Poland: Amendment to the special act on coronavirus – the Senate’s bill in the context of personal data protection

published on 27 March 2020 | reading time approx. 2 minutes

 
The special act of 2 March 2020 raises controversies and concerns about how its application will affect the processing of personal data.

In response to those concerns, the Polish Senate proposed on 13 March 2020 a bill amending the Act on Specific Steps to Prevent and Combat COVID-19, Other Contagious Diseases and the Crises They Cause and certain other acts (“special act”).

 
The explanatory memorandum to the bill says that: “the purpose of the bill is to refine and supplement the provisions of the Act of 2 March 2020 on Specific Steps to Prevent and Combat COVID-19, Other Contagious Diseases and the Crises They Cause (“the COVID-19 Act”). The bill should also introduce tools to minimise the negative consequences suffered by the Polish economy, especially micro and small enterprises, due to coronavirus.”

 
The bill gives employers various rights and tools to control the heath condition of their employees (Article 1(4) introducing Article 3a). The employer will have the right to:

• demand from the employee information whether he/she has recently been to a COVID-19 affected area;
• demand from the employee who is reasonably suspected of being COVID-19 infected or who has recently been to a COVID-19 affected area that he/she undergo the necessary medical tests; medical tests are healthcare services in the meaning of Article 9;
• check the employee's heath condition before admitting him/her to work, in particular to have his/her body temperature measured;
• implement additional sanitary or occupational health and safety requirements in the workplace;
• post the employee to a COVID-19 affected area only in necessary cases and with the employee's consent.

The proposed changes will give employers the right to process personal data regarding e.g. the employee’s health directly based on the special act. The employer will also be allowed to interfere to a certain extent with the employee's private life when it comes to staying in areas where he/she is exposed to the risk of coronavirus infection even if the employee is on holiday. The expression “the employer has the right to demand” used in the bill suggests that if the employee refuses to fulfil the demand (to provide the requested information), this may result in negative consequences for him/her, e.g. the employee may be refused admission to work. According to the bill, the above-mentioned rights may not be exercised in respect of persons hired under civil-law contracts.

Communication of the President of PDPO

In the current dynamic situation, the President of the Personal Data Protection Office has issued only one communication regarding the protection of personal data in the context of combating the epidemic. The communication refers directly to Article 17 of the special act saying that the Chief Sanitary Inspector (in Polish: GIS) or provincial sanitary inspectors acting on his behalf may issue, among other things, decisions imposing on employers the obligation to take specific preventive or control steps and instructing employers to be up-to-date with the communications from the State Sanitary Inspectorate. The communication indicated the Chief Sanitary Inspector as the body in charge of all issues related to combating and preventing the epidemic.

 
However, the communication of the President of PDPO does not clarify the doubts and concerns that employers have as to whether they are directly entitled to e.g. check the employee’s health condition or receive a statement in which the employee reasonably suspected of being sick confirms (or denies) staying in coronavirus affected areas.

 
One of those concerns refers to the wording of Articles 207 and 211 of the Labour Code under which the employer is responsible for health and safety in the workplace and is required to protect the health and life of employees by ensuring safe and hygienic working conditions based on the appropriate use of scientific and technical achievements (Article 207 of the Labour Code), while the employee is required to cooperate with the employer and superiors (Article 211 of the Labour Code).

Statement by the EDPB

Also the European Data Protection Board (EDPB) issued its declaration on 16 March 2020. According to the EDPB: “the GDPR provides for the legal grounds to enable the employers and the competent public health authorities to process personal data in the context of epidemics, without the need to obtain the consent of the data subject. This applies for instance when the processing of personal data is necessary for the employers for reasons of public interest in the area of public health or to protect vital interests (Art. 6 and 9 of the GDPR) or to comply with another legal obligation.”

 
Of course, it is not certain if the Polish Sejm will eventually approve and implement the proposed changes. Nevertheless, in the current legal situation and considering the PDPO’s inaction in this respect, the efforts to regulate the processing of personal data should be seen as correct. Every regulation limiting the right to privacy carries a risk, but the Senate’s proposal does not seem to go too far and undoubtedly responds to an increasing number of employers’ concerns.