Management of coronavirus contagion containment in workplaces

Amidst the current emergency state of spreading Covid-19 virus ("Coronavirus"), many countries are somewhat rushing to find remedies and restrictive measures in many fields of everyday and business life.

In such a context, on 14 march last, the most representative Trade Unions of Italy (Cgil, Cisl, Uil) underwent a new protocol jointly with the Cabinet for the implementation of workplaces' safety measures in contrast to Coronavirus (the "Protocol"). Such has now paved the way to new measures (temperature scanning, self-assessment forms on 14 days' previous Coronavirus at-risk contacts, dealing with on-premises reported suspicious cases) which have their consequences privacy-wise.

Notably, it is pivotal to:

• Minimize the data collected and processed as far as possible, ensure their proper secure storage and erasure following the relevant keeping period;
• Always be respectful of human dignity and individual's rights;
• Not share data with subjects other than those as per the relevant regulations in place (Cabinet Decrees – "DPCM" – of 11 March and Law Decree 14/2020), i.e. those involved in the management of the emergency;
• Check the legal basis of the processing, i.e. data shall be collected solely upon the need to comply with Governmental recommendations for contagion containment;
• Be equipped with a specific data processing notice.
• From an operational perspective, aside from the preventive measures recommended by the Authorities, it is advisable to have personnel and places ready, notably:
• Provide the personnel in charge with dealing with the herein-below 1., 2. and 3. events with protective masks and have them stored also for any individual reporting symptoms;
• Set up (if viable) at least two separate provisional containment places for isolation of on-premises suspect Coronavirus cases/symptoms;
• Provides the workforce (notably, the personnel in charge with dealing with the emergency situations at stake) with updated ant Authority-issued and validated list of Coronavirus symptoms, to allow a better understanding;
• Instruct the workforce and the visitors (either through dedicated hard copy materials and on-premises banners) to self-assess potential risky conditions and to stay put at home in case of potential Coronavirus symptoms and to communicate such a circumstance to the employer;

It is also fundamental to flank the means above with comprehensive guidelines for the personnel in charge for putting them in place and to fairly process the relevant personal data, e.g.:

Scanning of body temperature at workplace entrance

• Equip with the least invasive instruments (infrared portable scanners would fit, in-ear scanners would do provided that contamination risks are cleared – ask to the occupational physician);
• Maintain the privacy notice at the scanning post along with banners advising to voluntary not access workplaces in case of suspect symptoms or contacts;
• Provide people accessing the premises with the privacy notice (Protocol allows oral provision though);
• As to employees, the notice can be provided in hard copy format at the very first access further to the deployment of the containment measures at stake. Then maintain a copy affixed on the organization's notice-board and/or published on the intranet (if viable);
• As to external personnel, notice shall be made and maintained available for each and every access.
• No action is required in case of body temperature under 37.5°C, therefore, the corresponding value shall not be registered;
• In case of temperature over 37.5°C:
• Make a double check;
• Prevent the relevant individual's entrance at the premises;
• Discretely, without any sensationalism or alarmistic behaviour, escort the individual to a separated provisional containment area (it is advisable to opt for a closed area, not too far from the scanning post which provides privacy and enough separation between people therein), provide with a protective mask (better have them stored) and with the specific recommendations to get immediately in touch with the GP;
• Record exclusively the temperature and the name and surname of the individual;
• The data shall be kept no longer than the lasting of the present emergency (when end will be advised by the competent authorities) in a separate storage archive. Following the elapsing of the storage period, ensure proper definitive cancellation;
• Be kind to the individual throughout the whole process, stay calm and safe and remember that this is just a suspect (not an actual) Coronavirus case. Avoid any stigmatization or discrimination, always preserve individual's dignity.

Collection of statement form

• As an advanced measure, advise all movable/unnecessary appointments to wait for the end of the emergency state and allow access solely to the strictly necessary workforce and external personnel to not disrupt business continuity (others shall be smart workers);
• Maintain the privacy notice at the scanning post along with banners advising to voluntary not access workplaces in case of suspect symptoms or contacts;
• Provide the privacy notice attached to the self-assessment form and retain the signed hard-copy. It is advisable:
• As to the employees, to provide the relevant data privacy and to have the self-statement filled in at their very first access. Privacy notice can be maintained affixed on the organization's notice-board and/or published on the intranet (if viable);
• As to external personnel, to provide the relevant data privacy and to have the self-statement filled in before each end every visit;
• Data shall be collected through a specific form at the scanning post before the premises' entrance (or at the premise's reception area, as the case may be), allow enough separation;
• Collection of data shall be minimized as far as possible, in the context of the present emergency it is advisable to focus on individual's risky contacts rather than its travels (as Europe is almost completely undergoing emergency containment measures, so the difference between "safe" and un-safe zones is fading out), therefore following data shall be collected: name, surname, signature, date and reason of access, employer, 14-days previous at-risk contacts (tick a "YES" box in the form): (i) no exposition to actual or very probable Coronavirus cases, (ii) no family contacts with actual or very probable Coronavirus cases, (iii) no previous (self or imposed) quarantine periods.
• No further data shall be collected with respect to any Coronavirus positive contact of the individual. Should such be provided, ensure no collection and prompt erasure;
• In case an individual could not self-assess the "YES" answer to the (i – iii) questions above in the form, prevent the access;
• The data shall be kept no longer than the lasting of the present emergency (when end will be advised by the competent authorities) in a separate storage archive. Following the elapsing of the storage period, ensure proper definitive cancellation.

Individuals at workplace with suspect symptoms

Given the Coronavirus relatively long incubation time (roughly 14 days), it is possible that a person might underestimate or not relate to Coronavirus initial flu-like symptoms. Therefore, that such person (either employee or visitor) within the premises might feel sick and/or report suspect Coronavirus-related symptoms.

To face such an event it is advised that:

• The employees' personnel who receives the report shall immediately defer this to a colleague appointed for managing this kind of emergency and/or to the HR office. If present, liaise with the occupational physician;
• Discretely, without any sensationalism or alarmistic behaviour, escort the individual to a dedicated containment area where separation among individuals is duly ensured (provide with a mask if possible);
• Likewise, isolate other people present or who might have been in close contact with the individual at risk into a proper area (it is advised a different space from the one of confinement of the Individual at risk which in its turn ensures separation among occupants – provide everyone with a mask, if possible);
• Ensure a copy of the privacy notice is available in the provisional containment areas;
• Contact the competent Authorities to report the suspect case. Do not provide any improvised symptoms/background information which could mislead the first diagnosis;
• Be very careful and cautious in any related notice spread to the workforce, do not disclose any personal data (notably, name and surname) of any individual reportedly at risk (no spreading of panic or discrimination);
• Collect and store the data (solely name and surname) of the at-risk individual and the on-premises close contacts to the sole purpose of helping, if required, the Authorities in tracing back the contagion path in case of the individual's ascertained Coronavirus positivity;
• The data shall be kept no longer than the lasting of the present emergency (when end will be advised by the competent authorities) in a separate storage archive;
• Following the elapsing of the storage period, ensure proper definitive cancellation.

These measures shall be flanked by a properly documented training to the workforce appointed for the different tasks, as well as the relevant privacy-wise appointment of in-charge individuals for data processing. Such processing shall be also documented in the relevant register, to ensure further compliance with the GDPR.