Norton Rose Fulbright - Data Protection Report blog

A few weeks ago, we provided you with a summary of the rights and obligations of employers with regard to the personal data of their employees during lockdown.

On 11 May, many employees will return to their workplaces. Below you will find answers to the main questions you may have ahead as the end of the lockdown approaches.

Could an employer require its employees to use StopCovid or a similar private app and require to see the results?

No.  The CNIL stated in its opinion of 24 April 2020, that the “voluntary” mode of the app implied that no negative consequences could be associated with a person’s refusal to use the app. The CNIL expressly refers to employers, who may not require certain rights or access to the use of this app. This would, according to the CNIL, constitute discrimination.

However, as a principle, whilst employers have a duty of care towards their employees, employees also have a duty of care towards any person who might be impacted by their actions or omissions at work. Based on this rule, according to the French government (and this is confirmed by the CNIL), employees must inform their employer in the event of suspected contact with the virus.

Can companies demand to see the results of StopCovid before allowing access to the premises to external visitors?

If the premises are private spaces, this could be possible if prior information is provided to such visitors and if they are able to give their explicit consent. Generally speaking, the processing of the results collected will have to be fully compliant with the GDPR.

How should we manage new COVID-19 cases?

As explained above, employees have a duty of care towards any person who could be affected by their actions or omissions at work and they must inform their employer in case of suspected contact with the virus. The employer must therefore ensure that dedicated communication channels are made available to its employees to report COVID-19 symptoms and/or diagnosis.

If an employee tests positive for COVID-19, the employer must then inform its other employees of a possible case of infection so that they can stay at home and self-isolate. There is no need to follow-up with the “contact persons”.

Conversely, people who have been in contact with a person with COVID-19 and who are aware of it, should contact their employer to discuss arrangements, including remote working arrangements. In the absence of such a solution, they should contact their doctor, who may instruct the employee to take sick leave.

Could an employer impose a temperature test at the entrance to the premises?

The daily temperature check of all individuals at the entrance to the workplace is generally not recommended by the French government. In any event, this measure alone only partially achieves the objective of reducing infection, since the temperature is not necessarily indicative that someone has COVID-19 (and the absence of temperature is not necessarily indicative that he/she does not have COVID).

However, the Ministry of Labour updated its guidelines on this point on 9 April. Companies, as part of a comprehensive system of precautionary measures, may now implement systematic temperature monitoring of people entering their site, provided that these temperature-testing measures:

  • comply with the provisions of the Labour Code, in particular those relating to the company’s internal regulations;
  • are proportionate to the objective sought;
  • preserve the employee’s dignity; and
  • provide guarantees to the employees concerned by providing prior information in the internal regulations, a memorandum/email or by posting a physical poster in the workplace about: (i) the process generally; (ii) how long their data will be retained; and (iii) the consequences of submitting (or not) to a temperature test (e.g. the authorised temperature threshold and the consequences of exceeding this threshold).

It is only under these conditions that an employer would be entitled to refuse an employee access to the company’s premises if the employee refused to have their temperature taken.

What data can be collected by employers after an employee returns to work after having been infected?

It is possible for employees to return to work eight days after the onset of symptoms AND 48 hours after all clinical symptoms have disappeared. The government states that a medical certificate, although recommended, is not necessary for a return to work if the criteria for clinical recovery are well met.  Employers cannot require a medical certificate.