text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: See CJEU,

text: Case C-25/17

text: , Jehovan todistajat, para. 57. See Recital 8 of the Regulation.

text: EDPB Guidelines on Automated individual decision making and profiling for the purposes of Regulation 2016/679 (

text: rev.01), 6 February 2018, p. 21. Since it is a security measure, the sample for the video-surveillance policy could be adapted for such system; available on https://edps.europa.eu/sites/edp/files/publication/10-03-17_video-surveillance_guidelines_en.pdf.

amnesord:
COVID-19
Regulation 2018/1725
Privacy in the EU Institutions

title: Orientations from the EDPS: Body temperature checks by EU institutions in the context of the COVID-19 crisis

text: Executive Summary

text: A number of European institutions, agencies and bodies (EUIs) have implemented body temperature checks as part of the health and safety measures adopted in the context of their “return to the office” strategy as an appropriate complementary measure, among other necessary health and safety measures, to help prevent the spread of COVID-19 contamination.

text: At the same time, systematic body temperature checks of staff and other visitors to filter access to EUIs premises may constitute an interference into individuals’ rights to private life and/or personal data protection. The EDPS observes that body temperature checks can be implemented through a variety of devices and processes that should be subject to careful assessment. The EDPS has decided to issue the present orientations to help EUIs and Data Protection Officers (DPOs) meet the requirements of

text: Regulation (EU) 2018/1725

text: (the Regulation), where applicable.

text: The EDPS considers that “basic body temperature checks”, designed to measure body temperature only, operated manually and which are not followed by registration, documentation or other processing of an individual’s personal data would, in principle, not be subject to the scope of the Regulation.

text: Conversely, the EDPS considers that systems of temperature checks, operated manually and followed by registration, documentation or further processing of an individual’s personal data, or systems operated automatically with advanced temperature measurement devices would, in general, fall under the scope of the Regulation. The lawfulness of these processing operations could, in principle, be established by

text: Article 1

text: The EDPS notes that in compliance with Article 24 of the Regulation, temperature checks applied on a mandatory basis should not be based solely on automated processing. Meaningful human involvement should therefore be provided for at relevant stages of the check. The present orientations further provide a non-exhaustive list of technical and organisational recommendations that should be duly taken into account to ensure that appropriate safeguards are in place as well as specific recommendations concerning transparency towards individuals and the follow-up procedure in case of ‘positive check’.

text: Finally, the EDPS advises EUIs implementing temperature checks to review the necessity and proportionality of such measures regularly in the light of the evolution of the epidemic and its scientific understanding.

text: 2 | P a g e

text: 1 Introduction

text: Since the beginning of 2020, EUIs are faced with the emergence of the COVID-19 pandemic. Fever being one of the symptoms exhibited by an infected person, a number of Union institutions, bodies, offices and agencies (EUIs) have implemented body temperature checks adopted in the context of their “return to the office” strategy as complementary measures, among other necessary health and safety measures (masks provision, disinfecting gel, contact tracing by health authorities, etc.), to help prevent the spread of COVID-19 contamination. Other EUIs are either in the process or are considering implementing such body temperature checks. The EDPS observes that body temperature checks of staff and other visitors to filter access to EUIs premises can be implemented through a variety of devices and processes. These should be subject to careful assessment in each case, given that they may constitute an interference into individuals’ rights to private life and/or personal data protection.

text: In that context, the EDPS has decided to issue the present orientations on body temperature checks to help EUIs and their Data Protection Officers (DPOs) ensure appropriate protection of individual’s privacy and personal data and meet the requirements of

text: Regulation (EU) 2018/1725

text: (the Regulation), where applicable. These orientations are without prejudice to any possible future guidance by the European Data Protection Board on body temperature checks in the context of the COVID-19 crisis.

text: 2 Basic body temperature checks are outside the scope of the Regulation

text: The EDPS considers it relevant to distinguish two situations:

text: 1. “Basic body temperature checks” designed to measure body temperature only, operated manually and not followed by registration, documentation or other processing of an individual’s personal data. Such checks would, in principle, not be subject to the scope of the Regulation.

text: 2. Other systems of temperature checks, operated manually and followed by registration, documentation or other processing of an individual’s personal data, or systems operated automatically with advanced temperature measurement devices. Such checks would in general fall under the scope of the Regulation.

text: 2.1 Definition

text: “Basic body temperature checks” usually consist of a system where the security office at the entrance of a EUI building uses a basic temperature measurement device, such as a manual thermometer, to check the temperature of a person (employee, contractor, visitor, etc.), wishing to enter the premises. Such a system only provides an instantaneous temperature value, without

text: 4 | P a g e

text: any recording feature, and the process would not be followed by any registration of the measurement by the EUI. However, under those specific circumstances, such measures do, in principle, not fall under the material scope of the Regulation as defined under

text: Article 2(5)

text: : the EDPS considers that such basic body temperature checks do not involve a processing of personal data wholly or partly by automated means, and that in the absence of any registration of the temperature, such measurements cannot be considered as a processing other than by automated means of personal data forming part of a filing system or are intended to form part of a filing system. ‘Processing (wholly or partly) by automated means’ refers to all processing done by means of computer technologies. This is not the case here: the use by a security officer of an analogue or digital thermometer results only in displaying the temperature, allowing the security officer to read the temperature value with this eyes. The processing 'other than by automated means’ primarily refers to any manual data processing operation executed by humans, in a filing system. A ‘filing system’ means any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis (Article 3(7) of the Regulation. The requirement that the set of personal data must be ‘structured according to specific criteria’ is simply intended to enable personal data to be easily retrieved.2 Files or sets of files which are not structured according to specific criteria do not fall within the scope of the Regulation3. In the absence of any registration of the temperature value, it is impossible for the data to be easily retrieved for subsequent use. Therefore the body temperature collected manually does not form part of a filing system and is not intended to form part of a filing system. To remain outside the scope of the Regulation, temperature measurements may not be followed by registration, documentation or other processing allowing to link such temperature checks to a data subject (such as an identity check that would form part of a filing system).

text: 2.2 Legality

text: The systematic use of such “basic temperature checks” at the entrance of EUIs premises may however result in an interference into the fundamental right to private life protected under Article 7 of the Charter of Fundamental Rights of the European Union, and would therefore be subject to the legality, necessity and proportionality conditions laid down in Article 52(1) of the Charter. The impact on individuals’ privacy should be reduced to the strict minimum needed to reach the desired outcome.

text: 3 Body temperature checks subject to the Regulation

text: 3.1 Definition

text: When the body temperature checks operated manually are followed by the registration of the measurement or combined with an identity check, such temperature checks must be considered as forming part of a filing system subject to the scope of application of the Regulation. The use of automated digital means to detect body temperatures, such as the use of thermal cameras or

text: 5 | P a g e

text: thermal scans, also falls under the scope of the Regulation since the EDPS considers such checks as a processing of personal data wholly or partly by automated means within the meaning of Article 2(5) of the Regulation. Such temperature measurement constitutes ‘processing’ of ‘personal data’, as the information regarding the body temperature is collected and it relates to a identified or identifiable specific person, as per

text: Article 3(1)

text: and (3) of the Regulation. The data in question is ‘data concerning health’, since it is used to reveal information about the person’s health status regarding a possible infection with COVID-19 (or other health issues resulting in high temperature), as per Article 3(19) of the Regulation. This processing would need to be lawful in accordance with Article 5(1) of the Regulation. In addition, the processing of health data is subject to the conditions laid down in Article 10(2) of the Regulation.

text: 3.2 Lawfulness

text: The EDPS considers that the specific requirements for the processing of special categories of personal data provided under

text: Article 10(2)

text: (b), 10(2)(g) and 10(2)(i) of the Regulation are relevant in the current context of the Covid-19 outbreak. The application of the aforementioned Article(s) will depend on the context and the practical implementation of such body temperature checks. For example,

text: Article 10(2)

text: (b) could apply since EUIs as employers have a duty to protect the health and safety of their staff. The EDPS considers that

text: Article 1

text: e(2) of the Staff Regulations providing that “[o]fficials in active employment shall be accorded working conditions complying with appropriate health and safety standards at least equivalent to the minimum requirements applicable under measures adopted in these areas pursuant to the Treaties” provides an appropriate legal ground to satisfy the requirement of lawfulness. Indeed, given the current health crisis caused by the COVID-19 epidemic, body temperature checks of employees and other visitors alike may be deemed necessary by a EUI in order to comply with its health and safety obligations as mentioned above.

text: Article 1

text: (e)(2) of the Staff Regulations supplemented with an executive decision of an EUI, agency or body providing for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject. It will enable the affected person to foresee the impact of the processing operations on its fundamental rights and the powers provided by the Regulation to protect such rights.

text: 3.3 Temperature checks and automated individual decision-making

text: The EDPS observes that certain types of temperature checks may, in the absence of

text: meaningful human intervention in the checking process, qualify as an automated

text: individual decision making subject to Article 24 of the Regulation. Temperature checks based solely on automated processing, like a thermal scan or thermal camera, which might lead to prevent an individual from entering into a building, could be seen as an automated individua l decision-making process with significant effects similar to legal effects. In that regard, the EDPS notes that there is currently no Union Law, as per

text: Article 24(4)

text: , authorising temperature checks based solely on automated processing to allow or deny access to EUIs premises on health and safety grounds. Hence, a fully automated temperature

text: 6 | P a g e

text: Temperature checks applied on a mandatory basis should not be based solely on automated processing, and should therefore provide for meaningful human involvement

text: at relevant stages of the check process. According to the EDPB guidelines on this matter, “[t]o qualify as human involvement, the controller must ensure that any oversight of the decision is meaningful, rather than just a token gesture. It should be carried out by someone who has the authority and competence to change the decision.”

text: In line with the EDPB Guidelines, the EDPS advises controllers to identify and record the

text: degree of any human involvement in the temperature check process and at what stage

text: this takes place. The EDPS considers human involvement particularly relevant in case of ‘positive check’ by the automated processing resulting in a denial of access. In those cases, a second or third check upon request by someone who has the authority and competence (e.g. a doctor or a nurse) to assess the specific situation of the data subject and to inform and advise him/her accordingly would, in general, be considered as a meaningful human involvement (see also hereunder section 4.2 on “Denial and follow-up”). This could also include the integration via human intervention of specific circumstances affecting the data subjects by using an exemption certificate or allowing exceptional/compassionate decisions.

text: 3.4 Technical and organisational measures

text: The deployment of body temperature checks devices may call for specific and appropriate safeguards under

text: Articles 10

text: and, where applicable, Article 24 of the Regulation. In addition as for any data processing operation, the obligations of data protection by design and by default as set out in Article 27 of the Regulation should be applied: EUIs should design body temperature checks in such a way that the amount of collected personal data is minimised. EUIs should also ensure that the selected body temperature measurement devices employ privacy-friendly technology. Depending on the processing capabilities of the system used to carry out body temperature checks, additional data protection safeguards need to be implemented. Those measures should be documented in a specific policy document and audited regularly. The EDPS addresses below a non-exhaustive list of recommendations that should be duly taken into account to ensure that appropriate safeguards are in place where the temperature check system falls within the scope of the Regulation.  Systems for carrying out body temperature checks should be operating independently and not linked to any other IT system and in particular should not be connected to the security system such as the CCTV network. Being independent also means that the system for carrying out body temperature checks is not linked to any form of identity check.  It should be designed as a real-time system and no recording should be made of the reading. EUIs may place a remote viewing system close to the thermal scanner that does not allow the recording of the images.  EUIs may want to use some industrial-grade electric thermal imagers that were not primarily designed for epidemic responses. In such cases, the selected machine would

text: 7 | P a g e

text: need to be adapted to comply both with technical and data protection

text: requirements for its operation.  As previously indicated and especially for automated system, it must be verified that

text: there is no recording of the thermal images and the results are only displayed on

text: “live” screen. If the system can transmit images remotely via a wired or wireless protocol (e.g.: ZigBee, Bluetooth, Wi-Fi, Ethernet), it needs to be isolated from other networks.  The controller should verify the data accessed by the manufacturer of a temperature measurement devices if a telemetry system is installed for monitorin g the correct operation of such apparatus.  The full data life cycle needs to be analysed, in order to ensure that no recording or storage occurs. Furthermore, the use of the system should be limited to filter access to EUIs premises and not be deployed for another purpose. In order to ensure compliance with the purpose limitation principle : the purpose of the system for carrying out body

text: temperature checks must solely remain the detection of a person wishing to enter

text: an EUI premise having high temperature compared to a pre -defined threshold. The selection of a specific temperature threshold should be explained and documented.  In addition, since there is approximately a difference of one degree Celsius between a regular temperature and the threshold, the accuracy of the devices need to be verified

text: and might involve regular calibration of the sensor.

text:  Finally, the personnel who will be in charge of the checks need to be properly trained for the operation and interpretation of results (see also hereunder section 4.2 on “Denial and follow-up).

text: 4 General considerations for both types of temperature checks

text: 4.1 Transparency

text: The EDPS suggests that any person entering the building of an EUI should be clearly

text: informed that a temperature check system is in place with a clear indication of the reason of such a check and by whom and when these checks were decided. Signs with information about the temperature checks should be placed at such locations and be large enough so that individuals can notice them and can read them without difficulty. The signs within the buildings should be in the language (or languages) generally understood by staff members and most frequent visitors. If there is any question on how the temperature measurement device works and what data are collected, individuals should be able to receive appropriate information from the EUI/data controller.

text: 4.2 Denial and follow-up

text: In case of a ‘positive’ temperature check, a suitable follow-up procedure should be in

text: place. At this stage, the person should be given the opportunity to benefit from a second measurement. The second measurement should make it possible to rule out a cause linked to a malfunction or calibration issue of the device. Following the second measurement, if the person’s temperature is still above the defined threshold, the person should be given the opportunity to benefit from a third measurement performed by a healthcare professional using another device (see also section 3.3 on “Automated individual decision-making” and human involvement in the temperature check process).

text: 8 | P a g e

text: If following the third measurement the person body temperature is still above the defined threshold, the person prevented from entering the building should be provided appropriate advice and information, including at minimum a leaflet with contact details of health authorities and COVID-19 testing locations. If the person (staff, visitor and contractor alike) who is denied access requests a proof of that denial, the security staff should provide a receipt with the date, time and location of entrance with the indication that the holder of such receipt was denied entry because of a restriction currently in place at the EUI. As regard its own staff, while EUI’s employees may have to justify their absences at the office to their managers, such absence should be dealt with under normal procedure in place for such cases. The processing of personal data related to leaves and absences should remain clearly separated from the temperature check system put in place. The staff member concerned should be provided solutions, such as teleworking, that limit the disruption to its private life and like any other medical leave requests he/she should not be penalized or stigmatized as a result of a positive temperature check.

text: 4.3 Review

text: During this crisis, it is essential to comply with the requirements set out in the Regulation and in the Charter of Fundamental Rights. Under the principle of accountability, there should be an evidence trail to document the decisions taken in relation to data protection issues.

text: The EDPS advises EUIs implementing temperature checks to continuously review the necessity and proportionality of such measures in the light of the evolution of the epidemic situation and its scientific understanding.

text: 9 | P a g e


text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32018R1725) See for instance World Health Organization (WHO) interim Guidance of 10 may 2020 on “Contact tracing in the context of Covid-19”, available here: https://www.who.int/publications/i/item/contact-tracing-in-the-context-ofcovid-19 and the WHO Guidelines on ethical issues in public health surveillance of 2017, available here: https://www.who.int/ethics/publications/public-health-surveillance/en/ . TechDispatch #1/2020: Contact Tracing with Mobile Applications found on https://edps.europa.eu/dataprotection/our-work/publications/techdispatch/techdispatch-12020-contact-tracing-mobile_en EDPB guideline 04/2020 of 21 April 2020 on contact tracing tool found on https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_20200420_contact_tracing_covid_with_anne x_en.pdf “Officials in active employment shall be accorded working conditions complying with appropriate health and safety standards at least equivalent to the minimum requirements applicable under measures adopted in these areas pursuant to the Treaties. ». This provision should be interpreted with the requirements set out in Directive (

text: ) on the introduction of measures to encourage improvements in the safety and health of workers at work and in particular

text: Article 6

text: . For further analysis, you may read page 9 of the European Data Protection Board’s Guidelines 05/2020 on consent under Regulation 2016/679. Found at https://edps.europa.eu/data-protection/our-work/publications/guidelines/data-protection-impactassessment-list_en 8 In accordance with the principle of accountability, where Union institutions and bodies transmit personal data within the same Union institution or body and the recipient is not part of the controller, or to other Union institutions or bodies, they should verify whether such personal data are required for the legitimate performance of tasks within the competence of the recipient. In particular, following a recipient’s request for transmission of personal data, the controller should verify the existence of a relevant ground for lawfully processing personal data and the competence of the recipient. The controller should also make a provisional evaluation of the necessity of the transmission of the data. If doubts arise as to this necessity, the controller should seek further information from the recipient. The recipient should ensure that the necessity of the transmission of the data can be subsequently verified.

text: In this regard, see EDPS Guidelines on the concepts of controller, processor and joint controllership under

text: Regulation (EU) 2018/1725

text: , https://edps.europa.eu/sites/edp/files/publication/19-11- 07_edps_guidelines_on_controller_processor_and_jc_reg_2018_1725_en.pdf .

identifier: EDPS riktlinjer (2021)

publisher: Europeiska datatillsynsmannen

sprak: en

title: Orientations on manual contact tracing by EU Institutions in the context of the COVID-19 crisis

serie: riktlinjer

text: Executive Summary

type: stycke

text: Some European institutions, agencies and bodies (EUIs) have implemented a manual contact tracing system in order to trace persons who have been in close contact with a person infected by COVID-19. Contact tracing shall assist medical staff to assess the spread of a contagious disease and if possible prevent additional infection.

text: Regulation (EU) 2018/1725

text: (the Regulation) as long as EUIs put in place comprehensive data protection measures. The ethics of public health information requires that privacy considerations are thoroughly addressed at all levels of contact tracing activities.

text: Article 10(2)

text: (b) and10(2)(h) of the Regulation are relevant lawful grounds for the processing of special categories of personal data for the manual contact tracing of staff and members of the staff’s household. The provisions of Article 59 of the Staff Regulation related to the management of medical leave is the relevant legal ground for the processing of COVID-19 medical information by the medical service of EUI. Article 59(5) of the Staff Regulations satisfy the requirement of lawfulness for contact tracing, including the collection of data from members of the staff’s household, provided that such information is disclosed by the staff member.

text: The EDPS observes that EUIs do not have a legal basis, comparable to Article 59(5) of the Staff Regulations, to process health related data of non-staff person in its manual contact tracing operation. However, the EDPS considers that informing a non-staff person that he or she may have been in contact with an individual who has been found to be infected can be considered as a processing necessary for the performance of a task carried out in the public interest under

text: Article 5(1)

text: (a) of the Regulation. The lawfulness of this limited processing operation (restricted to informing the non-staff person) can be established by

text: Article 1

text: Informing affected data subjects should be done on the basis of a clear protocol limiting the amount of data to what it is considered strictly necessary to achieve its goals. Additionally, adequate security measures following Article 33 of the Regulation need to be in place when information and communication technologies are used for this purpose. The implementation of a manual contact tracing process by EUIs requires specific and adequate safeguards under Article 10 of the Regulation. The EUI shall take steps to ensure that any person acting under his authority process the data under its specific instructions.

text: 2 | P a g e

text: 1 Introduction

type: rubrik

text: In addition to other mitigation measures such as teleworking and compulsory body temperature measurement at the entrance of their buildings, some European institutions, agencies and bodies (EUIs) have implemented a manual contact tracing system in order to trace persons who have been in close contact with a person infected by COVID-19. Other EUIs might follow and apply a similar measure. EUIs put in place manual contact tracing systems to fight the COVID-19 pandemic within the European institutions as part of their standard epidemiological toolkit. Contact tracing shall assist medical staff to assess the spread of a contagious disease and if possible prevent additional infection by isolating contact persons before being contagious and thus spreading themselves the disease. The EDPS considers that manual contact tracing is compatible with the requirements of

text: Regulation (EU) 2018/1725

text: (the Regulation) as long as EUIs put in place comprehensive data protection measures. The ethics of public health information requires that privacy considerations are thoroughly addressed at all levels of contact tracing activities . The EDPS distinguishes between manual contact tracing and contact tracing with mobile applications. Manual contact tracing relies on health service agents to survey contaminated individuals for their close contacts. Subsequently, the health service agents reach out to those close contacts in order to assess their risks of having being infected and spreading the disease. They provide mitigation advice such as the need to undergo a test, inform their close contacts or quarantine/self-isolate. With the wide availability of mobile phones, mobile applications have been developed during this health crisis in order to notify the users on possible infection risks and assist health authorities in identifying and informing contact persons. The EDPS has already presented an overview of contact tracing with mobile applications in May 2020 . In addition, the European Data Protection Board (EDPB) has also published in April 2020 comprehensive guidelines on such tools . Due to its very different nature and data protection concerns, the issues raised by such system is not discussed in this document which is solely focused on manual contact tracing.

text: 2 Legal measures in relation to manual contact tracing

text: 2.1 Scope

text: Manual contact tracing is implemented at Member State level by the respective national health authorities. The system is broadly designed by national health authorities around persons living or entering the country. These authorities benefit from a well-defined public health legal framework with robust protocols related to the management of contagious diseases. Except for some specialised agencies like the European Centre for Disease Prevention and Control (‘ECDC’) that regularly or exclusively work in this domain, some EUIs, due to the COVID-19 crisis, only recently started developing a manual contact tracing system aiming mainly to protect the health of their employees and their contacts. Manual contact tracing is an epidemiological tool designed to break the chain of contamination. While contact tracing is primarily linked to persons with a confirmed diagnosis of COVID-19 infection, other data subjects, who are not currently infected or confirmed to be infected, are

text: 4 | P a g e

text: also concerned by this processing activity. Thus, this tracing system developed by EUIs will primarily concern their staff, although it could also concern other persons, who regularly work within or occasionally visit the EUI building, but are not directly employed by EUIs such as cleaning agents, experts from the Member State or security staff (non-staff). In addition, it may involve tracing members of the staff’s household (i.e.: wife, children, parents…).

text: 2.2 Legal basis

text: Most health and safety measures adopted by EUIs during this COVID-19 crisis are designed to provide a safe working environment for its staff in application of the requirements set out in

text: Article 1

text: (e)(2) of the Staff Regulation . The provision of masks or the measurement of body temperature are passive systems intended to reduce the infection risk. Manual contact tracing actively contribute to the medical management of an epidemic, an activity which fall outside the primary role of EUIs except for specific institutions working in this domain. All processing operations must satisfy the requirement of lawfulness as set out in Articles

text: and

text: (for health data) of the Regulation. Given the employment context of such tracing system, it is unlikely that consent would provide a valid or a relevant legal ground for the processing operation . The EDPS considers relevant to distinguish the collection and processing of personal data from staff and members of the staff’s household from the processing of personal data of non-staff persons.

text: 2.2.1 Staff and members of the staff’s household

text: The EDPS considers that

text: Article 10(2)

text: The provisions of Article 59 of the Staff Regulation related to the management of medical leave is the relevant legal ground for the processing of COVID-19 medical information by the medical service of EUI. However, it only applies to staff members who have a confirmed diagnosis. Article 59(5) of the Staff Regulations providing that an “[o]fficial may be required to take leave after examination by the institution's medical officer if his state of health so requires or if a member of his household is suffering from a contagious disease.” satisfy the requirement of lawfulness for contact tracing, including the collection of data from members of the staff’s household, provided that such information is disclosed by the staff member. However, it is the EDPS understanding that

text: Article 59(5)

text: is not applicable to staff members who will not generate a chain of contamination at the office (e.g. members who are exclusively teleworking and has not come to the office at all in the period during which they were contagious).When a staff member from one EUI may have been in contact with an infected person from another EUI, there is a need to share the tracing information between different EUIs’ medical services. Such transmission of personal data would need to comply with the Regulation and is further discussed in section 3.3.

text: 5 | P a g e

text: Manual contact tracing is subject to the principle of proportionality. Only relevant data, adequate and limited to what is necessary for the purpose (data minimisation) shall be collected and processed. Only those persons in close contact with the infected staff member shall be traced and monitored. Given the exponential nature of the infection dynamic, if the contamination level is too widespread within EUIs, the EDPS believes that the most appropriate measure to break the contamination chain would be, as it is the case at the moment of the adoption of these orientations, the extensive use of teleworking for most staff members and drastically limiting the amount of close contacts staff would encounter at work. In any case, following the dynamic nature of the contagion, EUIs must regularly review the use of such tool and its proportionality.

text: 2.2.2 Non-staff person

text: During normal day-to-day operation, EUIs may collect personal data such as access register or meeting lists of non-staff contacts regularly or occasionally visiting EUIs premises. This data might, incidentally, be of interest for contact tracing operations. The EDPS observes that EUIs do not have a legal basis, comparable to Article 59(5) of the

text: Article 5(1)

text: Article 1

text: (e )(2) of the Staff Regulations supplemented with an executive decision of an EUI, agency or body providing for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject. In this case, the processing should be strictly limited to the purpose of informing the non-staff contacts and providing him/her with the contact details of local health authorities. EUIs should not collect medical or health related information from a nonstaff person aside from the information required to contact trace its staff. Non-staff persons should be clearly informed that access register or meeting lists may be used for contact tracing. EUIs may also collaborate with employers of non-staff contacts persons in order to have a comprehensive contact tracing system. Similarly, employers of non-staff persons, especially those who regularly work within EUIs buildings, should inform the EUIs of any employees being infected and equally respect the right to privacy and anonymity of their own employee. In other words, they should provide the necessary information for EUIs to identify his own staff who is at risk. This information might be legitimately transmitted to national health authorities provided that the requirements described in section 3.4 are met. Local health authorities are normally

text: entitled to know the infection status of non-staff contacts and should collaborate with the EUIs’ health service. Likewise, local health authorities may provide information to EUI medical service in order to trace staff members who have been in contact with infected

text: non-staff contacts. This does not prevent EUIs to trace contacts of its staff following the lawful disclosure of a contact with someone infected.

text: 6 | P a g e

text: 2.3 The need for a data protection impact assessment

text: Given the ramifications on data subject’s privacy of contact tracing, it is relevant to analyse whether a data protection impact assessment (DPIA) is required under Article 39 of the Regulation. In accordance with

text: Article 39(4)

text: , the EDPS has published on 17 July 2019 a decision which provides a framework for EUIs as controller to assess when it is necessary to conduct a DPIA for a processing operation . In this decision, various criteria are deemed “(...) likely to result in a high risk to the rights and freedoms of natural persons”. A toolkit is provided in annex 1 of this decision in order to assist EUIs in undergoing this analysis. The following criteria would apply for a manual contact tracing processing operation implemented by EUIs. The first applicable criterion is the use of sensitive data concerning the health of the data subject. Contact tracing is triggered when it is discovered that the data subject is contaminated or possibly contaminated by the COVID-19 disease. The second applicable criterion is the potential scale of the manual contact tracing operation. COVID-19 disease can potentially infect anyone and thus should a large number of concerned data subjects be infected, the scale of the manual contact tracing operation could include a large number of staff members as well as staff members of other EUIs and numerous non-staff persons who were in close contact with infected or possibly infectious persons. While some data subjects may have a limited range of contacts, others given the global influence of the operation of the European Union could have been in close contact with a large number persons that would need to be traced. Finally, a third criterion should also be considered. It will be the first time that EUIs implement a manual contact tracing operation. It will involve the application of novel organizational solution and processes. As shown for example in section 3.2, badly designed procedures and unidentified data flows may lead to accidental exposure of sensitive medical data that may not only affect the data subject but also the global acceptance of this kind of operation. For its success, it is essential that the main data protections risks and issues are properly identified and addressed for this novel processing operation. A comprehensive DPIA will assist EUIs and provide a framework to tackle them. In view of the high sensitivity of the data at stake and the high risk for the privacy of individuals, EUIs need to conduct a DPIA when developing and implementing a manual contact tracing operation. By performing a DPIA, controllers will be able to design a robust and data protection-compliant system that will contribute to the smooth deployment of such system and its operational success.

text: 3 Operational aspects of manual contact tracing

text: 3.1 Medical data for medical professional

text: Given the nature of the pandemic, COVID-19 infections are not exceptional. Still, the infection status remains sensitive health data that require special care even if data subjects commonly share this information within their social circle. As shown above, the relevant legal ground for the processing of health data related to the COVID-19 infection by EUIs is Article 59(5) of the Staff Regulation. This Article clearly indicates that “the institution’s medical officer” is playing a critical role in processing the information linked to contact tracing. Therefore, the processing of health data should remain under the control and supervision of the medical officer or other medical professionals who are

text: 7 | P a g e

text: bound by medical confidentiality. Contact persons should preferably be contacted by personnel able to provide relevant information regarding the contamination risk and guidance on mitigation measures and treatment option. Special care should be applied when communicating health related information to non-medical staff in order to implement the relevant mitigation measures. EUIs must ensure that only the necessary information is provided. For instance, for the disinfection of an office, it is sufficient to designate which offices need to be fully cleaned. It is paramount to preserve the confidentiality of the medical information of the affected staff. This requirement does not prevent the processing of non-medical or health related data by non-medical staff but in charge of security or relevant measures in order to implement general health and safety measures.

text: 3.2 Communication to the contact persons

text: A vital step of manual contact tracing is informing the contact persons of a positive test of COVID-19. As such, this process can be disturbing for the privacy of the affected persons and their close contacts and special attention should be given to provide such information in a discreet way, respecting data protection rules. Informing affected data subjects should be done on the basis of a clear protocol limiting the amount of data to what it is considered strictly necessary to achieve its goals. Additionally, adequate security measures following Article 33 of the Regulation need to be in place when information and communication technologies are used for this purpose.

text: Information provided in the context of contact tracing must:  not reveal the identity of persons with a confirmed diagnosis of Covid-19 infection to the contact persons,  avoid informing simultaneously different contacts of a person (e.g. by putting them in cc of the email notification), as this could result in revelation of the person’s contacts and to a violation of his/her data protection rights.  refrain from including other, non-necessary, information about the affected persons, such as information on their health conditions or additional contact details that could identify the affected individual.

text: The EUIs should regularly remind staff members involved in the contact tracing operation of the sensitivity of the personal data being processed and of the common mistakes that can occur especially with the use of communication technologies (such as email, SMS etc). In case of a security incident during the above process which is identified as a personal data breach, the DPO of the EUI should immediately be involved in order to advise on measures to limit the impact of the incident. Due to the sensitivity of the personal data involved in this process, apart from notifying the breach to the EDPS, the EUI should inform affected data subjects according to Article 35 of the Regulation.

text: 3.3 Communication between medical officers of various EUIs

text: 8 | P a g e

text: During the normal operation of EUIs, staff members of different EUIs meet regularly for various reasons. In case of an infected staff member, EUIs may consider to trace or inform contacts of other EUIs. In order to implement an effective manual contact tracing strategy, EUIs as controllers need to transmit personal data to EUIs whose staff was in contact with the infected or potentially infected person. In such case, EUIs must comply with the requirements of Recital 21 of the Regulation and ensure that the transmitted information is necessary for the implementation of an effective contact tracing strategy. Medical services should agree how to proceed in practice with these data exchanges with appropriate technical and organisational measures to guarantee the confidentiality of the transmission of data. If bigger EUIs propose the use of their contact tracing platform to smaller EUIs, the responsibilities of each party in this processing operation should be clarified. Such relationships also need to comply with the requirements of either

text: Article 28

text: (joint controller) or 29 (processor) of the Regulation .

text: 3.4 Data transmission with local health authority

text: As previously mentioned, manual contact tracing by EUIs should be mainly limited to their staff and members of their household. Yet, the COVID-19 disease is not limited to the professional environment and local health authority will probably request data from contaminated staff members in order to expand the contact tracing operation to the full social sphere of the infected individual. This data transmission needs to comply with the requirements of Article 9 of the Regulation. Provided that the local health authority establishes that the request for transmission of personal data of the infected person falls within its legal duties to implement a contact tracing operation, it shall comply with the requirements of

text: Article 9 (1)

text: (a) of the Regulation. In any case, EUIs as controller need to ensure that the personal data transmitted to the local health authority is limited to what is necessary to pursue a local contact tracing strategy. In addition, EUIs must implement proper security measures in order to safeguard the confidentiality of the information provided.

text: 3.5 Duration of data storage

text: Controllers are reminded that the data collected for contact tracing need to be stored only for the required amount of time needed to achieve the primary goal of such processing operation and thus to comply with the requirements of

text: Article 4 (1)

text: (e). Thus following the complete tracing of the contacts of the affected data subject, the data collected for this specific purpose should be stored for a maximum of 14 days then be deleted in due time. While, the use of the manual contact tracing system for other purpose (“function creep”) must be avoided, it does not prevent the storage of such data for other compatible legitimate and duly documented medical or epidemiological purposes. If the collected data is meant to be used for research or statistical purpose, it is advised that safeguards designed to comply with Article 13 of the Regulation are implemented right at the start of the processing operation.

text: 9 | P a g e

text: 3.6 Technical and organisational measures

text: The implementation of a manual contact tracing process by EUIs requires specific and adequate safeguards under Article 10 of the Regulation. The security of the data in the whole data cycle of the process shall be ensured following the application of the adequate measures according Article 33 of the Regulation. The EUI shall take steps to ensure that any person acting under his authority process the data under its specific instructions. As for any data processing operation, data protection by design and by default set out in Article 27 of the Regulation must be applied. EUIs must ensure that they safely collect and process only the minimum amount of data and use privacy-friendly technologies at all stages of the process. This may include: - Providing access only on a need-to-know-basis to agents briefed about confidentiality, - Implementing accountability measures with regards to data access (e.g. logging), - Storing the contact data on secured servers or on cloud services designed for storing health data. The implemented measures should be documented and regularly audited. Great care should be taken in relation to the collected health data and controllers should use enhanced protection measures such as encryption. Similar security measures should be implemented for data transmission between various EUIs medical services and also with local public health authority in order to guarantee the confidentiality of the transmitted personal data. A full data life cycle analysis as required with DPIA can assist controllers in identifying weak spots and operational risks in the processing operation.

text: The purpose of this system must solely remain the disruption of contamination chain

text: within EUIs.

text: 3.7 Data subject’s rights

text: The medical imperatives of the management of the spread of the COVID-19 disease within the EUIs does not preclude controllers to comply with the requirement of Chapter 3 of the Regulation (Rights of data subject). For instance, if there is any question on how the manual contact tracing system works and what data are collected, data subjects should be able to receive appropriate information from the data controller and have controller’s contact details for lodging complaints or giving feedback on the contact tracing system. In particular, controllers should provide clear information to data subjects as regard to the collaboration between EUI and local public health authority. In addition, controllers should also provide clear information to the data subjects in relation to the possibility to oppose the contact tracing operation and its consequences. If there are any restrictions to the data subject’s rights, they must comply with the requirements of Article 25 of the Regulation.

text: 10 | P a g e

text: 11 | P a g e

type: vagledning

utgivare: edps


title: Return to the Workplace and EUIs’ screening of COVID immunity or infection status

text:   5

text: - 𝑝 100% − 𝑝 = 5%) -