Service

Requesting information on the health of employees - position of the Personal Data Protection Office

The employee's personal data is protected and may only be processed in specific cases. Employers often do not realize that the employee data they provide to other entities is transferred against the law. Due to the coronavirus pandemic, contractors and contracting authorities, in order to justify problems related to the necessity to postpone the contract completion date, use the situations of the contractor's employees being in quarantine or isolation and the inability to ensure the continuity of the contract. Can the request for information on the health status of employees be justified? Answer below.

Employees' personal data - the Labor Code

Pursuant to Art. 221 § 1 of the Labor Code, the employer requires the applicant to provide personal data including:

first name (names) and surname;
date of birth;
contact details indicated by such a person;
education;
professional qualifications;
the course of previous employment.

Additionally, the employer may require the employee to provide personal data including:

address;
PESEL number, and in its absence - the type and number of the document confirming identity;
other personal data of the employee, as well as personal data of the employee's children and other members of his immediate family, if providing such data is necessary due to the employee's use of special rights provided for in labor law;
education and course of previous employment, if there was no basis for their request from the person applying for employment;
payment account number, if the employee has not submitted an application for payment of remuneration personally.

As a rule, employee health data is not processed by the employer. According to Art. 9 sec. 1 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46 / EC (general regulation on data protection) [hereinafter: GDPR] processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership and the processing of genetic data, biometric data in order to uniquely identify a natural person or data concerning health, sexuality or sexual orientation of that person.

Therefore, the employee's health data is not processed.

The restriction indicated above does not apply if one of the following conditions is met:

the data subject has expressly consented to the processing of such personal data for one or more specific purposes, unless Union or Member State law provide that the data subject may not avoid the above prohibition;
processing is necessary for the performance of obligations and the exercise of specific rights by the controller or the data subject in the field of labor law, social security and social protection, insofar as this is permitted by Union or Member State law or by collective agreement under the law of a Member State providing for adequate safeguards for the fundamental rights and interests of the data subject;
processing is necessary to protect the vital interests of the data subject or another natural person, and the data subject is physically or legally incapable of giving consent;
processing is carried out as part of authorized activities carried out with appropriate safeguards by a foundation, association or other non-profit entity with political, ideological, religious or trade union purposes, provided that the processing applies only to members or former members of this entity or persons maintaining permanent contact with it in in connection with its purposes and that personal data are not disclosed outside this entity without the consent of the data subjects;
processing relates to personal data which are manifestly made public by the data subject;
processing is necessary for the establishment, exercise or defense of legal claims or in the course of the administration of justice by courts;
processing is necessary for reasons of important public interest, on the basis of Union or Member State law, which are proportionate to the aim pursued, do not infringe the essence of the right to data protection and provide for appropriate and specific measures to protect the fundamental rights and interests of the data subject ;
processing is necessary for the purposes of preventive healthcare or occupational medicine, for the assessment of the employee's ability to work, medical diagnosis, the provision of health care or social security, treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to an agreement with a healthcare professional and subject to the conditions and safeguards referred to in Art. 9 sec. 3 (an employee subject to the obligation of professional secrecy);
processing is necessary for reasons of public interest in the field of public health, such as protection against serious cross-border threats to health or to ensure high standards of quality and safety for healthcare and medicinal products or medical devices, on the basis of Union or Member State law, which provide for appropriate , specific measures to protect the rights and freedoms of data subjects, in particular professional secrecy;
processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or for statistical purposes pursuant to Art. 89 sec. 1 of the GDPR, on the basis of EU law or the law of the Member State, which are proportionate to the aim pursued, do not infringe the essence of the right to data protection and provide for appropriate, specific measures to protect the fundamental rights and interests of the data subject.

However, according to Art. 221b paragraph. 1 of the Labor Code, the consent of the person applying for employment or the employee may constitute the basis for the processing by the employer of personal data referred to in art. 9 sec. 1 GDPR, only if the transfer of this personal data takes place at the initiative of the job applicant or employee.

Possibility of transferring data on the employee's health by the contractor to the contracting authority

Pursuant to Art. 15r of the Act of March 2, 2020 on special solutions related to the prevention, counteracting and combating COVID-19, other infectious diseases and emerging crisis situations, parties to a public procurement contract, within the meaning of the Act of September 11, 2019 - Public Procurement Law , immediately inform each other about the impact of the circumstances related to the occurrence of COVID-19 on the proper performance of this contract, if such an impact has occurred or may occur. The parties to the contract confirm this influence by attaching to the information referred to in the first sentence, statements or documents that may relate in particular to:

absence of employees or persons performing remunerated work on a basis other than employment relationship who or could participate in the performance of the contract;
decisions issued by the Chief Sanitary Inspector or the provincial sanitary inspector acting under his authority, in connection with counteracting COVID-19, obliging the contractor to take specific preventive or control measures;
orders or decisions issued by voivodes, the minister responsible for health or the Prime Minister, related to counteracting COVID-19, referred to in art. 11 sec. 1-3;
suspension of deliveries of products, product components or materials, difficulties in accessing equipment or difficulties in providing transportation services;
other circumstances that prevent or significantly limit the performance of the contract;
the circumstances referred to in points 1-5, to the extent that they relate to the subcontractor or further subcontractor.

However, the President of the Personal Data Protection Office had doubts as to whether the above provision authorizes the contractor as an employer to process sensitive data, such as information on the employee's health.

Start a free 30-day trial period with no strings attached!

As indicated by the President of the Personal Data Protection Office in a letter of February 8, 2021 to the Director General of the Office of the Ombudsman for Small and Medium Enterprises, in accordance with recital 35 of the GDPR, personal data relating to health should include all data on the health status of the data subject, revealing information about the past, present or future physical or mental health of that person. These data are subject to a special processing regime and, taking into account the provisions of the EU data protection regulation, should be subject to greater protection.

In connection with the above, the President of the Office for Personal Data Protection is of the opinion that the provision of Art. 15r of the Act of March 2, 2020 on special solutions related to the prevention, counteracting and combating COVID-19, other infectious diseases and the emergencies caused by them, cannot constitute the basis and entitlement to process the employee's data in the field of his health without his consent.

The above also results directly from Art. 221b paragraph. 1 of the Labor Code, where the employee's consent is the condition for processing the employee's data. As indicated by the District Court in Giżycko in its judgment of September 10, 2019 (IV P 49/19): According to the new wording of Art. 221b of the Labor Code, the employee's consent may constitute the basis for processing the so-called data of a specific category only if the transfer is made on the initiative of the employee. Consequently, the legislator excludes the use of consent in a situation where the employee is not the initiator of the information transfer.

In view of the above, it should be considered that the regulation referred to in Art.15r of the Act of March 2, 2020 on special solutions related to the prevention, counteracting and combating COVID-19, other infectious diseases and emerging crisis situations, is contrary to the provisions of labor law, and the employer as a contractor is not entitled to provide data on health an employee of the contracting authority.

Awarding entities cannot make the recognition of the impact of COVID-19 on the proper performance of a public procurement conditional on providing them with full information on the health condition of employees and subcontractors' employees, along with non-anonymised documentation (decisions, orders) confirming that the persons concerned are on sick leave or in quarantine, and contractors cannot provide such data on their own, in order to justify the impact of the coronavirus pandemic on the performance of the contract.