Privacy in the time of the coronavirus

In order to take appropriate measures to provide a safe environment, employers are finding that they need to process more personal data than in normal times. A proper data processing protocol can and should strike a balance between epidemic control and privacy protection.

Can employers lawfully collect personal data about employees, including sensitive data (health data, data on family members), using questionnaires and devices?

The employer must provide a working environment that does not threaten life and health. If an employer needs to process a wider range of personal data than before the COVID-19 outbreak in order to maintain a healthy working environment, the employer may lawfully process this data to the extent necessary to achieve the purpose.

However, in order to be lawful in the processing of such data, it is essential that the employer develops a so-called pandemic/business continuity action plan.

As recommended recently by the Hungarian National Authority for Data Protection and Freedom of Information (hereinafter: “HDPA”, and “recommendation of the HDPA”), the plan should elaborate, for what purpose and what kind of data processing is required, and the risks to the employees should be considered.

Employees should be fully informed of the reasons why their employer needs to process additional personal data.

According to recommendation of the HDPA, within the framework of provision of information to employees, „attention needs to be called with emphasis to the fact that in the event of any alleged contact with the coronavirus and upon the onset of other conditions specified in the information material individuals should report this to the designated person and visit the company doctor or another physician immediately in order to protect their own and their colleagues’ health”.

Application of questionnaires

According to recommendation of the HDPA, the employer may record information that the employee has been in the an area affected by the outbreak and if as well as if the employee has been in contact with a person who has come from this area. With respect to the range of data so recorded, the HDPA deems it acceptable to have the employees complete questionnaires, however, the HDPA expressly underlines that the questionnaires may not include data concerning the medical history of the data subject and the employer may not require employees to enclose health documentation.

Application of diagnostic device

The recommendation of the HDPA published on 10 March 2020, the HDPA, regards the requirement of screening tests with any diagnostic device (in particular, but not exclusively, with a thermometer) disproportionate with a view to the current situation of the epidemic in Hungary. In particularly justified cases, the employer may only call for tests to be carried out by health care professionals or under their professional responsibility and the employer is entitled to be informed only about the results of these examinations.

Data processing in special legal order in case of mass epidemic

Since the publication of the recommendation of the HDPA of 10 March 2020, a special legal order called state of emergency (in Hungarian: „veszélyhelyzet”), has entered into force.

At the time of publication the recommendation of the HDPA, 9 people were diagnosed with COVID-19 in Hungary and no fatalities have occurred. The state of emergency that has come into effect since then, the epidemic situation that has resulted in several deaths, and the government decree of March 18, 2020, and the advice of the National Center for Public Health published on March 24, 2020, have created a new situation. The previous position of the HDPA is likely to be reviewed, as the epidemiological situation puts increasing pressure on the health care system and, at the same time requires more sacrifice and attention from all entities.

To our knowledge, several employers measure the temperature of their employees. It is possible that employer body temperature measurement will lead to earlier detection and consequently fewer infections, which could even save human lives. In the current situation, it may be that this measure falls under section GDPR Article 6. (1) (d), i.e. the processing of data is necessary for the protection of another person's vital interest. In this case, and until further notice from the HDPA, it is strongly recommended that the results of the measurements are not recorded, only if a worker develops heat rises or fever.

As the situation develops, we will be providing further updates.

Who to contact?

Please do not hesitate to contact any member of our team:

Iván Sólyom
Éva Bognár
Alekszej Dubalár
Péter Szaniszlai

To download this newsletter, please click here.


We, at Lakatos, Köves & Partners will be producing Updates to our COVID19 Newsletters as the situation develops. If you would like to receive those Updates please write to us at subscribe@lakatoskoves.hu and we will send you Updates as they are issued.