Privacy aspects of Covid-19 in Russia

The Covid-19 pandemic has created new legal challenges for many businesses worldwide. However, certain aspects of privacy law still have to be complied with, despite the difficult situation in the market. This poses additional challenges to businesses struggling in the new, rapidly changing environment. Recently, the Russian data protection authority (Roskomnadzor) clarified how employers could monitor the health status of their employees in compliance with Russian privacy law.

Due to the spread of Covid-19, employers are obliged to measure the body temperature of their employees in order to detect sick employees and therefore limit their access to work. From a privacy law angle, body temperature counts as health data, which in turn is considered a special category of personal data (sensitive data). Collection of such personal data can only be done subject to the handwritten consent of the relevant employee, or if otherwise allowed by employment legislation. The Russian Labour Code states that employers may not collect health data from their employees unless such data is necessary for deciding whether an employee can perform their job. In that case, no consent is required.

Furthermore, Roskomnadzor clarified the situation with respect to measuring the body temperature of company visitors who are not employed by the company they are visiting. In such cases, consent to the collection of health data is given by implied conduct (i.e. the intention to visit the company). No consent would be necessary in that case either. However, the company measuring visitors’ body temperature would have to provide a proper notice to the visitors that their body temperature will be monitored if they visit the company.

Finally, Roskomnadzor emphasised that the body temperature data collected must be deleted within one day, since the purpose of processing has been achieved.