This was stated by the Privacy Guarantor in the press release of 2nd March 2020
On 2nd March 2020, the Privacy Guarantor, accepting the invitation of the competent institutions to a necessary co-ordination of the Coronavirus measures on the national territory, requested all data controllers (including, therefore, employers) to comply scrupulously with the indications provided by the Ministry of Health and by the competent institutions for the prevention of the spread of Coronavirus, without carrying out autonomous initiatives, which provide for the collection of data on the health of users and workers, which are not normally provided for by the competent bodies.
Therefore, although there is an obligation for workers to report any situation of danger to health and safety to employers, the latter must refrain from requesting and collecting information regarding the presence of any flu symptoms of employees and contacts outside the sphere of work.
This is a provision in line with the principles of EU Regulation no. 2016/679 (GDPR), which attaches particular importance to the protection of personal data relating to the health of the person (see in particular art. 4 no. 15), considered sensitive data and in which, pursuant to Recital 35, fall within "All data concerning the health status of the data subject that reveal information related to their past, present or future physical or mental health status. This includes… information resulting from tests and checks carried out on a part of the body or an organic substance, including genetic data and biological samples; and any information concerning, for example, a disease, a disability, risk of disease, medical history, clinical treatments or the physiological or biomedical state of the interested party, regardless of the source, such as, for example, a doctor or other healthcare professional, hospital, medical device or in vitro diagnostic test. "
Article 9 of the GDPR generally prohibits the processing of this data, considered as genetic or biometric, relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, union membership, sexual life or sexual orientation of the person.
Moreover, the Supreme Court has always defined the data in question as "supersensitive", as it pertains to the most intimate aspects of people and therefore needs extra protection (Cass. no. 222 of 11.1.2016; Cass. no. 21107 of 7.10.2014; Cass. no. 18443 of 1.8.2013).
The prohibition, which concerns employers, does not apply to public health bodies (especially when processing is necessary for reasons of public interest, in relation to serious threats to health) and to those responsible for preventive medicine, occupational medicine, assessment of the employee's working capacity, diagnosis, assistance and / or health and / or social therapy.
The Guarantor's press release is also consistent with the provisions of art. 5 law 300/70, which prohibits checks by the employer on the suitability and infirmity due to illness or accident of the employee, obliging them to contact public bodies and specialised institutes of public law, as well as with art. 8 of the same law, which prohibits the employer from carrying out investigations, including through third parties, not only on the political, religious or trade union opinions of the worker, but also on facts not relevant for the assessment of the professional attitude of the worker. (LC)
