The Commissioner of Personal Data Protection has answered in a recent announcement frequently asked questions about preventive measures for covid-19.
Lately, I have again received many questions about measures that various organisations wish to take to prevent the spread of covid-19. Although, for many of these measures, I had previously issued relevant Announcements, I find it useful to repeat the following:
As I mentioned in my Announcement of 24/04/2020, the use of cameras that measure body temperature and/or thermometry systems is permitted only if there is a legal basis under the General Data Protection Regulation (GDPR) and if the Principles of Purpose Limitation and Data Minimisation established by the GDPR are satisfied. The same applies to temperature measuring, e.g. when customers enter shops or employees enter their workplaces.
With regard to the carrying out covid-19 diagnostic tests on employees, it is recalled that there are relevant Ministry of Health Decrees which determine in which cases employees are required to undergo tests. In the absence of such Decrees, the employer may not force employees to undergo such tests or force them to give their consent. It is recalled that, in the field of labour relations, the consent of employees is not a free expression of will and cannot be regarded as valid.
If an employee has undergone a test, the clinical laboratory is obliged to notify the result to the referring doctor and the Epidemiological Monitoring Unit. Under no circumstances is it justified to notify the employer of the result. The employer must be informed by the employee himself. Positive results are communicated to patients, only by their doctors.
Irene Loizidou Nikolaidou Commissioner for Personal Data Protection
