23 March 2020

Covid 19 – Workplace guidance from the French Data Protection Authority

The French Data Protection Authority has issued guidance for employers and employees on how personal health data may be collected and used in response to the Covid-19 health emergency – the guidance is clear that both have a role to play.

The French data protection authority, CNIL, has issued guidance on the processing of personal in the context of the Covid-19 outbreak (available here in French). The guidance follows on from guidance issued by the European Data Protection Board, which we reported on here and the UK Information Commissioner’s guidance, covered here.

The overriding guidance is that, whilst employers may take certain steps in response to Covid-19, they must not collect or otherwise process personal health data beyond what is necessary for the management of suspected exposure to the virus by employees.  The CNIL provides examples of systematic data processing which employers are not permitted to undertake, including requiring employees and/visitors to a workplace to provide body temperature readings on a daily basis, or requiring the submission of medical questionnaires by an organisation’s whole workforce.

Employers may, however, take other steps in response to Covid-19, notably supporting remote working and encouraging employees to make use of occupational health resources. In respect of health data reporting, employers are permitted:

  • To raise awareness about the Covid-19 virus and encourage employees to provide information about possible exposure to the virus, either to the employer or directly to the relevant public health authority.In that regard, it is noted that French employment law requires an employee to inform his or her employer of a suspected exposure to the virus.
  • Where a report is submitted about a suspected exposure, to record the date and identity of the reporting employee, and the measures taken in response to the report, such as remote working arragements and any referral to workplace health resources.

The CNIL guidance makes clear that public health authorities may collect individuals’ health data, and in particular data relating to symptoms of Covid-19 exposure and the recent movements of those affected.

The situation surrounding Covid-19 is evolving rapidly, and we shall continue to monitor and report on further guidance for employers issued by the data protection authorities.