Privacy in the time of the coronavirus - UPDATE

Several weeks have passed since the introduction of the first special legislative measures to address the coronavirus pandemic. In this newsletter we review the issues many of our clients face and consider some of the further potential legal issues which may arise as the lockdown conditions are relaxed.

IS THERE AN UPDATED OFFICIAL GUIDELINE ON THE ACCEPTABILITY OF PRESCRIBING BODY TEMPERATURE CHECKS FOR EMPLOYEES?

As we have reported previously, the Hungarian National Authority for Data Protection and Freedom of Information (HDPA) published a recommendation on 10 March 2020, stating that requiring screening tests from employees with any diagnostic device (in particular, but not exclusively, with a thermometer) is disproportionate in the current situation in Hungary and opened the possibility of testing only in particularly justified cases.

Since the publication of the recommendation a state of emergency entered into force in Hungary and the WHO declared a global emergency due to the coronavirus pandemic. One of the COVID-related Hungarian governmental decrees referred to the fact that employers are allowed to conduct compulsory health checks on employees (although the detailed rules of such health checks have not been published) and the advice of the Hungarian National Center for Public Health published on March 24 2020 also states that health checks are permitted in the current situation.

Under these circumstances, it became a practice of many employers to measure the body temperatures of their employees (or any person who enters their premises) as it is possible that such temperature measurement will lead to the earlier detection of infections. While the previous position of the HDPA has not been revised officially, in the current situation our advice to employers is that prescribing health checks is possible, but observing the rules on notification and the legality of data processing is extremely important. The prescription of health checks should be properly justified and documented.

THE POSSIBLE USE OF CONTACT TRACING MOBILE APPLICATIONS IN HUNGARY AND RELATED DATA PROTECTION REQUIREMENTS

Connected with potential relaxation of lockdown restrictions, several European countries are experimenting with contact following (tracing) mobile applications, possibly inspired by the example of China and South-Korea. These applications can play a key role as they can complement existing manual contact tracing and help interrupt the transmission chain of the coronavirus.

Such applications raise several data protection issues as they have the possibility to transmit a large quantity of personal data to the companies which develop them and to the authorities. Such applications need to be fully compliant with EU and national data privacy rules. On 21 April 2020, the European Data Protection Board issued a recommendation on this issue (“Guidelines on geolocation and other tracing tools in the context of the COVID-19 outbreak”) in which it has laid down the following requirements:

• The applications should be implemented in close coordination with public health authorities
• The applications should be installed voluntarily
• The applications should aim to exploit the latest privacy-enhancing technological solutions (e.g. to use Bluetooth technology in order to not enable tracking of people's locations)
• The applications should be based on anonymised data (thus, they can alert people who have been in proximity to an infected person without revealing the identity of the people infected)

Although further EU-level initiatives are anticipated, such applications are already available in certain member states (e.g. Austria and Slovakia). To date there is no information on an operating contact tracing system in Hungary.

WHAT SHOULD EMPLOYERS PAY ATTENTION TO WHEN THEY ALLOW OR PRESCRIBE WORKING AT HOME (HOME OFFICE) FOR EMPLOYEES?

During the coronavirus epidemic, it became a practice of many employers to order their employees to work from their home when the type of work so permits. In such cases the main data protection related obligation of employers is to ensure the security of both business-related information and also personal data which may be involved by using the necessary technical devices. It is recommended that employers provide the tools (i.e. laptop or desktop computer) to the employee which he/she would use to work and, as always, provide them with instructions on what kind of safety measures they should follow. If employees use their own devices, we recommend additional security checking of their work and devices.

GENERAL DATA PROTECTION LAW ADVICE

We have been advising clients on privacy issues not only in relation to the recent coronavirus epidemic, but also generally in many sectors (information technology, finance, education, food, manufacturing) and in all fields of data protection law (e.g. privacy notices, data protection policies, data breaches, disputes, data processing agreements). Should you have any questions in the field, please do not hesitate to contact us.

Éva Bognár
Iván Sólyom
Alekszej Dubalár
Péter Szaniszlai

To download this newsletter, please click here.


We at Lakatos, Köves & Partners will be producing Updates to our COVID19 Newsletters as the situation develops. If you would like to receive those Updates please write to us at subscribe@lakatoskoves.hu and we will send you Updates as they are issued.