The Italian Data Protection Authority (Garante) has just published on its website FAQs on the processing of personal data in the context of the health emergency caused by COVID-19.

The FAQs (which will be regularly updated by the Garante) concern the processing of personal data:

• in the healthcare sector;
• by local authorities;
• in public and private employment relationships;
• in the education sector;
• for clinical trials and medical research.

Some of the FAQs are on the issue of the measurement of body temperature by employers in order to prevent contagion. On this, the Garante recalled the principles of the so-called Shared Protocol of March 14, 2020  ̶ updated on April 24, 2020  ̶  and further stressed that "it is not allowed to record the data of the body temperature but, in compliance with the principle of "minimization" (Article 5, paragraph 1, letter c) of the Regulation cited above [the GDPR]), it is allowed to record only the fact that the threshold established by law is exceeded and only if it is necessary to document the reasons that prevented access to the workplace. Therefore, in the case of a body temperature of customers (for example, in the context of large-scale distribution) or occasional visitors, it is not, in principle, necessary to record the data relating to the reason for the refusal of access even if the temperature exceeds the threshold provided by the emergency laws and regulations".

The Garante also confirmed that it is not possible to disseminate the identification data of people who tested positive for COVID-19 or who are isolated. In fact, "[t]he laws and regulations in force prohibit the dissemination of data relating to health. This prohibition has not been derogated by the emergency laws and regulations on the epidemiological emergency caused by COVID-19". Therefore, health authorities, prefectures, municipalities and any other public or private entity must not spread, through websites or other channels, the names of who have tested positive for COVID-19 or are isolated, in order to fight the spread of the epidemic or "fake news".

Nevertheless, the employer (but not the workers' safety representative) must, according to applicable laws and regulations, communicate the names of the infected employees to the relevant health authorities and collaborate with them on the identification of "close contacts", for the timely adoption of the necessary preventive measures. The relevant health authorities are the only entities in charge of informing the mentioned “close contacts”.

The FAQs have been published together with other articles on the section of the Garante's website dedicated to the ongoing health emergency:

• "Use of location data and contact tracing tools in the context of the COVID-19 emergency";
• "Collection of the main provisions adopted in relation to the state of epidemiological emergency by COVID-19 with implications on the protection of personal data";
• "Coronavirus and data protection: documents and insights”.