COVID-19: Privacy and new measures for safety in the workplace in Italy

The “Protocol for the regulation of measures to fight and contain the spread of Covid 19 in the workplace” on 24 April 2020 (hereinafter, the “Protocol“) sets out specific guidelines – agreed upon by the representatives of employers and trade unions – to help companies in the adoption of anti-contagion safety protocols, aimed at preventing the spread of COVID 19 in the workplace.

Below we briefly answer some of our clients’ most frequently asked questions, in order to reconcile an employer’s obligation to guarantee a safe and healthy workplace with their obligations regarding privacy and protection of personal data, based on the aforementioned Protocol and the guidelines provided by the Italian Data Protection Authority.

Are companies obliged to subject staff to body temperature checks before they enter the workplace?

Companies will have to adopt an anti-contagion safety protocol, which may include this type of check. However, body temperature measurements are not mandatory.

Companies can check employees’ temperature at the entrance, but are not permitted to recording the data.

It is allowed to record information regarding only the one instance that exceeded of the maximum body temperature established by law (but not the specific temperature), when it is necessary to document the reasons for refusing the employee access to the workplace.

In order to allow access to company premises, can an employer request that workers fill out questionnaires about his or her state of health, contact with infected subjects or if he comes from high epidemiological risk areas?

Companies, through the most suitable and effective methods, are required, to make workers and anyone else who enters the company premises, aware of the directives of the Authorities, by delivering and/or posting specific notices at the entrance and in the most visible areas.

In particular, the notice should provide information concerning:

• the obligation to stay at home in the presence of fever (over 37.5 °) or other flu symptoms and to contact the family doctor and the health authority;
• the awareness and acceptance that  it is prohibited to enter or stay in the company premises and it must be declared promptly where, even after entry, there are dangerous conditions (such as symptoms of flu, temperature, origin from areas at risk or contact with people positive to the COVID 19 in the previous 14 days, etc.) that – according to the Authorities – require the family doctor and the Health Authority to be informed and to remain at home;
• the commitment to comply with the directives of the Authorities and of the employer in accessing the company premises (in particular, keeping the safety distance, observing the rules of hand hygiene and maintaining correct hygiene behaviours).
• the commitment to promptly and responsibly make the employer aware of the presence of any flu symptoms during the performance of working activities, taking care to keep an adequate distance from other people.
• the denial of access to those who, in the past 14 days, have had contact with subjects who tested positive for COVID-19 or come from areas at risk according to WHO indications.

It is, therefore, possible for the employer to request a declaration stating the above circumstances.

In any case, only the data necessary, appropriate and relevant to the prevention of infection from COVID-19 can be collected. The employer shall avoid requesting additional information regarding the person who tested positive, the specific locations visited or other details relating to her/his private life.

Are employers subject to additional disclosure obligations?

Employers must disclose information on the processing of personal data pursuant to Articles 13 and 14 of the GDPR. Please note that this disclosure may omit information that the data subject already knows. It is advisable to provide this information in writing and to acquire a confirmation of receipt (for example, a signature).

Can companies order diagnostic tests other than temperature measurement?

If, to prevent epidemic outbreaks in the areas most affected by the virus, the competent health authority has issued specific additional measures, including specific diagnostic tests (e.g. COVID 19 swab test), employers must provide maximum collaboration.

In the absence of indications from the competent health authority, can employers order diagnostic tests other than temperature measurement?

The occupational doctor, in consideration of his role in risk assessment and health oversight, may suggest that the company adopt any diagnostic means deemed useful in order to contain the spread of the virus and safeguard the health of workers.

To this end, the occupational doctor must take into account the workers’ higher exposure to the risk of contagion.

These general preventative measures must be adopted in compliance with the personal data protection principles and in respect of the hygiene measures required by the Ministry of Health.

What information can be collected by companies in order to allow the reintegration of subjects who have tested positive for COVID 19 infection?

Access to company premises for workers who have already tested positive for the COVID 19 infection must be preceded by (i) the submission to the occupational doctor of a medical certificate which certifies that their swab test results are “negative” for COVID-19, according to the procedures provided for and issued by the local health authorities, and by (ii) medical examination carried out by the occupational doctor in order to assess their fitness to work.

Are companies also allowed to collect health data in relation to visitors?

When it is necessary for external visitors to enter the company premises, those visitors must comply with all company rules, including the rules for accessing the company premises, including the measurement of body temperature, where required by the protocol adopted by the company.

In any case, data regarding the body temperature of customers (for example, in the context of large retailers) or occasional visitors, even if the temperature is higher than the threshold indicated in the emergency provisions, shall not be recorded.

Furthermore, in the case of employees of third-party companies operating in the same workplace (e.g. maintenance workers, suppliers, cleaners or security) whose COVID-19 swab test results are positive, the contractor must immediately inform the client and both must collaborate with the health authority providing useful information for identifying any close contacts.

Are companies allowed to carry out internal investigations for the purpose of identifying any close contacts with subjects whose COVID-19 swab test results are positive?

In principle, it will be up to the competent health authorities to inform the “close contacts” of the infected person in order to activate the planned prevention measures.

In any case, the company – upon the request of the health authorities – must collaborate for the identification of any “close contacts” of a person present in the company whose COVID-19 swab test results are positive. This is to allow the authorities to apply the necessary and appropriate quarantine measures, in compliance with the laws applicable at the time.

In carrying out these investigations, the company must avoid disclosing any information related to the identity of the subject whose COVID-19 swab test results were positive.

How should companies act in the event that local authorities order further measures, not included in the Protocol?

The measures prescribed at the local level shall have to be assessed on a case by case basis in order to guarantee the best balance between the need for workplace safety and the protection of privacy and personal data.

Who is allowed to process this information within a company?

Access to this information must be limited to only subjects who absolutely need it in consideration of their role (for example, HR, H&S).

A committee is set up in the company to apply and verify the regulatory protocol rules .

The identity of infected workers must not be communicated by the employer even to the Workers’ Representative for Safety.

How long shall this information be kept?

The collected data, in principle, must not be retained beyond the end of the state of emergency, unless a longer retention period is required by the law.

Are there specific requirements to be considered in relation to different industries?

Yes. For example, the construction sector provides a specific protocol to contain the spread of the COVID-19 on construction sites.

*****

This newsletter is for informational purposes only. Its contents cannot be considered exhaustive and do not constitute a legal advice.