Up Again Qatar: Privacy and Data

Intellectual Property and Technology

1. Can an employer carry out temperature monitoring and other health checks on employees and visitors prior to them entering work premises?

Temperature checks are mandated and any employees or visitors showing possible symptoms must be refused entry to the workplace. Any suspected cases of COVID-19 must be reported to the relevant health authority immediately. This is a general reporting obligation on any adults who come into contact with a suspected case of COVID-19, not only for employers.

Employers should keep in mind that Qatar’s Data Protection Law will also apply to personal data when this data is processed electronically, or obtained, collected or extracted in any other way in preparation for the electronic processing thereof, or that is processed by combining electronic processing and traditional processing.

Particular caution should therefore be applied to how employers handle Special Personal Data under that Data Protection Law, which includes health information about an individual.

2. Can an employer ask employees and visitors to complete a questionnaire on whether they are experiencing typical COVID-19 symptoms, have been in contact with an infected individual, or recently travelled to high risk countries?

Employers can ask their employees and visitors to complete a questionnaire, but there is no obligation on employees or visitors to respond.

3. Can an employer require their employees to notify them if they or a member of their household has contracted COVID-19, or that they have the antigen?

Currently, it is not possible for employers to require this.

4. Can an employer tell their employees that a colleague may have potentially contracted COVID-19?

It is only permitted for an employer to tell their employees that a colleague has potentially contracted COVID-19 if that individual gives their consent. Employers may wish to inform their employees without identifying the relevant individual, and indeed may be required to under their duty to ensure the health and safety of their employees, under the Qatar Labour Law.

5. Can an employer share information with a health authority about COVID-19 cases they become aware of?

An employer can share information with the Ministry of Public Health as this may be for a lawful purpose, but we still recommend only doing so with the express consent of the individual, or otherwise at the express request of the Ministry.

6. Can an employer send employees’ health data to one of their affiliates outside the EEA or otherwise in another jurisdiction?

An employer can only send employees’ health data to one of their affiliates outside Qatar with the consent of the individual unless this transfer of data is deemed necessary for realising a lawful purpose for the data controller or for the third party to who the personal data is sent. The data controller must observe, when disclosing and transferring personal data to the data processor, that the transfer is for a lawful purpose and that the transfer of data is made pursuant to the provisions of the Data Protection Law.

7. Can an employer monitor how employees move around the workplace to help keep social distancing rules?

Consent of the individual is recommended, although there is a fair argument that this could be considered a necessary measure to comply with the guidance issued by the Ministry of Health and Human Resources, which requires businesses to take necessary measures to limit the spread of epidemics in private sector organisations.

8. Does an employer need to comply with any other GDPR principles or local privacy laws, when collecting data for the purpose of tackling COVID-19?

Yes. Please see question 1 above.

9. What are the risks if I am in breach of the GDPR or local privacy laws?

There is an obligation on the data controller to notify the regulator, the Ministry of Transport and Communication, and the data subject of any breaches of the measures to protect the data subject’s privacy if it is likely to cause damage to the data subject.

The Ministry of Transport and Communication is responsible for the enforcement of the Data Protection Law. Any data subject may submit a complaint to the Ministry of Transport and Communication in the case of a violation of the Data Protection Law. The Ministry of Transport and Communication will investigate the complaint and, if found to be valid, the Ministry of Transport and Communication can oblige the data controller or processor to rectify the violation within a specified time period.

The Ministry of Transport and Communication can also impose fines of up to QAR5 million (USD1.4 million) for violations of the Data Protection Law.