With respect to the pandemic situation we would like to briefly inform you on some important issues regarding the processing of data based on the information provided by the National Authority for Data Protection and Freedom of Information (NAIH).
The obligations of the undertakings
- Businesses, as data processors, remain responsible for the lawfulness of data processing and for compliance with data protection principles in times of emergency as well.
- In addition, the firm’s medical doctor as an independent data processor is also required to comply with the applicable privacy regulations.
- It is important to bear in mind that even in the event of an epidemic, the processing of personal data is reasonable only if the purpose of the processing cannot be achieved by measures which do not involve data processing.
What measures should businesses take in the event of an epidemic regarding data protection?
- Call the attention of your employees’/co-workers’ to make the necessary announcements and measures to protect their own and their co-workers’ health, even by using legal questionnaires.
- Develop a procedure for those who enter the office and provide them with appropriate information if processing their data.
- Develop a mechanism on what kind of personal data can be processed by the company and under what conditions If an employee or a customer submits a report.
- If you order home office, review the data security measures, modify them as needed and inform your employees and colleagues.
- However, it is important to investigate if there are measures that can be implemented without processing personal data (for example changing opening hours, providing a glass wall or antiseptic liquids etc.). If yes, apply these first.
We must underline and stress that the above topics are just brief summary of some issues we find crucial in the upcoming period.
Further analysis may be required in certain cases depending on the decision of the companies related to their employment policies or other arisen questions.
Should you need assistance in the drafting of necessary documentation or advice on certain GDPR questions, do not hesitate to contact us.