As a rule, temperature screening should not be an employer’s only response to the COVID-19 outbreak and employees should be encouraged to work from home to the maximum extent possible. Nevertheless, in view of the latest communications from the Luxembourg government and the planned phasing-in of an end to quarantine, employees will progressively be returning to the workplace.
As employers have an obligation to ensure the health and safety of their employees and the security of their workplace, stakeholders may wonder whether is it permissible to take employees’ temperatures for the purpose of granting or denying access to business premises.
We would like to highlight that this question requires an analysis of the particular facts of each situation. Luxembourg data protection rules and requirements must always be taken into account in so far as the employer will gain access to personal information as a result of the screening (e.g. the employee’s work location, either on-site or from home).
In accordance with the CNPD’s recent recommendations (1), merely reading body temperature taking at the entrance of a site does not qualify as an instance of processing personal data, as long as this reading does not entail, or is not linked to any additional record or processing of personal data.
Similarly, the use of thermal cameras is allowed as long as it does not allow the identification of employees, agents or visitors and is not linked to any recording or re-using of the images.
However, the CNPD considers that this would be different if the employer (i) creates a file containing all the monitored temperatures as well as identification data of the monitored persons, or (ii) could consult the images recorded by the thermal cameras and identify the data subjects. This would indeed be a disproportionate processing of data, which would not comply with the principle of data minimization, insofar as the employer could have implemented less invasive means to protect the employees’ and visitors’ privacy.
Those recommendations follow the French and Belgian data protection authorities’ guidelines (2)(3).
Your contacts for more details: Astrid Wagner (firstname.lastname@example.org) and Faustine Cachera (email@example.com)
(1) CNPD: Coronavirus (covid-19): recommandations de la CNPD relatives à la collecte de données personnelles dans un contexte de crise sanitaire
(2) COVID-19 et le traitement de données à caractère personnel sur le lieu de travail.
(3) Coronavirus (COVID-19) : les rappels de la CNIL sur la collecte de données personnelles par les employeurs