Are you taking the temperatures of staff, customers or kids?

‍

Everyone is navigating the regulations required for re-opening, all the whilst trying to run a business and recover economically. Whether it's your staff or your customers or even kids attending sports activities, you might be taking temperatures on arrival. And there are data protection implications. Measuring a person’s body temperature is, in principle, a processing of personal data. “Processing” can refer to many different actions regarding personal data: for instance viewing, storing, passing on, looking at or deleting personal data. Simply viewing a temperature on a thermometer or with a thermal camera, without the temperature being stored or recorded, is often already a processing of personal data.

Temperature measuring falls under the realm of  person’s health data. This involves a special category of personal data and, in principle, a processing prohibition applies. The basic principle is that measuring temperatures is not permitted, unless one can invoke a legal exception. Currently there is no new legislation requiring temperatures be taken so this is hard to do.

Explicit consent of these categories of data subjects might be an option in very specific cases, but only if consent is really completely freely given. What this means is that the data subject must not be negatively affected by the fact that he or she does not give his consent. For instance, think of an employee arriving for work who is asked at the entrance if they want to be tested. They will probably feel compelled to a greater or lesser degree to give their consent; otherwise they will not be allowed onto the premises and therefore cannot do their job. So in this case consent is not legal as its not freely given.

In summary measuring the temperature of employees and visitors will often not be permitted.  There does not seem to be a good legal exception, which would be necessary under the GDPR to measure the body temperature of employees and visitors. And even if it were available, the processing of health data is, in principle, only reserved for doctors. In addition, the processing must be necessary for the intended purpose. We're now at a stage where we now that people without symptoms can also spread the virus.

Take advice based on your specific circumstances but in general employers and business owners are probably not allowed to measure temperatures.

You can download the full guidance notes from the Data Protection Commission here.

For advice on recording names and contact details of guests to your premises get in touch with us and we will set up a quick call. Our speciality is translating the regulations into what's relevant for small businesses.