Privacy & Information Security Law Blog

On June 5, 2020, the Belgian Data Protection Authority (the “Belgian DPA”) published guidance on its website (the “Guidance”) regarding temperature checks during the COVID-19 crisis. The Guidance aims to provide advice to organizations looking to control access to their premises by restricting individuals with fevers in order to prevent further spread of the virus.

Overall, the Guidance provides that organizations cannot currently conduct temperature checks to the extent they record the results of those checks, or the organization’s response to such checks, in files, nor may organizations conduct temperature checks using sophisticated means, such as thermal cameras, digital temperature scanners or other automated measuring means. However, the simple reading of individuals’ temperatures without recording any data does not constitute a processing activity under the EU General Data Protection Regulation (“GDPR”) and is therefore allowed from a data protection standpoint.

The key takeaways from the Guidance are:

• Simply reading an individual’s temperature with a basic (manual) thermometer does not constitute processing of personal data under the GDPR, provided that temperature data and the response to temperature checks (such as whether an individual’s access to the premises was denied) are not recorded.
• If organizations record the response to temperature checks (e.g., an employer sends employees home following temperature checks and records the reasons for sending those employees home for labor law purposes), this constitutes a processing activity to which the requirements of the GDPR apply and for which a valid legal ground is required. If the processing activity is not covered by a law, and consent cannot be relied on due to an imbalance of power (e.g., in an employer-employee relationship), then it will be considered unlawful.
• According to the Belgian DPA, temperature checks using sophisticated means, such as thermal cameras, digital temperature scanners or other automated measuring means that allow the reading of an individual’s temperature at a distance, constitute processing activities involving health data under the GDPR and are not allowed.
• To the extent temperature checks involve the processing of health data, one of the legal grounds provided for under Article 9 of the GDPR must be satisfied. According to the Belgian DPA, health data may only be processed for COVID-19 monitoring purposes where: (1) the data subject has given her explicit consent to the processing; (2) it is necessary for the purposes of carrying out the obligations and exercising specific rights in the field of employment, social security and social protection law and to the extent it is authorized by Union or Member State law or a collective agreement providing appropriate safeguards for the fundamental rights and the interests of the data subject; (3) it is necessary for reasons of substantial public interest on the basis of Union or Member State law; or (4) where it is necessary for reasons of the public interest in the area of public health on the basis of Union or Member State law, which must provide suitable and specific safeguards of individuals’ rights and freedoms, in particular professional secrecy. The Belgian DPA considers consent not to be an appropriate legal basis to legitimize temperature checks as (1) consent must be freely given; (2) individuals must have the right not to give their consent for the processing of their personal data and to object to temperature checks; and (3) in the field of employment, employees may feel pressured to consent due to the imbalanced nature of the relationship with their employers. According to the Belgian DPA, even where consent is considered valid, it cannot be used to legitimize excessive processing of personal data. This would be the case, for example, where processing is not absolutely necessary to achieve the purpose. The Guidance further clarifies that there is currently no specific legal basis under Belgian law that would allow organizations like employers or schools to conduct systematic temperature checks involving the processing of health data. While employers have an obligation to ensure health and safety at the workplace, according to the Belgian DPA, this obligation is not specific enough to legitimize the processing of health data for COVID-19 monitoring purposes. The Belgian DPA therefore calls upon the Belgian legislator to fill this legislative gap to the extent necessary in the current context.
• The Belgian DPA finally stresses that temperature checks are only partly effective in detecting COVID-19, as not all infected patients have a fever, and a fever could be a symptom of a different illness.

Read the Belgian DPA’s Guidance (in French).