Up Again Russia: Privacy and Data

Intellectual Property and Technology

1. Can an employer carry out temperature monitoring and other health checks on employees and visitors prior to them entering work premises?

General Russian privacy rules would require written consent of the data subject for medical information. A more specific rule in the Labour Code allows an employer to enquire about personal health information where that information is relevant to the employee’s ability to do their job.

The data regulator, Roskomnadzor, has issued a specific clarification regarding temperature checks. Under this clarification, Roskomnadzor considers temperature checks for COVID-19 to be within the rule under the Labour Code and believes that the employees’ consent is implied, as long as there is a notice at the entry of the premises that there will be temperature checks.

With regard to other visitors, Roskomnadzor believes that as long as there is a clear notice of temperature checks for entry, the visitors’ consent is implied by their seeking access to the premises. In the case of checking visitors’ temperature, the employer should not ask for identification.

The information from the temperature checks should be done on an anonymous basis and the data gathered should be destroyed within 24 hours.

These clarifications were made under the context of checking temperature and should not be construed to extend to more invasive types of testing.

Roskomnadzor also noted that local rules may affect this clarification.

The Moscow Mayor has issued a decree stating that employees should participate in medical examinations organised by their employers, but this is not specifically tied to monitoring at the entrance of the building.

The Russian Labour Code contains an exhaustive list of grounds for suspension or refusal of admission of employees to the workplace, but these grounds do not contemplate this situation. That said, the agency handling public health issues such as this, Rospotrebnadzor, has recommended that employees with a fever and signs of respiratory disease may be refused admission to their workplace.

2. Can an employer ask employees and visitors to complete a questionnaire on whether they are experiencing typical COVID-19 symptoms, have been in contact with an infected individual, or recently travelled to high risk countries?

An employer may ask an employee about information related to their health status where that affects their ability to perform job functions and, under the Roskomnadzor clarifications, measures to identify the disease are associated with determining the possibility of performing labour functions. So, from the point of view of personal data law enforcement, it appears that asking an employee to complete the questionnaire would not require additional consent. We note that Roskomnadzor is not the enforcing official for labour law, however, so their clarifications do not apply to that sphere.

As for visitors, we believe that if the visitor is given notice of the requirement, their providing the information directly themselves is likely to be considered to be implied (if not express) consent for collection of this information.

The questionnaire should clearly indicate the purpose for the collection and include a paragraph on consent in all cases, including those involving employees. Though there may be contexts in which consent may be implied, a written questionnaire provides an opportunity to obtain actual consent.

The Moscow Mayor has issued a decree stating that employees should participate in medical examinations organised by their employers, but this is not specifically tied to monitoring at the entrance of the building.

The Russian Labour Code contains an exhaustive list of grounds for suspension or refusal of admission of employees to the workplace, but these grounds do not contemplate this situation. That said, the agency handling public health issues such as this, Rospotrebnadzor, has recommended that employees with a fever and signs of respiratory disease may be refused admission to their workplace.

3. Can an employer require their employees to notify them if they or a member of their household has contracted COVID-19, or that they have the antigen?

The Labour Code personal data provisions are interpreted by Roskomnadzor to include measures to identify a disease as being connected to an employee’s ability to perform their job functions, and though this was issued in connection with temperature testing, this principle may be construed to expand to requesting this kind of information in a general sense. That said, however, to the extent this information involves personal health information of others, such as family members or people in the household, the implied consent may not apply.

Local rules, however, do provide an obligation for employees to notify their employers if they, or a member of their household has symptoms or diagnosis of respiratory diseases or pneumonia. This rule does not mention disclosure of having the antigen.

So, under personal data rules, providing information about third parties who are not employees may not be covered by implied consent, but under local Moscow rules (and perhaps those of other cities), providing such information is required.

The best approach is to obtain consent of these third parties where possible or to ask the employee to provide this information on a no-name basis. In any event, we would not expect there to be a high risk of enforcement actions taken in case of third-party information being given in this type of situation.

4. Can an employer tell their employees that a colleague may have potentially contracted COVID-19?

An employer may tell employees that a colleague may have potentially contracted COVID-19, but may not disclose that person's identity without the hardcopy written consent of that individual.

5. Can an employer share information with a health authority about COVID-19 cases they become aware of?

Yes, but disclosing an individual's health information would require hardcopy written consent from the individual.

6. Can an employer send employees’ health data to one of their affiliates outside the EEA or otherwise in another jurisdiction?

Yes, but disclosing an individual's health information would require hardcopy written consent from the individual.

7. Can an employer monitor how employees move around the workplace to help keep social distancing rules?

Yes. No consent is needed for this. Further, Rospotrebnadzor has issued a recommendation for employers to divide workflows and teams by placing employees on different floors or separate rooms and by implementing different shifts. Essentially, social distancing is encouraged.

8. Does an employer need to comply with any other GDPR principles or local privacy laws, when collecting data for the purpose of tackling COVID-19?

All personal data must be collected, used and disseminated in accordance with Russian data rules, and specific, personal health information is given a higher level of protection. Handling this information would require hardcopy written consent from the individual.

9. What are the risks if I am in breach of the GDPR or local privacy laws?

The risks are not particularly high in most regards. Penalties are most likely to be administrative fines, but in the context of the public health situation, enforcement action or aggressive penalties are unlikely.