News Archives - Page 9 of 9 - Kapolyi Law Firm

Employer’s Data Protection Challenges During the Coronavirus Pandemic

In our previous newsletter, we examined the most important labour law provisions, which became especially relevant due to the spread of the coronavirus. We would like to remind you, that in today’s extraordinary circumstances, employers must not only consider labour laws, but also comply with data protection regulations. This newsletter summarises the most imperative risks, and proposes measures to be taken, which are approved by the Hungarian National Authority for Data Protection and Freedom of Information (NAIH).

Risks and Challenges

The European General Data Protection Regulation (GDPR) set strict conditions for data processing, and equipped national authorities with effective tools to enforce its provisions. As a result, enterprises must invest a significant amount of resources in order to ensure compliance with data protection provisions. The world of business perceives the strictness of the GDPR as an unnecessary burden. This is especially true for SMEs and those enterprises whose main area of activity bears no relationship with processing personal data, or those who only conduct data processing peripherally. Therefore, one may believe that the new data protection regulations needlessly hinder the implementation of the employer’s health and safety measures.

Luckily, this is not the case. During the drafting of the GDPR, European lawmakers considered risks such as an epidemic, which means that the GDPR does not hinder or prevent epidemic measures from being implemented (Section 46 of the Preamble of the Regulation explicitly describes this). However, this does not mean that by referring to extraordinary circumstances employers are allowed to collect and process any kind of data. The Regulation continues to severely sanction data processing which may not be considered as purposeful or justifiable, and also prohibits the employer from going beyond its role, utilising tools which only national authorities are permitted use.

A situation such as this requires the employer to process a wider range of data on employees than it usually does. In order to ensure uninterrupted communication and the upkeeping of regular operation, it becomes inevitable for the employer to collect and process personal phone numbers, e-mail addresses and other online contact details. Furthermore, depending on a given economic activity, it may become necessary to process several other kinds of personal data.

With regards to the above, our general advice is to ask for the assistance of a data protection expert when designing new workflows to be implemented. We recommend this in order to satisfy the principle of privacy by design, and through this to ensure compliance with further data protection principles. It is not recommended to appoint administrative staff or middle management to implement measures. It is a better choice to construct uniform, regulated workflows with the aid of an expert.

With regards to data protection, a further challenge stems from the recently popular decision of employers directing employees to work remotely. It is often the case that employees are forced to use their own devices for work – to a certain extent – instead of relying on the employer’s IT infrastructure. Such measures may pose severe data protection risks. In several processes, a greater data protection risk is one which may have an effect on the data processing’s legality. For instance, in case of data processing based on legitimate interest, the test for balancing interests may bear different results under a lower data protection level.

Healthcare and Travel-related Data Processing

Recently, employers widely began to implement measures, which involve the processing of personal data concerning health. We would like to emphasise that personal data concerning health is classified as a special category under the GDPR. The processing of such data has strict conditions and boundaries. The data protection risk in this case is significantly greater, than when processing different categories of data.

It is not lawful for employers to conduct medical checks by themselves, or to request healthcare documentation from their employees. Conducting mandatory body-temperature tests, issuing compulsory health-related questionnaires, demanding data on medical history in any way, and other similar measures all count as an unlawful data processing, which the employers may not conduct. According to NAIH, an exception to this rule may only be granted on an individual basis for certain jobs that are considered to be highly susceptible to illness. Even in this case, several data protection provisions are to be complied with, and a healthcare expert must also be involved.

The processing of health-related data is not forbidden. The GDPR prescribes several legal grounds, based upon which the processing of special categories of data is permitted. It is important to mention that prior to beginning the processing of such data, it is essential to examine the necessary conditions for it. It is common practice that an employer orders an employee to fill out a declaration of consent and believes that the data processing is therefore legitimate. This will most likely result in an invalid declaration and illegitimate data processing, even if the data in question does not fall under a special category of data. We therefore recommend this practice to avoided.

A significant proportion of employers with larger workforces have recently ordered their employees to compulsorily fill out questionnaires with regards to whether the employee or any other person entering the premises of the workplace has recently visited a country affected by COVID-19 or whether they have symptoms of the coronavirus. These questionnaires may only be legitimate, if prior to their introduction, the employer has conducted the test for balancing interests, and is satisfied that the measure is necessary and is proportionately beneficial when considering the measure’s negative effects on the employees’ rights. As discussed above, questions may not inquire about medical history, and the processing of data collected through the questionnaire must be regulated.

A further question arises with regards to the legality of an employee’s ‘whistleblowing’ concerning another employee’s symptoms. Accepting these reports is not illegal. Based on the principles of Labour Law (duty of cooperation, good faith, fairness), employees are entitled to and obliged to submit a report to the employer regarding health risks they are aware of in the workplace. However, we believe that the process of submitting a report should be regulated in a way which complies with data protection principles, and does not result in the stigmatization and/or discrimination of employees who are perceived to be ill.

Recommended Measures

Generally, we recommend that personal data should only be processed, if it is absolutely necessary. If there is an alternative, then that should be the preferred choice. Furthermore, when processing sensitive data, it is recommended to strive for a high level of compliance with the principle of transparency, and to and to provide clear information on all measures taken.

Recently, European data protection authorities began to publish their recommendations with regards to data protection questions related to the coronavirus epidemic. The interpretation of regulations varies greatly between different authorities. It is often the case that certain legal bases are legitimate in one Member State, but are not applicable in another and a number of Member States’ authorities declared that employers have limited means to conduct data processing. Concurrently, multiple authorities explicitly stated that the GDPR does not restrict entities in such situations. As such, we recommend multinational enterprises not to rely on the guidance and/or internal regulations issued by their corporate group or parent company. Hungarian corporations must comply with NAIH’s guidelines.

On a final note, we would like to direct your attention to NAIH’s recommendations for the measures to be taken by employers, which we summarised below:

NAIH recommends the development of a so-called pandemic or business continuity action plan. This plan this does not exclusively concern itself with data protection issues, but are drafted with consideration of the relevant data protection risks. Detailed informative prospectuses created for employees as a part of the plan don’t limit themselves to data protection issues only. Instead, they are to provide information regarding the coronavirus and guidance on how to deal with the risk of infection. In similar situations, NAIH considers it necessary for the plan to include provisions on the reorganisation of business and business travel, including the regulation of remote working. Additionally, NAIH considers it important that the action plan includes a notice for employees to immediately report any suspected infection and to consult the occupational physician or a general practitioner.

Just like with preparing the necessary labour law documentations, responding to our clients’ data protection inquiries is a top priority for us. We will do everything in our power to help you comply with regulations as soon as possible!

If we may be of assistance to you with regards to any of the above, please don’t hesitate to contact us!

The Coronavirus Crisis: our recommended course of action with regards to work matters

In light of the spread of the coronavirus in Hungary, the current state of emergency in effect, and the implementation of various epidemiological measures, Kapolyi Law Firm recommends the following course of action to be taken with regards to your workforce:

If the Workplace is Placed Under Quarantine

If employees are unable to access their workplace, as it has been placed under quarantine and the employer is therefore unable to provide employment as contracted, then Section 146(1) of the Labor Code applies. As such, if the employer is unable to provide employment as contracted due to unavoidable external reasons (i.e.: a quarantine order issued to combat the spread of the coronavirus), then the employer is not obliged to pay the employee’s base salary. However, two conditions must be simultaneously met: the reason for the disruption was not foreseeable, and it is objectively impossible for the employer to avoid said reason.

If the Employee’s Home or Place of Residence is Placed Under Quarantine

It may be the case that the employer is unable to provide employment as contracted since the majority of employees are sick or are placed under quarantine. In this case, the above-detailed scenario is triggered, and employers will not be obliged to pay their employees’ base salary. Per the Law on Compulsory Health Insurance, ill employees are entitled to sick pay. Per Government Decree 41/2020. (III. 11.) those who are potentially infected may officially be ordered to self-quarantine at home by the authorities (without admission to a hospital). Currently, people arriving from one of the following countries are subject to compulsory self-quarantine, regardless if they have symptoms or not: Italy, China, South-Korea and Iran.

The Separation of Employees Capable of Work

In case of the separation or the quarantining of an employee otherwise capable of work (i.e.: when an employee is not sick but is being monitored), the employee should temporarily work remotely (e.g.: at home) if possible. If working from home is not an option (for instance because of the nature of the employee’s work, or due to other circumstances), per Section 44(g) of the Law on Compulsory Health Insurance, the employee is entitled to sick pay, as the employee is incapable of work. An employee is considered to be incapable of work if:

the employee is banned from doing their job due to public health concerns and he/she is not staffed in any other position;
the employee is segregated by authorities for public health reasons;
the employee is unable to reach his/her workplace due to an epidemiological or veterinary quarantine and the employee cannot be temporarily staffed in a different workplace (or in a different position).

Quarantine Ordered by the Employer

It may be the case that neither the employer nor the employee are affected by restrictive measures, but for the sake of health and safety, the employer orders the employee to self-quarantine (i.e.: if the employee returns from a country not listed in the Government Decree mentioned above). An action plan may potentially consist of the following elements:

remote working (Home Office) based on a mutual agreement;
if the employee’s job permits, remote working per the instruction of the employer;
with the consent of the employee (by mutual agreement), the taking of unpaid leave;
if the employee has outstanding annual leave days and does not consent to take unpaid leave, the taking of paid leave;
if none of the above are appropriate, the employer may order the quarantining of the employee, for the duration of which he/she is entitled to their base salary (downtime).

An advantage of working remotely (Home Office) is that employees are not physically in each other’s vicinity while working, meaning employees are unable to infect one another (it is possible for a for an employee not to have any symptoms, but to infect their colleague regardless) and are not exposed to the virus when using public transportation. Considering the above – and to prevent the further spread of the epidemic – we recommend that you instruct your employees to work remotely.

If you decide to issue a firm-wide remote working decree, our firm will prepare your internal Home Office regulation as a matter of top priority.

If you would like more information on the above, please don’t hesitate to contact us!

Kapolyi INSIGHT business breakfast

We organized a client breakfast inviting the representatives of listed companies, institutional investors and securities account managers, under the name of Kapolyi INSIGHT. At the event experts of Budapest Stock Exchange and Kapolyi Law Firm presented and summarized the key tasks and obligations of the relevant actors and stakeholders subject to the new act on long-term shareholder engagement.

The act on encouragement of long-term shareholder engagement adopted in July 2019 imposes new obligations on issuers, fund managers and insurance companies. During our Business Breakfast event, Kapolyi INSIGHT – hosted at the Bank Center – our speakers raised awareness about the implications of new duties and responsibilities for those affected. You can read more about the event on portfolio.hu.