Data on coronavirus (Covid-19) infections and suspected cases are sensitive data that are particularly protected by data protection law. However, data protection law also provides that this health data can be used to the extent necessary to contain the spread of the virus and to protect other people. In particular, this includes the collection of data from persons who have been diagnosed or suspected of being infected as a result of contact with an infected person or as a result of their stay in a risk region.
The company will therefore be able to and must communicate, to the necessary extent, when an employee has tested positive so that other employees who have had contact with the infected employee know how to act now to prevent further spread. However, this only applies to the extent necessary. The necessary extent must be determined on a case-by-case basis.
For example, if a company has several business premises, it will be permissible, to the extent necessary, to communicate within one business premises or parts thereof who has tested positive, but not company-wide if the infected employee has not had contact with employees of other business premises or parts thereof. However, if the infected employee has visited other sites or parts of sites within the incubation period, communication will need to be extended to the sites or parts of sites visited to protect other employees who have had contact with the infected employee.
We will be happy to advise you so that you can avoid liability. Please contact us at firstname.lastname@example.org or by telephone on 01 725 77.