Update: Does data protection stand in the way of infection control? - Taking body temperature

Currently, events are evolving very quickly. On Sunday, the German Chancellor called on the population to make personal sacrifices in the fight against the spread of the coronavirus and announced a comprehensive ban on physical contact. Will we have to give up ever more rights in data protection as well? The State Commissioner for Data Protection and Freedom of Information in Rhineland-Palatinate (hereafter: CDF Rhineland-Palatinate) calls for keeping an eye on the legal framework during crisis management and now takes a clear stand on the issue of the permissibility of taking body temperature.

Last week, the German data protection supervisory authorities had not yet taken a position on the issue of whether it is permissible to take body temperature of employees. The CDF Rhineland-Palatinate now rejects this step in a recent statement (State Commissioner for Data Protection and Freedom of Information in Rhineland-Palatinate).

As indicated in the article of March 18, 2020, measures to protect against infections must be necessary and proportionate to meet the employer’s duty of care. According to the CDF Rhineland-Palatinate, however, necessity is only given where the personal data is indispensable for the data controller to meet its duties. This is only the case if the task cannot be performed without knowledge of the information, cannot be performed on time, can only be performed at a disproportionate expense, or can only be performed with other disproportionate disadvantages. This cannot be presumed, however, where employers make employees’ entry to the company’s premises dependent on them having their body temperatures taken.

The CDF Rhineland-Palatinate even doubts that taking the body temperature is suitable for meeting the above-mentioned duty of care in the first place. On the one hand, it is not possible to draw conclusions about the corona disease from an elevated temperature. On the other hand, it is not be possible to detect an existing corona disease beyond doubt due to the elevated temperature. The CDF Rhineland-Palatinate also refers to other options that are available to employers to meet their duty of care, such as offering working from a home office or the repeated advice to consult a physician in the event of flu symptoms.

Finally, according to the CDF Rhineland-Palatinate, the taking of body temperatures cannot be legitimized by declarations of consent from employees, since they are in an economically dependent relationship with the employer and therefore the voluntary nature necessary for consent is lacking.

Tip for use in practice:

To our knowledge, the CDF Rhineland-Palatinate is the first German supervisory authority that has positioned itself to the effect that taking body temperatures of employees is fundamentally not admissible under data protection law. It is to be expected that other German data protection supervisory authorities may also adopt this view. Since it depends on the specific individual case, we recommend that companies contact their competent data protection supervisory authority in relation to this issue and ask for their opinion. We will gladly support you in this effort.

It is a fact in times of Covid-19 that developments are highly dynamic and accordingly the positions on the admissibility of individual measures may be constantly changing. Specific measures should therefore always be checked for their admissibility under data protection law. We will gladly support you in this process as well.

Status: March 24, 2020