What Should be Considered While Processing the Data of Workers in the Covid-19 Outbreak? 6 May 2020

As it is known, with the publication of the Law on the Protection of Personal Data ("Law") in the Official Gazette dated April 7, 2016 and numbered 29677, certain serious obligations were imposed on the data responsible; and violation of the said obligations has been imposed on certain sanctions.

However, with the new type of coronavirus epidemic affecting the whole world, some additional measures have been taken to prevent the epidemic especially in the workplaces and prevent the workers from getting infected. Given the extraordinary environment created by the Covid-19 outbreak, it is of great importance that the data officers do not ignore their obligations arising from the protection of personal data.

As a matter of fact, the Personal Data Protection Authority (“Institution”) underlined this issue with its announcement on the official website, “What to Know under the Law on the Protection of Personal Data in the Process of Combating Covid-19”. The Institution emphasized in the relevant announcement that even those exceptional times, data supervisors and data processors should ensure the security of their personal data. Therefore, it was necessary to remind the employers about the issues to be taken into consideration in terms of the protection of personal data in the measures taken within the scope of preventing the new type of coronavirus epidemic.

What are the Basic Principles to be Considered in the Processing of Personal Data?

The law requires that the basic principles to be considered in the processing of personal data comply with the law and the rules of integrity, to be accurate and up-to-date when necessary, to be processed for specific, clear and legitimate purposes, to be linked, limited and measured for the purpose for which they are processed, and the time required for the purpose or foreseen in the relevant legislation. up to be preserved.

Accordingly, the obligation to comply with the basic principles stipulated by the Law does not disappear due to the new type of coronavirus outbreak. Therefore, within the scope of epidemic prevention, It should not be concluded that all kinds of personal data, including special personal data such as health data of employees can be processed unlimitedly although the aim of preventing the epidemic creates an extraordinary data processing authority for employers.

Can Health Data be Processed Without Employee’s Explicit Consent?

With the spread of the Covid-19 outbreak, some measures have been taken at workplaces to prevent the outbreak. Accordingly, it is unquestionable that the employer is obliged to take some precautions, since the outbreak of some of the employees working in collective workplaces will create a risk of disease for other employees.

On the other hand, there are some points that should be taken into consideration while taking these measures, especially in terms of processing of health data. Accordingly, Article 6 of the Law regulates that special personal data, including health data, can only be processed with the explicit consent of the data subject. Although the law provides for some exceptions that do not seek explicit consent in terms of health data, it is not possible to evaluate the measures to be taken by employers within the scope of the new type of coronavirus outbreak.

In this context, it is observed that measures are taken in the workplaces, especially at the time of entry and exit, to measure the fever of employees and to ask questions about their health status in order to determine whether there is a threat to disease. It should be noted here that it is necessary to obtain the clear consent of the workers in taking these measures. Although the Law has not stipulated a formal condition for obtaining explicit consent, employers are advised to obtain written explicit consent with appropriate texts to avoid any sanctions as a result of future conflicts.

Can Employees' Health Data be Processed by the Workplace Physician?

As mentioned above, Article 6 of the Law has envisaged some exceptions in order to process special quality data without explicit consent. Accordingly, it is possible to process health data without explicit consent by people who have an obligation to keep secrets for reasons such as protection of public health, preventive medicine, medical diagnosis, treatment and care services. For this reason, it is possible to process the data in question by taking some precautions by the workplace doctor within the scope of the prevention of the Covid-19 outbreak in the workplaces. However, even in this case, it is necessary to act in accordance with the general principles mentioned above, and therefore whether every measure to be taken should be legally evaluated.

Can the employer explain to the other employees that an employee has a virus?

Given the rapidly spreading effects of the Covid-19 outbreak, there is a possibility that ir or more employees will be caught in the new type of coronavirus despite all precautions taken by the employer.

At this point, it is undoubted that other employees with whom the employee was in contact at the workplace before the detection of the disease should be informed and necessary measures should be taken in this regard. However, these measures to be taken for the protection of public health do not give employers unlimited power. As a matter of fact, the Institution stated in its announcement that the disclosure of the name and other information of the employee who got the disease as much as possible should be avoided. However, it was emphasized that in cases where the name of the employee has to be disclosed in order to identify the persons with whom the Covid-19 positive diagnosis is contacted, it is appropriate to inform the relevant employee in advance and should not be given more information than necessary.

Can he request information from the employee about the recent travels to the affected countries and the symptoms of the virus?

As explained above, within the scope of personal data protection legislation, principles such as lawfulness and legitimate interest should be observed in the processing of personal data. Accordingly, the lawfulness of the data processing purpose should be evaluated separately for each activity. However, it is anticipated that employees may request information on issues such as the countries they travel to, the symptoms related to the virus, and the measures to be taken due to the outbreak caused by the new type of coronavirus.

As a matter of fact, the Authority evaluated that the employers would have justified reasons for demanding such information within the scope of their legal obligations regarding protecting the health of the employee and providing a safe workplace.