While the whole world is making an enormous effort to prevent new coronavirus spread, during such crisis privacy is threatened, including the personal data protection.

Identification of the infected citizens, isolation, and monitoring over introduced measures during the state of emergency, on one side, and protection of the human rights, on the other side, is the only legal and legitimate way of government acting during the pandemic.

On the other side, employers are authorized to collect information about their employee’s health and ensure health and safety at work, while protecting personal data in accordance with the law.

 

CONTACT:

 

Commissioner for Information of Public Importance and Personal Data Protection (hereinafter: Commissioner) published the Announcement as of April 1 st , 2020 whereby it gives the guidelines
regarding processing personal data during the state of emergency.

The Commissioner stated that the state of emergency due to prevention of coronavirus spread certainly affect fundamental human rights and freedoms, while freedom of assembly and freedom of movement have already being restricted. However, the right of personal data protection has not been restricted so far and therefore even during the state of emergency personal data protection has to be carried out regularly in accordance with the Law on Personal Data Protection and other regulations governing this matter.” 1

According to the Law on Personal Data Protection, health of the citizens have special treatment because it contains sensitive data. In addition to this, the Commissioner drew special attention that it is unacceptable to disclose the identification or identifying information on individuals when publicly disclosing the information on persons that are infected, except when necessary and under the strict conditions set forth in the Law on Personal Data Protection. 2

PERSONAL DATA PROTECTION IN SERBIA AND OTHER COUNTRIES DURING PANDEMIC

Although in the Republic of Serbia there is no record of the authorities heavily violated the privacy of citizens, it still remains uncertain whether there are some illegal methods being applied to monitor infected or isolated citizens.

Governments all around the world are finding solution in applying modern technologies in order to identify infected citizens. For instance, citizens of Israel are regularly receiving text messages on their mobile phones with an order to self-isolate, because government of Israel determines that one may have come near infected person using mobile phone locations to retrace the movement of citizens. In some Asia countries technologies are being developed that can easily identify who wears and who does not wear the masks, while others use the GPS location history from mobile phones to determine the countries citizens have visited recently. 3

Some countries went even further, such as Montenegro which announced the list of citizens’ personal data who traveled back to Montenegro and has been self-isolated. When giving explanation on this move, the Government of Montenegro stated it faces difficulties to monitor citizens in self- isolation and that this was the most efficient way to inform citizens of those who are isolated and who may be infected by new coronavirus.

The Government of the Serbia confirmed that it tracked location of mobile phone of citizens who are ordered a self-isolation in order to monitor if they comply with such measures. Although during the state of emergency it is possible, to the extent necessary, to restrict the right of personal data protection, none of these restrictions have been introduced in Serbia and therefore the general rules for personal data protection still apply fully.

Even though all the measures introduced during the state of emergency may be proven as effective in preventing the infection spread, the question is whether those measures are truly justified from the perspective of balance between public and personal interest. At least procedure for their implementation must be followed, having in mind these measures derogate fundamental human
rights.

Considering competent authorities in the Republic of Serbia did not enact any legal acts that would restrict the constitutional right of personal data protection, it remains to wait for new announcements in the coming period, both by the Commissioner and by the representatives of the Council of Europe and other European countries.

COMPANIES HANDLING OF EMPLOYEES’ HEALTH DATA

The Commissioner’s announcement contains some information on how to handle employees’ health data by the employers. It is emphasized that processing of employees’ data on health condition should only be carried out to the extent necessary to comply with the regulations of the competent authorities related to the pandemic and with full respect for the data processing principles of the Law on Personal Data Protection. Announcement also contains instructions for employers who have organized work from home, to provide secure connection and correspondence through official
emails. 4

 

CONTACT:

 

Thus, the Law on Personal Data Protection is applied fully and data on health are treated in accordance with this law. However, the Commissioner’s announcement does not provide employers
with instructions on what data concerning the health conditions of employees can they process, and therefore it remains to the employers to interpret the regulations and legally handle personal data. We believe it would primarily be information related to whether the employee has been in contact with the infected person, whether he or she has traveled to the countries which are considered as center of pandemic and whether the employee has been infected.

On the other hand, it is uncertain whether the employer is allowed to ask employees, for instance, to provide the information whether he or she have any symptoms of the virus on a daily basis or is it allowed to measure the body temperature of the employees every time they enter the premises.

PERSONAL DATA PROTECTION RIGHTS

Considering that the application of the Law on Personal Data Protection is not suspended yet, nor the constitutional right to protect personal data is restricted, citizens have the right to be informed of any of their personal data being processed, as well as to use legal remedies prescribed by the law.

However, taking into account the changed work regime and decreased level of human resources, it is expected that state authorities and companies will not be able to reply to all requests in a timely
manner. Anyway, those handling the personal data are obliged to act upon the request and notify the applicant on its personal data being processed.

[1.]Announcement from the Commissioner for Information of Public Importance and Personal Data Protection: “Processing of Personal Data during the State of Emergency” as of April 1 st 2020 published on the website of the Commissioner for Information of Public Importance and Personal Data Protection: https://www.poverenik.rs/sr-yu/saopstenja/3293-обрада-података-о личности-за-време-ванредног-стања.html
[2.] Ibid.
[3.] “COVID-19 Privacy Update, Privacy in the Time of Corona”, as of March 2020 published on the website Karanovic/Partners: https://www.karanovicpartners.com/news/privacy-in-the-time-of-corona/
[4.]Announcement from the Commissioner for Information of Public Importance and Personal Data Protection: “Processing of Personal Data during a State of Emergency” as of April 1 st 2020 published on the website of the Commissioner for Information of Public Importance and Personal Data Protection: https://www.poverenik.rs/sr-yu/saopstenja/3293-обрада-података-о-личности-за-време-ванредног-стања.html