Employee Zero”. How to react to a suspicion of COVID-19 at the office?

The state of the epidemic related to the spread of the SARS-CoV-2 virus, announced in Poland on 20 March 2020, forced a large number of companies to switch to remote work, thus reducing contacts between employees to a minimum.

However, with the easing of restrictions on the economy and social life (the so-called "de-frosting" process), employees are more and more willing to return to their offices. Repeated intensification of interpersonal contacts – both at work and outside of it – translates into an increased risk of an infected person appearing at the workplace. In view of this risk, employers must carefully prepare for the return of employees to the office, as well as develop plans to respond in the event of a COVID-19 infection, while ensuring the legality of the actions taken.

Practical difficulties start at the very beginning. Employees are not obliged to inform their employer about a SARS-CoV-2 infection. There are also no provisions that would exempt employers from the restrictions on the processing of personal data revealing information about health.

Within the meaning of the EU Regulation on personal data protection, commonly referred to as "the GDPR" (General Data Protection Regulation; in PL RODO), the collection of information by an employer on an employee’s health constitutes processing of special categories of personal data. This includes both information about the actual state of health (information that an employee is infected), and about symptoms that may indirectly indicate the possibility of infection (e.g. high temperature, suffocating cough). The GDPR prohibits the collection of sensitive data unless there is an exception provided by law. Thus, the employer must identify a specific legal basis for taking measures such as, for example, surveys with employees about deterioration of health, or recording body temperature measurements as they enter the work premises. In other words, employers should iden tify a specific legal provision that authorizes them to collect and use health-related data for specific purposes. Unfortunately, neither the GDPR nor Polish regulations, including those adopted in connec tion with the epidemic, contain such explicit authorisation.

It has been highlighted that the provisions of the Labour Code on health and safety at work entitle – and even oblige – the employer to take reasonable steps to prevent COVID-19 infection among the crew. However, these regulations are very general, hence this interpreta tion raises doubts as to their compliance with the GDPR. Such a risk was indicated by the President of the Office for Personal Data Protection (the OPDP) in his communications. The President of the OPDP believes that guidelines or a decision of an authorized health inspection authority should be the basis for collecting data on employees' health. From a practical point of view, it is important to note that the above mentioned decisions may also be issued orally, and then confirmed in writing, which will certainly encourage speed of action, especially in "emergency" situations. Nevertheless, the practice of issuing such decisions by individual health and epidemiological stations is not uniform.

Furthermore, it is worth mentioning that obtaining employees' consent to conduct surveys or research is difficult in practice. For such consent to be valid, the Labour Code requires that providing sensitive information (including health- -related information) be always initiated by the employee.

At present 1 , no general standard for dealing with SARS-CoV-2 infection at work has been set. The guidelines issued so far focus on selected sectors of the economy. One of them is guidelines for office workers. Although the binding force of the recommendations published on governmental websites as well as their imprecise provisions raise some doubts, it should be strongly recommended that employers who decide to return employees to the office prepare a return plan and appropriate procedures. The procedures should be aimed both at preventing infections in the workplace, and at establishing a procedure to be followed in the event of an infection. The rules which are worth defining concern in particular health and safety at work in relation to the state of the epidemic. For example, they should specify how to comply with the recommendations for conditions in the workplace in order to maintain

The GDPR prohibits the collection of sensitive data unless there is an exception provided by law. Thus, the employer must identify a specific legal basis for taking measures such as, for example, surveys with employees about deterioration of health, or recording body temperature measurements as they enter the work premises.

distance between employees, e.g. in social rooms or during meetings in the office. A system of rotational work in the office could be considered in order to reduce the number of staff present in the office at the same time. Additional hygiene measures, disinfectants or the availa bility of disinfectants and similar technical issues should also be determined.

Another key element is to define rules of access to the office. Employers have the opportunity to apply various solutions and measures. Some employers limit themselves to instructing staff to stay at home in case of disturbing symptoms. A widely used solution is to introduce informal quarantine by recommending to work from home when the employee has been away from home or there are other circumstances that indicate an increased risk of infection. Other employers decide to introduce more far-reaching measures, including thermal imaging cameras, non-contact thermometers or surveys for those entering the work prem ises. However, when deciding on such more far-reaching security measures, it is important to bear in mind the legal uncertainties indicated above. In any case, their introduction should be preceded by an analysis of the purpose and legality of the adopted solutions.

A critical point in the process of preparing the company for the return of employees to the office should also be to establish rules of conduct in the case of suspected infection at the workplace. While working on an appropriate procedure in this respect, one should skilfully balance the need to protect the health of other employees on the one hand, and on the other hand, the legal requirements for protecting the privacy and dignity of the employee concerned by the suspected infection. However, there is no doubt that in such a situa tion the employer should not remain passive, but has a duty to be proactive. The Ministry of Development provides some detailed guidelines for industrial plants and offices. According to them, if an employee is suspected of being infected, the employer should send him/ her home and disinfect all places visited by the employee. In addition, the employer's representative should immediately contact the competent health inspection unit and inform them of the incident, and then strictly follow the instructions and orders given. If oral instructions are obtained from the authority, efforts should be made to document the actions taken and to obtain written confirmation of the instructions given by the official.

The state of the epidemic introduced in Poland is undoubtedly a huge challenge for employers. Employers should be particularly cautious when taking actions to counteract the spread of COVID-19, and monitor issued regulations and recommendations on an ongoing basis.

Authors:

Counsel, Baker McKenzie Krzyżowski i Wspólnicy sp.k.

Associate, Baker McKenzie Krzyżowski i Wspólnicy sp.k.