Up Again Bahrain: Privacy and Data

Intellectual Property and Technology

1. Can an employer carry out temperature monitoring and other health checks on employees and visitors prior to them entering work premises?

Temperature checks are recommended and any employee or visitors showing possible symptoms must be refused entry to the workplace. Any suspected cases of COVID-19 must be reported to the Ministry of Health immediately. This is a general reporting obligation on any adults who come into contact with a suspected case of COVID-19, not only for employers.

2. Can an employer ask employees and visitors to complete a questionnaire on whether they are experiencing typical COVID-19 symptoms, have been in contact with an infected individual, or recently travelled to high risk countries?

Employers can ask their employees and visitors to complete a questionnaire, but there is no obligation on employees or visitors to respond.

3. Can an employer require their employees to notify them if they or a member of their household has contracted COVID-19, or that they have the antigen?

Yes.

4. Can an employer tell their employees that a colleague may have potentially contracted COVID-19?

Employers are allowed to tell their employees a colleague has potentially contracted COVID-19 only if that individual consents. Employers may wish to inform their employees without identifying the relevant individual, and indeed may be required to do so under their duty to ensure the health and safety of their employees.

5. Can an employer share information with a health authority about COVID-19 cases they become aware of?

An employer can share information with a health authority, but we recommend only doing so with the express consent of the individual.

6. Can an employer send employees’ health data to one of their affiliates outside the EEA or otherwise in another jurisdiction?

An employer can send employees’ health data to one of their affiliates outside the EEA or in another jurisdiction, but only with the consent of the individual unless the exceptions listed under Articles 4 and 5 of the Personal Data Protection Law No. 30 of 2018 (PDPL).

7. Can an employer monitor how employees move around the workplace to help keep social distancing rules?

Consent of the individual is recommended, although there is a fair argument that this could be considered a necessary measure to comply with the guidance issued by the Ministry of Health, which requires businesses to take necessary measures to limit the spread of epidemics in private sector organisations.

8. Does an employer need to comply with any other GDPR principles or local privacy laws, when collecting data for the purpose of tackling COVID-19?

As per Articles 4 and 5 of the PDPL, consent of the individual is required for the processing of personal data and sensitive personal data, unless such processing is necessary and falls within the exceptions listed under Articles 4 and 5 of the PDPL.

9. What are the risks if I am in breach of the GDPR or local privacy laws?

Violations of the PDPL may attract both civil and criminal liabilities. Criminal liabilities may include imprisonment for a period not exceeding one year and/or a fine ranging of between BHD1,000 and BHD20,000 (Article 58, PDPL). A legal person may be fined double the aforementioned amounts (Article 59, PDPL).