The COVID-19 virus epidemic has caused the need for many businesses to organize and adapt their work during the state of emergency, in accordance with the measures introduced to protect the population from the spread of viruses, which, due to the circumstances, restrict many citizen rights. However, it should be emphasized that the restrictions imposed on certain human rights, such as freedom of movement and freedom of assembly, do not include restrictions on the right to the protection of personal data.
The legally valid collection and processing of personal data creates particular problems in the field of employment relations, for the purpose of protection of the employees, because since the adoption of the Personal Data Protection Regulation 2016/679 (GDPR), upon which the Law on Personal Data Protection of the Republic of Serbia (LPDP) relies, there was no opportunity to build a practice in the application of the provisions of these regulations in a state of emergency by the competent state bodies, as well as the case law. It is a legitimate desire for employers to protect themselves and their employees from the epidemic of the virus by exercising some kind of moderate and appropriate control of employees’ health status during the epidemic.
The purpose of processing this kind of data would be, on the one hand, to respect the legal obligations prescribed both before and during the pandemic. On the other hand, data would be processed for the purpose of protecting the safety and health at work of employees. The introduction of a state of emergency is the basis for the implementation of solutions different than the usual, however, any action regarding the collection and processing of personal data, in addition to a valid legal basis, must be carried out in accordance with the provisions of the current Law on Personal Data Protection.
Pursuant to Article 17 of the LPDP, data concerning health of the data subject belong to a special category of personal data, which is in principle prohibited with exception of certain situations. Notwithstanding the prohibition in principle, the valid LPDP, separately and in combination with other relevant regulations, such as e.g. The Labor Law (LL) and the Law on Occupational Safety and Health (LOSH), as well as the regulations adopted during the state of emergency, provide a valid legal basis for collecting and processing this type of data.
In support of this opinion is the statement of the Commissioner for Information of Public Importance and Personal Data Protection, dated April 1, 2020. The Commissioner also referred to the rights and obligations of employers regarding the processing of personal data of employees in this situation:
“When it comes to the ability of the employer to process data relating to symptoms of potential coronavirus infection in employees, job applicants and other persons entering the employer’s premises, the Commissioner emphasizes that processing can be done in accordance with the acts of the competent authorities which are related to the fight against the current pandemic, while respecting the processing principles of Article 5 of the Law on Personal Data Protection. Data Controllers and Processors who organize work at home in a state of emergency, if such work involves the processing of personal data, in accordance with the principle of integrity and confidentiality, are obliged to provide appropriate measures of personal data protection, which include measures such as checking communication and correspondence security through official emails, etc.”
Finally, it should be noted that the processing of special categories of personal data may entail other obligations for the Data Controllers, provided by the applicable LPDP, such as the obligation to keep records of processing operations, appointing of a Data Protection Officer, conducting an impact assessments on the protection of personal data, etc. The recommendation is that, if employers do decide to process this type of data, they do so with the smallest possible amount of processing which is sufficient to fulfill the purpose of the processing, and fully in accordance with all the rules and principles of processing prescribed by LPDP.
Should you need additional information about any aspect of personal data protection, you can contact our associate Igor Petronijevic, or any of your standard contacts at Zivkovic Samardzic Law Office.
Obrada ličnih podataka o zdravstvenom stanju zaposlenih u vreme vanrednog stanja
Epidemija virusa COVID-19 izazvala je potrebu mnogih privrednih subjekata da rad tokom trajanja vanrednog stanja organizuju i prilagode postojećim zakonskim propisima, a u skladu sa uvedenim merama radi zaštite stanovništva od širenja virusa kojima su, usled nastalih okolnosti, ograničena mnoga prava građana. Ipak, treba naglasiti da uvedena ograničenja koja se odnose na određena ljudska prava, kakva su sloboda kretanja i sloboda okupljanja, ne obuhvataju ograničenja prava na zaštitu podataka o ličnosti.
Posebne probleme stvara zakonito prikupljanje i obrada ličnih podataka u oblasti radnih odnosa, a radi zaštite zaposlenih, jer od donošenja Uredbe o zaštiti ličnih podataka 2016/679 (GDPR), a na koju se oslanja i Zakon o zaštiti podataka o ličnosti Republike Srbije (ZZPL), nije bilo prilike da se izgradi praksa u primeni odredaba ovih propisa u vanrednom stanju od strane nadležnih državnih organa, kao ni sudksa praksa. Legitimna je želja poslodavaca da zaštite sebe i svoje zaposlene od epidemije virusa, tako što će vršiti neki vid umerene i primerene kontrole zdravstvenog stanja zaposlenih, za vreme trajanja epidemije.
Svrha obrade ovakve vrste podataka bila bi sa, jedne strane, poštovanje zakonskih obaveza propisanih kako pre, tako i u toku pandemije. Sa druge strane podaci bi se obrađivali u svrhu zaštite bezbednosti i zdravlja na radu zaposlenih. Uvođenje vanrednog stanja podloga je za primenu drugačijih rešenja u odnosu na uobičajena, međutim svako postupanje u pogledu prikupljanja i obrade ličnih podataka, pored valjanog pravnog osnova, mora biti sprovođeno u skaldu sa odredbama važećeg Zakona o zaštiti podataka o ličnosti.
U skladu sa članom 17 ZZPL, podaci o zdravstvenom stanju lica na koje se podaci odnose spadaju u posebnu vrstu ličnih podataka, koja je načelno zabranjena izuzev u posebnim situacijama. I pored načelne zabrane, važeći ZZPL, zasebno i u kombinacijama sa drugim relevantnim propisima, kakvi su npr. Zakon o radu (ZOR) i Zakon o bezbednosti i zdravlju na radu (ZBZR), ali i propisima donetim u vreme vanrednog stanja, pruža valjan pravni osnov za prikupljanje i obradu ove vrste podataka.
U prilog iznetom mišljenju govori i saopštenje Poverenika za informacije od javnog značaja i zaštitu podataka o ličnosti, od 1. Aprila 2020. godine. Takođe, Poverenik se osvrnuo i na prava i obaveze poslodavaca po pitanju obrade ličnih podataka zaposlenih u ovoj situaciji:
„Kada se radi o mogućnosti poslodavca da vrši obradu podataka koji se odnose na simptome potencijalne infekcije koronavirusom kod zaposlenih, kandidata za zaposlenje i drugih lica koja ulaze u poslovne prostorije poslodavca, Poverenik naglašava da je obradu moguće vršiti u skladu sa aktima nadležnih organa koji se odnose na borbu protiv aktuelne pandemije, uz pridržavanje načela obrade iz člana 5. Zakona o zaštiti podataka o ličnosti.
Rukovaoci i obrađivači koji u uslovima vanrednog stanja organizuju rad zaposlenih od kuće, ukoliko taj rad obuhvata i obradu podataka o ličnosti, u skladu sa načelom integriteta i poverljivosti, obavezni su da obezbede odgovarajuće mere zaštite podataka o ličnosti, što podrazumeva mere kao što su provera bezbednosti veze i korespodencije putem službenih mejlova i dr.“
Na kraju, treba napomenuti da obrada posebnih vrsta podataka o ličnosti sa sobom može povući i druge obaveze za Rukovaoce, predviđene važećim ZZPL, kakve su obaveze vođenja evidencija radnji obrade, imenovanje Lica za zaštitu podataka o ličnosti, procene uticaja na zaštitu podataka o ličnosti i druge. Preporuka je svakako da, ukoliko se poslodavci odluče na obradu ovakve vrste podataka, to čine u najmanjoj mogućoj meri koja je dovoljna da se ispuni svrha obrade, u potpunosti u skaldu sa svim pravilima i načelima obrade koje propisuje ZZPL.
Ukoliko su Vam potrebne dodatne informacije o bilo kom aspektu zaštite ličnih podataka, možete se obratiti našem saradniku Igoru Petronijeviću, ili Vašem standardnom kontatku u advokatskoj kancelariji Živković Samardžić.