Do employers have the right to provide data on health of employees to the contracting authority?
On 29 January 2021, the Spokesperson for Small and Medium-sized Enterprises asked the President of the Office for Personal Data Protection to take a position on Article 15r(1) of the Law of 2 March 2020 on specific solutions related to the prevention, prevention and eradication of COVID-19, other communicable diseases and the crisis situations caused by them (hereinafter: the COVID-19 Act).
In accordance with that provision, the parties to a public procurement contract, within the meaning of the Law of 11 September 2019 – Public procurement law, without delay, are to inform each other of the impact of the circumstances surrounding the occurrence of COVID-19 on the due performance of that contract, if such influence has occurred or may occur. The parties to the agreement shall acknowledge this impact by attaching to the information referred to in the first sentence statements or documents which may relate in particular to m.in:
- the absence of employees or persons providing paid work on a basis other than an employment relationship which participates in or could participate in the performance of the contract;
- decisions issued by the Chief Sanitary Inspector or acting under his authority by the state provincial sanitary inspector, in connection with the prevention of COVID-19, requiring the contractor to take certain preventive or control measures.
In his reply of 8 February 2021, the President of the Office for Personal Data Protection stated that the abovementioned Article 15r(1) of the COVID-19 Act does not constitute a legal basis for the employer to obtain data on the health status of the employee for the purpose of transmitting it to the contracting authority in the context of the performance of a public order – it is also irrelevant whether that counterparty is a public or private entity. Nor does that provision give the customer the basis for the acquisition and processing of such personal data.
The President of the Office for Personal Data Protection also explained that the employer must demonstrate one of the conditions set out in Article 9(2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 allowing the processing of this category of data in well-defined circumstances in order to process the employee’s health. Referring to Article 221b(1), paragraph 2 and paragraph 3 of the Law of 26 June 1974 – The Labour Code governing the processing of data of specific categories (on health), the President of the UODO concluded that the employer, in accordance with the principle of accountability, would not be able to demonstrate why he obtains and transmits to other entities (contractors) data on the health status of the worker for the purposes of the performance of the public contract.
According to the DPA, the provisions of Article 15r(1) of the COVID-19 Act cannot constitute a legal basis for the employer to process other data about the employee (health data) and under conditions other than those expressly provided for by labour law.
