COVID-19: Important employment and data protection law aspects

3.12.2020

The spreading of COVID-19, also known as the "Corona virus", is accelerating every day, and the Danish authorities are also monitoring the health risks closely and the possibility of containing the virus. The current situation has forced Danish businesses take precautionary measures, and both the Danish government and the social partners have already made a number of announcements and recommendations. This newsletter explains our recommendations to Danish employers when drafting internal guidelines and measures to deal with Corona virus / COVID-19. Updates will shortly follow in light of the latest initiatives introduced by the Danish government as of today.
With increased global travelling, it is relevant for all employers to draw up internal rules and guidelines specifying the rights and obligations of the employees. Many employers with cross-border activities, particularly in high-risk areas, have already implemented procedures and measures to cope with COVID-19, but other employers should also take steps to prevent their employees from catching the virus. 

The Danish Working Environment Act 

All Danish employers are required by the working environment rules to provide a safe and healthy physical working environment. It means i.a. that the employer must assess how the employees can avoid unnecessary exposure to COVID-19 in the workplace from colleagues, customers or other business partners. 

Measures/internal guidelines

All employers are recommended to adopt their own measures/internal guidelines in relation to COVID-19. The details of the guidelines should reflect the employer’s specific situation.   

Most recently, the government has called on Danish businesses to keep employees who have been in so-called “high-risk areas” away from the workplace for 14 days after returning home (Announcement of 3 March 2020 by the Danish Ministry of Industry, Business and Financial Affairs based on the recommendations of the Danish Health Authority. The high-risk areas are listed on the websites of the Danish Ministry of Foreign Affairs and the Danish Health Authority www.sst.dk/corona).

The list of high-risk areas is changing every day, and employers should monitor the development closely based on the recommendations of the Ministry and the Authority. The Ministry of Foreign Affairs advises against unnecessary travelling in high-risk areas.

Employees’ travelling

For employers to take relevant measures, they must know about their employees’ travelling activities.

Such information constitutes personal data, which must be obtained and stored in accordance with the data protection rules (see below). 

All employers should call on their employees to take the situation seriously and advise those with COVID-19 symptoms to see a doctor and not appear at work. Employers should specify the obligation in writing and maybe impose sanctions on employees who breach the rules and/or do not comply with other communicated measures. 

As a general rule, employees cannot refuse to appear at work, nor decide to stay at home at their own initiative for fear of being infected with the Corona virus.

However, it is within the employer’s managerial authority to order the employees to work at home during a given period. 

Employees travelling on business to high-risk areas

Also, employers should consider whether business trips to high-risk areas or to countries where an outbreak has occurred should be cancelled to protect the health and safety of the employees. The employer may, subject to the relevant precautionary measures, order an employee to go on a business trip to a country where the virus has already spread, if the Danish Ministry of Foreign Affairs does not advise against travelling to that country. If the employee refuses to go, it may, in the circumstances, amount to a breach of the employment, unless the employee’s health or life is at risk. 

If the employee has had to travel to a high-risk area for business purposes, the employee should work from home for a period of 14 days after returning to Denmark as recommended by the authorities. In that case, the employee will be entitled to usual salary. If an employee who is away on a business trip is prevented from returning home (e.g. because the local authorities require isolation at the hotel, closing of the airport, etc.), then the employee will be entitled to receive salary as usual. 

Employees going on private trips to high-risk areas

If an employee goes on a private trip to an area which, at the date of departure, is designated as a high-risk area by the Danish authorities and is prevented from returning home (e.g. because the local authorities require isolation at the hotel, closing of the airport, etc.), this will not be a valid excuse for absence, and the employee will generally not be entitled to salary in the period of absence. The reason is that the employee has exposed himself to risk by not following the authorities’ recommendation, and such conduct should not be prejudicial to the employer. 

The same applies if the employee catches the Corona virus/becomes ill while making a voluntary trip to a high-risk area, which will probably be regarded as self-induced illness. Ultimately, the employer may be entitled to dismiss the employee summarily for unlawful absence, but this will have to be assessed on a case-by-case basis. Another more pragmatic approach would be for the employer and employee to agree on a solution, where the employee takes holiday or time off in lieu during the self-induced absence, provided that this can be accommodated within the employment.  

When returning home from a private trip to a high-risk area, the employee should - like in the case of business trips - work from home during the first 14 days.  The Ministry of Industry, Business and Financial Affairs has called on employers to pay salary to the employees during that period. On the other hand, the employee will probably not be entitled to salary during a self-induced home working period if the travelling took place against the recommendations of the Ministry of Foreign Affairs and despite the employer’s advice to the contrary, unless the employer continues to receive the employee’s services. However, this should be pointed out to the employee before departure. 

Data protection aspects

As noted above, employees’ personal data must be processed in accordance with the data protection rules in connection with an actual or potential outbreak of COVID-19. It must i.a. be ensured that the processing takes place in accordance with the general principles of the General Data Protection Regulation, including in relation to lawfulness, fairness and transparency. Also, the employers should only process such personal data as are necessary to prevent the virus from spreading. 

First of all, employers should consider the purpose of the processing of information about an employee’s actual or potential infection with COVID-19. The processing must serve a legitimate purpose. Then, it should be considered which general and special categories of data (sensitive data) will have to be processed to achieve that purpose. 

After defining the purpose and type of personal data, the employer must determine which processing activities are being performed and on what legal basis. In the case of general data such as the employee’s name, travelling activities, etc., the processing may e.g. take place on the basis of the employer’s legitimate interests in providing a safe and healthy physical working environment, if - and to the extent that - these interests are deemed to override the data subject’s fundamental rights and freedoms.  

Consent?

As a general rule, processing of sensitive personal data, including in relation to the employee’s health following an actual or potential COVID-19 infection, is subject to the employee’s express consent. In some cases, however, processing may take place on another legal basis, for instance with reference to the employer’s employment law obligations. Thus, it must be assessed on a case-by-case basis when express consent is required and when processing may take place on another legal basis. Since the employee’s consent can always be withdrawn, a different basis for processing is to be preferred.  

Further, it cannot be ruled out that the employer will be asked to disclose - or has a legitimate interest in disclosing - information about (potentially) infected employees to third parties, including colleagues, customers, business partners or authorities. In that case, the employer should assess whether disclosure is necessary and serves legitimate interests and, if so, on what legal basis disclosure may then take place. In case of disclosure, the registered employees must generally be informed about the recipients or categories of recipients of their personal data.

The above describes only some of the data protection aspects that should be taken into account by employers before processing employees’ personal data in relation to COVID-19. 

Check-list for internal guidelines  

As outlined above, many things will depend on the specific circumstances of the relevant employer. We recommend that employers consider the following when drafting internal guidelines/measures in relation to COVID-19:


  • Description of measures taken at the workplace (good hygiene practices, etc.) and monitoring of travelling activities and other infection sources.
  • Establishment of procedures where an employee has been or shows signs of being infected.
  • Guidelines on limitation of unnecessary travelling activities (based on the authorities’ recommendations or in-house restrictions). 
  • Quarantine situations or quarantine periods ordered by the employer.  
  • Pay and working conditions during quarantine periods (possibility of working from home, necessary equipment, etc.).   
  • Guidelines on suspension of physical meetings, sessions and other events. 
  • Possible consequences of private trips to high-risk areas. 
  • Possibility of taking holiday or time off in lieu in case of delayed journey home from private trips and in similar situations.
  • Special rights and obligations for posted employees, e.g. in relation to returning home and/or complying with local law.  
  • Calling attention to the general requirement for proof of sickness
  • Sanctioning of non-compliance with internal guidelines.
  • Effective communication of guidelines, including reference to the relevant authorities’ websites, etc. and current updates.
  • Need for management training.  

Our assistance

Our specialists are ready to provide advice on the drafting and adjustment of internal guidelines and to answer any legal questions that may arise.


News updates will shortly follow in light of the latest initiatives introduced by the Danish government as of today.