We are facing a virus that deeply affects our lives and catches us all off guard; COVID-19. The epidemic caused by this virus has affected the whole world and our country, and it has brought some legal problems as well as the loss of life in a sad way.
The issue that we will discuss in this article emerges at the point of protecting privacy within the scope of the Law on the Protection of Personal Data for employers. As a matter of fact, the Law on the Protection of Personal Data[Kanun] One of its purposes is to protect the fundamental rights and freedoms of individuals, especially the privacy of private life, in the processing of personal data.
In this direction, the data protection authorities of many countries under the influence of the epidemic have started to publish advisory texts. Personal Data Protection Board in our country[Kurul] On March 27, 2020, a public announcement was made on what should be known about the processing of personal data within the scope of combating the COVID-19 virus. [one]
In the Public Announcement it has published, the Board mentions that personal data should be processed in accordance with the law and on the basis of basic principles, also in the event of an exceptional pandemic, and points out once again the importance of taking the necessary administrative and technical measures for data security. In this context, personal data processing activities carried out within the scope of the measures taken against the Covid-19 virus should be processed according to general principles, that is, they should be necessary, related to the purpose, limited and measured. In addition, the Board’s Decision dated 31/01/2018 and numbered 2018/10 “Adequate Precautions to be Taken by Data Controllers in the Processing of Special Quality Personal Data” should also be taken into consideration. [2]
As stated by the Board, it is inevitable to process personal data (TR Identity Number, address, workplace, travel information) and sensitive personal data, which are categorically considered more sensitive than others, in the event of the extraordinary pandemic we are in. Personal data can only be processed in cases stipulated by law or with the explicit consent of the person. It is not possible to process personal data in the absence of a legal regulation or in the absence of a clear declaration of intent to process personal data belonging to the individual. Accordingly, obtaining explicit consent for the processing of both personal data and sensitive personal data is considered among the personal data processing conditions in the Law.
In Article 6 of the Law, it is stipulated that the processing of sensitive personal data without the explicit consent of the person concerned is prohibited, and an exception is made in the next paragraph. In this context, personal data related to health, which is one of the special categories of personal data, can be collected by the persons who are under the obligation of confidentiality or the authorized institution and organization for the purpose of protection of public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing. It is stipulated that it can be processed without seeking explicit consent.
Considering the regulations in the Public Announcement, especially within the scope of the questions from the client companies, we have prepared a set of questions and answers regarding the application in terms of employee-employer relationship.
- Can an employer take the temperature of all staff and visitors or request information about virus symptoms?
As it is known, employers are obliged to take all necessary measures to ensure occupational health and safety in their workplaces, to keep tools and equipment in full, and workers are obliged to comply with all measures taken regarding occupational health and safety. As we have mentioned above, special categories of personal data can be processed with the express consent of the person concerned. In this regard, it is possible to obtain the explicit consent of the personnel, as well as from the visitors. However, we would like to remind you that consent should not be put forward as a prerequisite for the visitor to enter the facility, since the consent should be given with free will and should not be conditional.
However, in the case of Covid-19, since there is an epidemic, these data may be processed without consent for public health purposes by healthcare professionals who are obliged to keep secrets within the scope of the exception. Therefore, the employer can measure the temperature and request information without the need for the consent of the occupational physician.
The first question that comes to mind here is; Can the employer process personal data without express consent within the scope of the exception? Or, can the workplace physician share the health data he has received with a different department? As an exception, in Article 6 of the Law, it is stipulated that sensitive personal data can be processed by persons or authorized institutions and organizations under the obligation to keep secrets without express consent. For this reason, the occupational physician, who is under the obligation of confidentiality, may request that the relevant person visit a higher-level health institution after receiving the said health data, and the details that will directly determine who the relevant person is should not be shared.
- Can the employer report the number of employees showing symptoms to other departments?
Considering the answer we have given above, the occupational physician should prevent the sharing of the patient’s or symptomatic personnel’s information, but they can determine the risk situation by asking different questions in order to identify the personnel with whom this person is in contact. Since the workplace physician also has the obligation to protect the health of other employees, if it is obligatory to indicate the name of the sick or symptomatic personnel, this issue can be resolved within the scope of the principle of proportionality.
- Can the employer request information about the countries that the visitors or their staff have traveled to before?
Special categories of personal data are data that, if learned by others, may cause the person concerned to be victimized, be exposed to discrimination or damage their honor and dignity. In this context, travel information is not within the scope of special categories of personal data. However, personal data is generally evaluated according to the processing purposes. Since the purpose of collecting travel information is to learn about the possibility of transmission of the disease, health data is obtained indirectly from the data controller. However, the Board did not include it within the scope of sensitive personal data, which is considered more sensitive in the Public Announcement. 5 of the Act. There is no objection to obtaining travel information, taking into account the personal data processing conditions.
In any case, it should not be forgotten that even in this exceptional time, data controllers and data processors must ensure the security of the personal data of the persons concerned. In fact, in this extraordinary situation we are in, the fundamental right that is tried to be protected is the right to life, which is the highest right, and although there are some theoretical regulations in terms of the protection of personal data, as we mentioned in our previous article, since every extraordinary situation creates its own law, the theoretical information is not useful in practice. It will be seen in time how applicable it is.
[2] https://kvkk.gov.tr/Icerik/4110/2018-10
Seda Mengeş
Lawyer / K&P Legal Law Firm
