Up Again Portugal: Privacy and Data

Intellectual Property and Technology

1. Can an employer carry out temperature monitoring and other health checks on employees and visitors prior to them entering work premises?

For employees, yes. Under article 13-C of Decree-Law no. 10-A/2020 (amended by Decree-Law no. 20/2020, 1 May), in the context of COVID-19, temperature tests can be performed on employees for the purpose of access and permanence at the workplace, exclusively for protecting their health and the health of third parties. No records can be kept, unless prior consent is given by the data subject.

For visitors, the Portuguese Authority for Data Protection (CNPD) has not issued any guidelines. Depending on the circumstances, we believe this processing is admissible whenever visitors provide consent. If temperature measurements are higher than normal body temperature, the employee or visitor may be prevented from accessing the workplace. Please note that the General Directorate of Health (DGS) indicates as a symptom a temperature equal to or higher than 38º.

2. Can an employer ask employees and visitors to complete a questionnaire on whether they are experiencing typical COVID-19 symptoms, have been in contact with an infected individual, or recently travelled to high risk countries?

For employees, yes, but questions must be limited to these aspects. We recommend that, if possible, the answers are accessed by the occupational health services.

Under the DGS Guidelines no. 006/2020 all employees must report to their directors a health disease involving symptoms and epidemiologic link compatible with COVID-19.

Please note that compliance with the Guidelines no. 006/2020, which determine all the steps that must be taken by the employer regarding suspected cases in the company, is extremely important.

For visitors, the Portuguese Authority for Data Protection (CNPD) has not issued any guidelines. Depending on the specific circumstances, we believe this processing is admissible if visitors consent.

3. Can an employer require their employees to notify them if they or a member of their household has contracted COVID-19, or that they have the antigen?

The employer may request employees to report if they have symptoms (or are infected with COVID-19) or had contact with an infected individual in the past 14 days. Requiring specific information on the identification of the member of their household who has contracted COVID-19 may be considered excessive.

Please note that under the DGS Guidelines no. 006/2020, all employees must report to their directors a health disease involving symptoms and epidemiologic link compatible with COVID-19.

4. Can an employer tell their employees that a colleague may have potentially contracted COVID-19?

Yes. Under the DGS Guidelines no. 006/2020, if there is a validated or suspected COVID-19 case in the company, the employer shall inform the remaining employees that there is a potential case waiting for test results. If the test results are positive, the sharing of information may be needed to identify the employee’s close contacts. We recommend these procedures are conducted by the occupational health services.

5. Can an employer share information with a health authority about COVID-19 cases they become aware of?

Pursuant to Guidelines no. 006/2020, if there’s a suspected COVID-19 case at the company premises, a specific procedure must be followed. Once in the isolation room, the employee shall directly call SNS 24 and provide the relevant information (including temperature). The employer must cooperate with the health authorities to detect the employee’s close contacts and, if it is requested by the health authorities or if the employee did not provide this information, the employer may provide it.

If the employer is aware of employees with COVID-19 who are not in the company premises at a such moment or prevents an employee from entering the premises due to their temperature, it should contact the competent health authorities in order to cooperate to detect employee’s close contacts, but the employee must directly contact the SNS 24 and provide the relevant information in relation to their situation. Please note that, unless the employee provides prior content, the employer must not keep temperature records.

6. Can an employer send employees’ health data to one of their affiliates outside the EEA or otherwise in another jurisdiction?

As general rule, no.

Health data can only be accessed by health professionals bound by professional secrecy. The possibility of being the employer (and not the occupational health services) directly conducting the temperature monitoring is exceptional and only for preventive purposes (including the protection of the employee and third parties). As such, being exceptional, we do not see a legitimate ground for the collected data to be communicated to any third parties other than the health authorities, as mentioned in the answer immediately above.

7. Can an employer monitor how employees move around the workplace to help keep social distancing rules?

Employers must ensure that the rules (including regarding social distance) are complied with by employees, so it is advisable to monitor compliance reasonably. However, the means of monitoring used must be reasonable and proportionate. Depending on the means of monitoring, specific restrictions may apply.

8. Does an employer need to comply with any other GDPR principles or local privacy laws, when collecting data for the purpose of tackling COVID-19?

Yes. GDPR and local data protection law principles must always be complied with.

9. What are the risks if I am in breach of the GDPR or local privacy laws?

Breach of GDPR and/or data protection laws principles may lead to civil, administrative and criminal liability depending on the type of conduct. In terms of administrative liability, the fine is up to EUR20 million, or in the case of an undertaking, up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher.