Up Again Angola: Privacy and Data

Intellectual Property and Technology

1. Can an employer carry out temperature monitoring and other health checks on employees and visitors prior to them entering work premises?

Yes, as long as certain requirements are met. In fact, according to article 10 of the Presidential Decree no. 142/20 of 25 May, temperature monitoring at the entrance of the establishments is recommended, and the responsible entities shall, in the event of identification of suspected cases, prevent entry and immediately inform the local health authorities.

With respect to the legal requirements for carrying out such processing activities, under article 14(1)(a)(b) of Angolan Data Protection Law (Law no. 22/11, 17 June), the processing of personal data relating to health can only be carried out with:

  • the consent of the data subject or their legal representative; and
  • authorisation from Angolan Data Protection Authority (DPA).

Depending on the context, the consent from the data subject can be waived.

Temperature monitoring and other health checks can be performed on employees without their consent for the purpose of access and permission to stay at the workplace, exclusively to protect their health and the health of third parties (i.e. for the purpose of preventive medicine within the scope of the employer's obligations related to occupational health, hygiene and safety at work).

With regard to visitors, the need to obtain the consent of the data subjects could be ruled out based on processing being justified as in the public interest.

However, in the absence of any government decision or guidance in this specific regard, it is recommended that the consent of the visitor is gathered for temperature monitoring and other health checks. The consent must be unambiguous, express, and in written form.

In both cases, prior authorisation from the DPA is always required.

The processing of health data must be carried out by a health professional registered with the corresponding professional body/association, who is obliged to comply with the duty of professional secrecy.

2. Can an employer ask employees and visitors to complete a questionnaire on whether they are experiencing typical COVID-19 symptoms, have been in contact with an infected individual, or recently travelled to high risk countries?

Yes, as long as the requirements related to health data mentioned in the answer to question 1 above are met. Questions about health must be limited to these aspects. We also recommend that, if possible, the answers are accessed by the occupational health services.

Therefore, for employees the data must be collected without their consent for the purpose of access and permission to stay at the workplace, exclusively to protect their health and the health of third parties (i.e. for the purpose of preventive medicine within the scope of the employer's obligations related to occupational health, hygiene and safety at work).

With regard to visitors, the need to obtain the consent of the data subjects could be ruled out based on the processing being justified as in the public interest.

However, in the absence of any government decision or guidance in this specific regard, it is recommended that the consent of the visitor is gathered for the completion of the questionnaire. Please note that the consent must be unambiguous, express, and in written form.

In both cases, prior authorisation from the DPA is always required.

3. Can an employer require their employees to notify them if they or a member of their household has contracted COVID-19, or that they have the antigen?

Yes, the employer may ask employees to report if they have symptoms (or are infected with COVID-19) or had contact with an infected individual in the past 14 days.

Please note that under the Annex of the Presidential Decree no. 142/20 of 25 May, which establishes the rules for the functioning of the institutions and the behaviour of citizens for the prevention and tackling of COVID-19, entities and also citizens have a general duty to notify the local health authorities about suspected cases of COVID-19.

4. Can an employer tell their employees that a colleague may have potentially contracted COVID-19?

Yes, the employer shall inform the remaining employees that there is a potential case waiting for test results. If the test results are positive, the sharing of information may be necessary to identify the employee’s close contacts. We recommend these procedures are conducted by the occupational health services.

5. Can an employer share information with a health authority about COVID-19 cases they become aware of?

Yes. Pursuant to article 10 of the Presidential Decree no. 142/20 of 25 May, entities shall immediately inform local health authorities about a suspected case of COVID-19.

6. Can an employer send employees’ health data to one of their affiliates outside the EEA or otherwise in another jurisdiction?

As general rule, no. Health data can be accessed only by health professionals, registered with the corresponding professional body/association, bound by professional secrecy. As such, we do not see a legitimate ground for the data to be communicated to any third parties other than the local health authorities, as mentioned in question 5 above.

7. Can an employer monitor how employees move around the workplace to help keep social distancing rules?

Employers must ensure that employees comply with the rules (including regarding social distance), so it is advisable to monitor compliance reasonably. However, the means of monitoring used must be reasonable and proportionate. Depending on the means of monitoring, specific restrictions may apply.

8. Does an employer need to comply with any other GDPR principles or local privacy laws, when collecting data for the purpose of tackling COVID-19?

Yes. Angolan Data Protection Law (Law no. 22/11, 17 June) principles must always be complied with.

9. What are the risks if I am in breach of the GDPR or local privacy laws?

Breach of Angolan Data Protection Law (Law no. 22/11, 17 June) may lead to civil, administrative and criminal liability depending on the type of conduct. In terms of administrative liability, the fine is up to USD450,000.

This material was prepared by DLA Piper Africa, Angola (ADCA)