Agencia Española de Protección de Datos [Spanish Data Protection Authority]

The Spanish Data Protection Authority, in the context of the emergency of public health derived from the area of the coronavirus (COVID-19), responds to the frequently asked questions made by companies and hard-working part of with regard to the fulfillment of the regulations of data protection on the personal data processing regarding the health. 

They emphasise following aspects: 

1. In this exceptional situation, employers will be able to discuss the information of workers in the event of being infected by the coronavirus, in accordance with the health regulations, work and especially of risk prevention at work, to guarantee its health and to adopt necessary actions by statutory authorities, ensuring the right to the protection of the health of the rest of the staff and to avoid contagions within work centres.
   
   
2. The information will be able to obtain through questions to the staff, being limited exclusively to investigate on the existence of symptoms or if the hard-working person has been diagnosed as a person infected or subject to quarantine. It would be converse to the regulations with regard to data protection, circular health questionnaires extensive or that they include questions not related to the illness.
   
   
3. The information will not be able to give identifying to the concerned individual to the rest of the company without its consent, although, would be able to broadcast at the request of statutory authorities or if it was necessary to reach the aim of protection of the health of the rest of the staff.
   
   
4. It is possible to request information to the employees and external visitors on symptoms or risk factors without the need for to request its explicit consent. Questions should be limited to the temporary incubation frame of the illness.
   
   
5. They are not owed to hinder or to limit measures that they adopt statutory authorities in the fight against the pandemic. The current regulations with regard to data protection already has the permission to adopt necessary actions to safeguard the individuals' vital interest, the essential public interest in the field of the health, the performance of medical diagnoses or the fulfillment of legal obligations in the workplace. However is owed to continue observing principles of minimisation, of limitation of the aim and of terms of conservation.
   
   
6. Workers that, after credit had contact with a case of coronavirus, could be affected by this illness and that, for application of protocols established by the Health Authorities competent, are seen subjected to the corresponding isolation preventive to avoid risks of contagion derived from this situation until so much the corresponding diagnosis is had, they should inform to its employer and at the service of prevention or, where applicable, to the delegates of prevention (Act of Risk Prevention at Work).

We will update the present information with regard to Data protection as Statutory authorities carry out new considerations or specific regulations is published in this regard.