection legislation or permitted under another law.

What employee works councils or trade unions obligations are applicable in relation to the implementation of these measures?

• In China, Hong Kong and the Netherlands, no trade union or works council information or consultation obligations would generally apply to the implementation of these measures.
• In Singapore, the UK and the US any union collective bargaining agreements should be checked and, if these questions are covered, the unions should be consulted prior to their implementation.
• In France, employers are required to maintain a document which records health and safety assessments of the workplace, including professional risks and actions taken by the business. This document would need to cover the measures discussed regarding COVID-19, together with risks and actions taken. Whenever  this document is updated, it is subject to consultation with the employer’s Social and Economic Committee.
• In Germany, these measures would be subject to a co-determination right by the works council. The employer is required to consult the works council for approval and conclude a works agreement specifying the relevant data, methods and place of temperature test, retention period, recipients and period for which the access to facilities would be denied.
• In Italy, because a nationwide union agreement has been signed by unions, government and employers’ associations regarding these matters, further information and consultation with unions is not legally required.

With thanks to Jurriaan Jansen, Christoph Ritzer, Anna Gamvros, Stella Cramer, Barbara Li and Joe Dole for their contribution to this article.