If an employee has COVID-19 is this sensitive data?
Is the fact that an employee has COVID-19 special category data? And if yes, how can we tell other staff about this without breaching GDPR?
Yes, it is special category data (i.e. sensitive personal data). Generally speaking, special category data can only be processed in very limited circumstances, typically where you have consent or it is necessary in the field of employment law. However, given the current state of affairs and PHE’s advice to prevent the spread of COVID-19, you may be able to justify processing this data using other grounds.
There are a number of avenues here, and it is quite complex, but one thing you should remember is that you can always process special category data where that processing is necessary to protect the vital interests of a staff member with COVID-19 or the vital interests of his/her immediate colleagues.
Any processing must be limited to what is strictly necessary, i.e. notifying the colleagues which staff member has contracted COVID-19 in case they have had close contact as well, but requesting that the information is not broadcast more widely or circulated outside of the company in order to maintain the individual’s expectation of privacy.
GET IN TOUCH
If your business needs legal support with any issues arising from COVID-19, please get in touch with Matthew Holman.
All information in this document is accurate at the time of writing. It is meant for general information only and is not legal advice.