The recent publication of the "Guidelines for Health Surveillance of Workers at Risk of Exposure to COVID-19" and the imminent economic reactivation of the country raised a number of questions and concerns regarding the correct treatment of the personal data of employees that would be subject to the monitoring of their health condition. That led the National Authority for the Protection of Personal Data to issue the non-binding Advisory Opinion No. 32-2020-JUS / DGTAIPD, which addresses these matters.

The guidelines establish among their provisions that, prior to the return or reinstatement of employees to their workplace, they must fill out — with the character of sworn statement — the so-called "Symptomatology Sheet COVID-19," which contains basic questions related to the symptoms of the disease. It also established the obligation to periodically apply serological or molecular tests for COVID-19 to all employees who return to jobs considered to be very high, high or medium risk, at the employer's expense. Furthermore, it stated that the temperature of all workers must be taken at the beginning of the working day, and those with a temperature greater than 38° Celsius flagged. If it turns out to be suspicious, a special protocol must be followed that could include quarantine and the communication of such a status to the individuals' contacts at the workplace and at home. 

The advisory opinion has made it very clear that employers do not need to obtain their employees’ consent to process their personal data, provided that this treatment is done with due respect for the Peruvian Personal Data Protection Law and its regulations. Likewise, it has mentioned that employees must cooperate and provide information to their employer regarding the possible or actual contagion of COVID-19 — all these to guarantee the safety and health in the workplace and prevent the spread of COVID-19. 

The National Authority for the Protection of Personal Data based their conclusions on the following provisions:

• The limitations on consent listed in Article 14 of the Peruvian Law on Protection of Personal Data, specifically: a) the existence of a contractual relationship, such as the employment relationship; b) the public interest, such as public health or the health of the holder of personal data and risk prevention; and c) the existence of legitimate interests of the owner of the data, such as safeguarding their health.
• The employer’s legal duty to provide a safe and healthy work environment and prevent the occupational risks of its other employees within the framework of the health emergency.
• That the treatment of these sensitive data obeys the specific purpose of containing the spread of the COVID-19, limits itself to that purpose and does not extend to others nor keep personal data for longer than necessary for the purpose for which they are collected.
• The employee’s legal duty to contribute to the fulfillment of the established obligations of safety and health at work, cooperating with the employer so that the latter can guarantee safe conditions for employment, reducing as far as possible the risks of contagion for the rest of the personnel, suppliers, clients or users of its services.

In other words, the data protection legislation expressly alludes to public interest and health as factors that enable the processing of personal data relating to people's health without their consent, which covers the treatment of these data when there is a correspondence with the COVID-19 diagnosis or symptoms and that the appropriate measures are taken to prevent the spread of the virus inside and outside the workplace.

Takeaways

• Employees must inform their employer of the symptoms or possible contagion of COVID-19 or of their condition as workers with risk factors for COVID-19 since not doing so would constitute a danger to their own health and safety and from the rest of the people who physically interact in the work center.
• Employers must inform the employees of the symptomatology or of the reactive or positive result of a test carried out for COVID-19, as the case may be, when the health authority or person in charge of Safety and Health of Workers at the workplace considers that the health of the employees could be at risk due to direct or indirect contact with the one infected, with the sole purpose of reconstructing the chain of possible contagions and to prevent people with whom they may have had contact to adopt the corresponding sanitary measures.
• Employers must inform the employees about the details of the treatment of their personal data and must adopt sufficient technical and organizational measures to safeguard the integrity and security of the information collected until it is useful for the specific health purpose or is deleted, dissociated or anonymized by the effect of a legal mandate.

Photo by Eduardo Flores on Unsplash