Datenschutz und Corona

FAQ (Englisch) – processing employee data in connection with Covid-19



(FAQ) - Frequently Asked Questions

Disclaimer: The FAQ is tailored for the German market since the processing of employee data is subject to special provisions according to the Federal Data Protection Act (BDSG). Its general assumptions though may be useful for Controllers which are located outside of Germany but are subject to tthe GDPR.

Employers are obliged to provide care for their employees in accordance with the regulations of the German Occupational Safety and Health Act (ArbSchG). This also includes ensuring both the operational safety and the health of the employees. The German Federal Ministry of Labour and Social Affairs (BMAS) has published the SARS-CoV-2 occupational safety standard ( in connection with the return of employees to their jobs in order to create uniform protection for employees. However, measures to implement the standard or as part of the employer's duty of care must always be assessed in terms of their permissibility under data protection law. The following FAQ therefore intends to address the currently relevant questions relating to the processing of personal data in the context of monitoring of employees and its admissibility under data protection law. The explanations with regard to a Covid-19 Warning App are based exclusively on the App of the Federal Government of Germany (

To view the answer click:

1. Do employees have to inform the employer that they are or may be infected with

There is no unanimous opinion on the question of an employee's duty to inform the employer. In principle, employees are not obliged to inform the employer about their illnesses. However, the employee is subject to obligations of consideration in the employment relationship according to Sect. 15 para. 1; Sect. 16 para. 1 ArbSchG in connection with Sect. 241 para. 2 Civil Code, which oblige him to immediately report any direct significant danger to safety and health that he/she has identified. (1)

In the context of the Covid-19 pandemic and the resulting tightened contact restrictions and hygiene measures due to the high infectivity, it must be assumed that employees are obliged to report positive testing and thus obvious infection with Sars-CoV-2. The notification has to be made immediately, i.e. without culpable hesitation. This is only possible by telephone/writing, but in any case not in person, due to the officially ordered quarantine which automatically follows in case of a positive test. The same should apply if a person living in the same household (family member, roommate etc.) has tested positive and one must therefore assume an increased risk of infection. In order for employees to be able to fulfil their obligations, the employer should also inform about possible signs or symptoms where employees should stay away from the premises and consult a doctor. A notice can be posted in front of the company premises for this purpose, for example. The RKI [=Federal Agency for Infectious Diseases] provides information on its website about possible symptoms indicating a Covid-19 infection (

However, an immediate significant risk can no longer be assumed if the 14-day incubation period has elapsed without symptoms typical of Covid-19, the employee has been in domestic quarantine during this period and therefore has had no contact with other employees, and, if quarantine has been ordered by the health authorities, has been lifted again. On presentation of a medical certificate of incapacity to work, there is no additional obligation to notify the employer, as the employee who previously tested positive should not pose any further health risk to other employees. More information on the course of the infection with Covid-19 and the measures taken by the responsible health authorities can be found under the following link:

(1) Sagan/Brockfeld, Arbeitsrecht in Zeiten der Corona-Pandemie [labour law in times of the Covid-19 pandemic], NJW 2020, 1112 (1112).

2. May an employer ask whether employees have been in a risk area or have had contact
    with people who have tested positive?

According to Sect. 618 Civil Code in conjunction with Sect. 3 para. 1 ArbSchG, the employer is obliged to take measures of occupational health and safety to ensure the safety and health of the employees. This may include sending the employee home if the employer suspects that an employee may have been infected with Covid-19. In this context, the employer is entitled to ask the employee concerned after a vacation-related absence whether he or she has been at a location for which there was an official travel warning from the German Foreign Office or which was designated as a risk area by the Robert Koch Institute (RKI). The employer may also ask whether there was contact with persons who tested positive. (2)

Since 10.4.2020, the RKI no longer designates international risk areas or particularly affected areas in Germany, which is why questions relating to risk areas have lost relevance (see

An obligation or even a right to record the results of this survey results on the one hand from the documentation obligation according to Sect. 6 ArbSchG and, on the other hand, from the interest to claim compensation for continued remuneration according to Sect. 56 IfSG [Infection Protection Act]. The admissibility under data protection law results from Sect. 26 Abs. 3 BDSG in connection with Art. 9 Abs. 2 lit. b GDPR. (3)

It should be noted that the person concerned does not have to name any specific contact persons. A statement that contact has been made with a person tested positive is sufficient. With regard to internal company documentation, it is only necessary that, in the case of confirmation that contact has been made with a person who has tested positive, it is recorded that the person concerned has been asked not to enter the workplace for a specified period of time. (4) Even outside the workplace, contact with members of the group of colleagues should - as far as possible - be avoided.

If there is a reasonable suspicion of infection with the Covid-19 virus, the employer can demand a medical certificate or an examination by the company doctor. (5) However, this will not be an enforceable means for the employee to actually be allowed to take a test.

(2) Sagan/Brockfeld, Arbeitsrecht in Zeiten der Corona-Pandemie [labour law in times of the Covid-19 pandemic], NJW 2020, 1112 (1112).
(3) Lachenmann, Datenschutz vs. Corona-Virus – Handlungsempfehlungen für Unternehmen bei Schutzmaßnahmen [data protection vs. Covid-19 - recommendations for companies implementing safety measures, DSB 2020, 84.
(4) HmbBfDI, Datenschutz in Zeiten von Covid-19 [data protection in times of Covid-19] (
(5) Sagan/Brockfeld, Arbeitsrecht in Zeiten der Corona-Pandemie [labour law in times of the Covid-19 pandemic],, NJW 2020, 1112 (1113).

3. Is an employer allowed to test the state of health of employees,
    for example by measuring their body temperature?

As mentioned in section (2), the employer may, in special circumstances, require the submission of a medical certificate or an assessment by the company doctor. In the opinion of the HmbBfDI [DPA of Hamburg], the retrieval of Covid-19-specific symptoms and, among other things, the measurement of body temperature as health data can be regarded lawful according to Sect. 26 para. 3 BDSG in conjunction with Art. 9 para. 2 lit. b GDPR if the specifics of the workplace make this necessary. It is considered a special case if close physical contact cannot be excluded due to the design of the workplace, e.g. in facilities such as hospitals or medical device manufacturers. (6)

Here, too, it is only necessary to store information on whether an employee has been denied access for a specified period of time and not that specific health data is collected and stored.

(6) HmbBfDI, see (4)

4. Is an employer allowed to use camera technology to monitor compliance
    with the distance regulations according to the new occupational safety standard
    SARS-CoV-2 of the (7)

If it is necessary for the performance of the employment relationship, the use of open video surveillance can be justified in accordance with Sect. 26 para. 1 sentence 1 BDSG. What is important here is the intended purpose. A conceivable purpose would be the use to increase the security of the employees. The decisive factor in assessing whether video surveillance is necessary is the respective local situation and the question of whether there are not also less intrusive but equally effective means of achieving the goal of increasing security.

The occupational health and safety standard itself suggests various organisational measures which should be taken if it is not always possible to ensure that the required minimum distance is maintained. Examples include the wearing of mouth-and-nose covers, the installation of partitions and the closing of places where people usually gather. Accordingly, there are preferable less intrusive measures to ensure safety at work, which make it difficult to introduce justified video surveillance for the purpose mentioned.

In principle, it should be noted when introducing video surveillance technology, this most likely will be subject to co-determination pursuant to Sect. 87, Subsection 1, No. 6, BetrVG [Works Constitution Act], since it is basically suitable for monitoring behavior and performance.

Alternatively, various sensor technologies are already available which are intended to support the maintenance of safety distances without personal data. When making a selection, it should be checked in detail whether this is really an anonymous solution or whether data processing is only pseudonymous via an evaluable instrument ID, which would open up the material scope of application of the GDPR. If the sensors are suitable for behaviour or performance monitoring, the co-determination rights of the works council must also be observed.


5. May an employer use camera technology to detect
    possible Covid-19 infections?

As described in points (2) and (3), it may be necessary in certain areas to ask employees about Covid-19 symptoms before entering the workplace or to take their body temperature. In any case, a permanent recording of thermal images cannot be considered necessary for this purpose, since - as described above - the storage of such specific health data is not considered permissible under data protection law.

With regard to the necessity of using thermal imaging cameras on the company premises, this will have to be denied, since a possible infection of other employees may already have taken place and the thermal image is therefore not suitable for fulfilling the purpose (prevention of infection). Introducing thermal imaging cameras would only be conceivable at separate and clearly marked entrances of premises of certain occupational/hazard groups (see sect. 3), in connection with a storage ban, i.e. no storage of the collected information.

In general, fever measurement as a meaningful indicator of a Covid-19 infection has to be doubted. However, the RKI (8) considers it to be a suitable preventive measure in the form of initial screening before events (9).

(8) Ständiger Arbeitskreis der Kompetenz- und Behandlungszentren für Krankheiten durch hochpathogene Erreger am Robert Koch-Institut, Hinweise zu Erkennung, Diagnostik und Therapie von Patienten mit COVID-19 [indications for the detection, diagnosis and therapy of patients with Covid-19], .
(9) Sagan/Brockfeld, Arbeitsrecht in Zeiten der Corona-Pandemie [labour law in times of the Covid-19 pandemic], NJW 2020, 1112 (1113).

6. Can the employer oblige employees to install and present a Covid-19 warning app on
    their private smartphone or on business smartphones?

Private Smartphones

The employer's right to issue instructions under § 106 GewO [Trade and Industry Code] does not go so far as to oblige employees to use their own hardware and software for professional purposes. (10)  Therefore, employers cannot demand that employees install special apps on their private smartphones. The employer also has no control rights over private devices. (11) If an employee has installed a Covid-19 app on his/her smartphone for his/her own interests and thereby receives a warning that he/she appears to have come into contact with persons who have tested positive, this may result in an obligation to report this to the employer, as described in Section 1.

(10) Vgl. Gola, Handbuch Beschäftigtendatenschutz [handbook employee data protection], 8. Aufl. 2019, Rn. 1107.
(11) The Conference of Federal and State Data Protection Officers (DSK) points out that access to workplaces must not be made dependent on presentation of the app. This would be an improper use, which is already incompatible with the concept of voluntariness. Discrimination against people who do not use the app should be excluded,

Smartphones for business use only

If business smartphones are issued, and if they are only for business use, the employer may equip them with the software required for the performance of the employment relationship. If the software is capable of performance or behaviour monitoring, the co-determination rights of the works council must be observed.

The legal basis for processing personal data by a Covid-19 warning app on the business mobile phone would be Sect. 26 para. 1 sentence 1 BDSG, in order to ensure or support the health care of employees and business partners and to be able to react appropriately in the event of a positive test of a contact. Of course, this would entail a duty to inform according to Art 13 GDPR and the specification of a storage period and deletion routine. At present, indications of 4-8 weeks are regarded as appropriate storage periods. (12)

It has to be asked whether the warning message issued by the app and the processing of this information by the employer must be regarded as processing of health data. In this case, Section 26 para. 1 sentence 1 of the BDSG would not be considered as a legal basis, as this is not applicable to health data in principle, but Section 26 para. 3 BDSG would have to be applied. (13) A warning message by the app indicating a Covid-19 infection would lead to the employees obligation pursuant to Sections 15 para. 1; 16 para. 1 ArbSchG in conjunction with Sect. 241, Subsection 2, Civil Code to notify the employer about the infection (see Sect. 1). The permissibility of processing this personal data then arises, as stated in Sect. 2, from Sect. 26 para. 3 BDSG. However, especially in the field of professions with close body contact, e.g. in nursing, in hospitals or emergency services, an application can definitely offer an advantage for employees as well as for the professional contact persons, since here often particularly endangered persons are involved, for whom a preferably protected and low-risk environment should be created.

The use a Covid-19 warning app is subject to co-determination in accordance with § 87 para. 1 no. 7 BetrVG, as the use of it in the company is an occupational health and safety measure in accordance with Sect. 3 para. 1 ArbSchG. The works council has a say in the introduction of an obligation to use the app and in any form of its design. (14) From a data protection point of view, it is important to ensure that the works council agreement is designed in such a way that it does not fall below the applicable data protection level guaranteed by the GDPR.

Even if the smartphone is released for business use only, you will encounter the problem that the app is also active during breaks of the employees, which are not part of the working time. The right to issue instructions does not extend to the private sphere of the employees, so that even with business smartphones the only conclusion that can be drawn is that the app can only be used on a voluntary basis in conformity with data protection regulations. Nevertheless, employers in professions with close body contact should make an appeal to their employees to take their business smartphones with the active app with them in their free time as well, in order to keep the risk of infection as low as possible due to the special duty of protection towards their customers, or to be able to guarantee a quick follow-up of the health authorities and the taking of measures by the employer.

The BayLDA [DPA of Bavaria] states in its comments on the German Covid-19 Warning App ( that consent has to be considered inadmissible as legal basis. The BayLDA considers that the voluntary nature of the consent is generally not given due to the imbalance in the employment relationship and that the consent is therefore invalid. The BayLDA threatens to impose fines for violations.

(12) S. HmbBfDI, Datenschutz in Zeiten von Covid-19 [data protection in times of Covid-19],; Senatskanzlei Berlin .
(13) Körner, Beschäftigtendatenschutz in Betriebsvereinbarungen unter Geltung der DS-GVO [employee data protecftion in works council agreements when applying the GDPR], NZA 2019, 1389(1392).
(14) Wall, Corona-Tracing-App und Mitbestimmung [Covid-19 tracing app and co-determiniation] (

Business smartphones with private use permission

For business smartphones with private use permission, the use of the app - as described above - will be even more difficult, since not only the break times but also the entire leisure time of the employees would be affected. Therefore, the necessity of processing personal data would have to be denied as well. However, the employee can also simply switch off the smartphone in his or her free time or not carry it with him or her, which would counteract the purpose of the app, but is legally permissible. In addition, many of the current leisure activities, restaurant visits or even services with close body contact are subject to documentation requirements, so that a kind of "alarm chain" can be triggered even without using the app.

In practice, it is conceivable that company policies could be introduced under which access to the company premises would only be permitted with an active Covid-19 app under certain given reasons (e.g. a confirmed case of infection or suspicion). If an employee refuses to use the app, he or she must perform his or her work in the home office or, if necessary, be released on full pay in the absence of home office regulations. The DSK ( and the BfDI [Federal Data Protection Commissioner] ( emphasise in their statements on the German Covid-19 Warning App that its use is voluntary and reject the right of third parties to inspect it.

The Covid-19 Warnign App can only generate effective added value if extensive data is collected. This inevitably includes the private sphere, as this is where anonymous contact is most likely to occur, whereas in the professional environment, the chain of contact, whether through duty rosters or other documentation, can be better traced. Voluntary use of the app on business smartphones must be measured against the standards of consent in the employment relationship according to Sect. 26 para. 2 BDSG.