Employer’s right to inform other employees about infection - IPRS

Employer’s right to inform other employees about infection + - Opozorilo: Mnenje je bilo izdano na podlagi določb Zakona o varstvu osebnih podatkov (ZVOP-1, Uradni list RS, št. 94/07 - uradno prečiščeno besedilo), ki je z dnem

2. 2023 prenehal veljati in ga je nadomestil nov Zakon o varstvu osebnih podatkov (ZVOP-2, Uradni list RS, št. 163/22), zato mnenje ni več nujno aktualno. Mnenja po ZVOP-2 so na voljo tukaj. Datum: 15.10.2020 Številka: 07126-1/2020/56 Kategorije:Delovna razmerja, Posebne vrste, Pravne podlage, Pridobivanje OP iz zbirk, Zdravstveni osebni podatki --> Kategorije: Delovna razmerja, Posebne vrste, Pravne podlage, Pridobivanje OP iz zbirk, Zdravstveni osebni podatki The Information Commissioner (Slovenian National Supervisory Body for Personal Data Protection) received your question regarding employer’s right to inform other employees about the situation that a particular employee has been infected by SARS-COV-2: Is it allowed, on the basis of the GDPR, for the employer to inform other employees that one of them has been infected with SARS-COV-2 virus and if so, under what conditions would you allowed to provide such information? As requested, please find below answers to your questions: Slovenian national legislation does not explicitly prescribe when specifically and from whom, an individual could or should obtain personal data on identifiable individuals, e.g. about who the infected individuals are, as the cases and circumstances can be extremely varied. EDPB has already stated that in the employment context, the processing of personal data may be necessary for compliance with a legal obligation to which the employer is subject, such as obligations relating to health and safety at the workplace, or to the public interest, such as the control of diseases and other threats to health. The GDPR also foresees derogations to the prohibition of processing of certain special categories of personal data, such as health data, where it is necessary for reasons of substantial public interest in the area of public health (Art. 9.2.i), on the basis of Union or national law, or where there is the need to protect the vital interests of the data subject (Art.9.2.c), as recital 46 explicitly refers to the control of an epidemic (Statement on the processing of personal data in the context of the COVID-19 outbreak, adopted on 19 March 2020). This means that the competent authorities, in cooperation with the health profession (National institute of public health), must assess on a case-by-case basis and determine what information is needed to protect people's vital interests or in relation to ensuring health and safety at work or on other legal grounds. For concrete instructions on how the employer is obliged to act in the event of an infection by SARS-COV-2 among employees, we suggest that employers contact National institute of public health, which can give precise and clear instructions on further procedures and planned measures. We also emphasise that outside the inspection procedure and in advance, the Information Commissioner cannot judge which specific data may, can or even must be processed in connection with the current situation, only the competent institutions can. Kind regards, Mojca Prelesnik Information Commissioner of the Republic of Slovenia O NAS Informacijski pooblaščenec Dunajska cesta 22 1000 Ljubljana, Slovenija Zemljevid (vir: najdi.si) Telefon: 01 230 97 30 Poštni in varni e-predal: gp.ip(at)ip-rs.si Odgovorna oseba za informacije za medije: dr. Jelena Virant Burnik. Kontakt za medije: Barbara Repovš, mediji@ip-rs.si ali 01 230 97 30 Prijava kršitev (Navodila in obrazci) URADNE URE PON - PET 9.00 - 12.00 POVEZAVE Informacije javnega značaja Priročniki in smernice Obrazci Politika zasebnosti Informacije o obdelavi osebnih podatkov Izjava o dostopnosti Podpora za majhna podjetja Pravice posameznikov Prijava na prejemanje e-novic Informacijski pooblaščenec | 2026