In the current context of the Covid-19 pandemic, companies are now questioning what measures may be implemented to prevent the spread of the virus among their employees with a view to a progressive return to their business activity, including whether it is lawful to collect health data from their employees, namely their body temperature.
The Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados – CNPD) has come forward with guidelines on the collection of employees' health data. CNPD considers that the employer may not collect and record the body temperature of employees, except when using health professionals in the field of occupational medicine and upon prior written justification.
Under the General Data Protection Regulation (GDPR), body temperature falls into one of the special categories of data – health data – subject to enhanced legal protection. GDPR prohibits employers from collecting or recording employees' health data except for the purposes of labor law. The Portuguese Labor Code provides that employers may not demand health data from employees, except when specific requirements related to the nature of the activity so justify and the relevant reasons are provided in writing by the employer. Health data must be provided to a medical professional, who may only inform the employer if the employee is able to perform his/her job.
Based on a literal interpretation of the Portuguese Labor Code, CNPD understands that the legislator has not assigned to the employer a role that is exclusive to health authorities, nor have they assigned such role to employers, which is true. However, it is also true that this rule was not drafted to be applied in exceptional situations, but in a so-called "normal" context of the employment relationship. Consequently, the application of this rule is debatable in the current pandemic scenario.
On this matter, the Portuguese Ministry of Labor has already noted that taking employees' body temperature in the workplace may be feasible in certain circumstances. The Portuguese Government should soon clarify this matter by means of a solution that should present itself proportional to the current pandemic situation, and considering that employers have a duty of care, including the duty to ensure the safety of their employees it the workplace.
GDPR (as a regulation, GDPR must be immediately applied, unlike a directive, that must be implemented by each member state into the national law) provides that the processing of health data is lawful, through a health professional (subject to professional secrecy), if processing is necessary for reasons of public interest in the area of public health, including for monitoring epidemics and their spread, which is certainly the case. This is the lawful basis on which employers will be entitled to take employees' body temperatures (obviously, within certain constraints).
In short, very exceptional situations do demand very exceptional measures.