Employers have been obliged to adopt several new implementations for their employees because of the precautions of the coronavirus outbreak. After receiving questions from our clients, we think that it will be useful to clarify and remind the obligations within the scope of protection of personal data and the secondary legislation, employers' obligations to inform their employees and taking their explicit consent especially for their health data to process are continuing. That is, in the event of epidemics, it is not possible to say that the personal data can be processed indefinitely on grounds of public interest or public health considering the scope of protection of personal data.
According to Article 10 of the Law, the data managers are obliged to provide information to the personal data holder before the acquisition of personal data or at the latest, at the time of the acquisition of personal data relating to each data processing activity. Data of health is deemed of a special quality as per Article 6 and processing them are subject to explicit concern. It does not mean that the obligations which are stated in protection of personal data are suspended because of the extraordinary situation of this outbreak.
For example, within the scope of the "Curfew Circular for those aged 65 and over with Chronic Illness" issued by the Ministry of Interior on 21.03.2020, the employer will be able to request a health report to identify their employees with chronic illnesses and to implement the necessary measures. Employers have the obligation to inform while they are requesting this information and report, as a data manager according to Article 10.
In this manner, to prevent the epidemic, employers must first fulfill their obligation to provide information to their employees to question their health and to process their health data, and to obtain the explicit consent from their employees to process them. The processing of personal data of employees who do not give explicit consent is contrary to protection of personal data and may cause the employer to have imposition of administrative sanctions.
The exception of the restriction that the employer cannot process health data without the employee's explicit consent is regulated under the Article 6/3 " ...Personal data relating to health and sexual life may only be processed, without seeking explicit consent of the data subject, by any persons or authorized public institutions and organizations that have confidentiality obligations for the protection of public health, operation of preventive medicine, medical diagnosis, treatment and nursing services" Within the scope of this article the doctors, including those are working in a company, nurses and medical personnel are the persons who can be deemed as an example.
Accordingly, in case of processing health data of employees by the company doctor, the employer's obligation to inform will continue, but the obligation to obtain explicit consent will be suspended. Further, another important point is to store the health data in a secure room that is not accessible to anyone other than the company doctor, including the employer; otherwise, the employer must get explicit consent from their employees.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
