Is application of Swiss data protection law affected by COVID-19 crisis?
No, data protection laws continue to apply as they did prior to the COVID-19 crisis. However, the Swiss data protection authority, the Federal Data Protection and Information Commissioner (FDPIC), will be aware of the particular challenges and constraints that employers face at present.
What official guidance on data protection law is available?
The FDPIC has issued no official guidance to date. There is guidance from EU data protection authorities, but it is not officially binding, even less so in Switzerland, and there are important differences between EU and Swiss data protection and employment laws.
Can employers direct their staff to report symptoms of COVID-19?
Yes, employers must ensure the health and safety of their employees as well as a duty of care, which requires them to know about potential cases of COVID-19 in their organisations.
If an employer knows that an employee may have potentially contracted COVID-19, can they inform their staff?
Yes, employees should be kept informed about cases in an organisation. However, individuals should not be named, and only the required information should be given.
Can employers lawfully impose temperature, saliva or blood testing for COVID-19 on employees as a condition of entering work premises?
Temperature screening is acceptable as a measure to protect employees' health. A saliva test as a condition for entering work premises should be considered lawful, as long as provided saliva tests are more precise or yield faster test results than temperature screening. Similarly, blood testing would require consent unless blood tests are known to be more reliable or faster than saliva testing.
However, the Swiss government has stated publicly that there is no need for general COVID-19 testing for employees. An employer wishing to carry out general testing should therefore be able to rely on a particular situation to justify the measure. Since the dispensing to the general public of test kits for the diagnosis of transmissible human diseases is prohibited, saliva and blood testing must be done by qualified medical personnel, unless authorised by Swissmedic.
Can employers use laboratories outside Switzerland?
Yes, the transfer of health data to a laboratory abroad is permitted provided that the laboratory is located in a country with an adequate level of data protection (which includes EU and EEA countries and the United Kingdom). For recipients in other locations, safeguards such as the EU Standard Contractual Clauses are required. The Standard Contractual Clauses must be notified to the FDPIC. Where a laboratory receives only pseudonymised data (eg, the testing kits with a bar code that is not personally identifiable to the laboratory) the above does not apply. When the testing is implemented employees should be informed about the transfer to the laboratory abroad.
What other restrictions apply to employee data in relation with COVID-19?
Where sensitive data is collected, employers must state expressly their identity, the processing purpose and the categories of (contemplated) recipients of that data inside and outside of the organisation.
Employee data collected in relation with COVID-19 cannot be processed for any other purposes and must be erased when no longer needed.
Access to identifiable employee data must be restricted based on the need-to-know principle.
Where employee data needs to be shared with group companies, the disclosing entity must ensure that restrictions on cross-border transfers are complied with and where the group companies are joint controllers or controllers and processors, the appropriate contractual arrangements must be in place.
Before implementing specific health protection measures, employees must be informed; employees or their representatives have the right to make proposals in this respect. Employers must justify their decisions if they only partially take into account any objections or proposals made by the employees or their representatives.
