On 18 June 2020, the Hungarian government declared a “health crisis situation” with the passage of Decree No. 283/2020. According to this decree, Hungary’s data protection authority (NAIH) is revising its former opinions on the personal privacy aspects of temperature measurement in light of the significant increase in COVID-19 infections in Hungary.
NAIH confirms that during the current health crisis brought on by mass infections, organisations (i.e. businesses, associations, institutions) can measure the temperature of individuals if all of the following conditions are met:
- The individual is entering territory, property or buildings owned or used by the organisation;
- Measurement is applied uniformly to all persons wishing to enter (whether the individual is in an employment relationship or otherwise);
- Personal identification of the subject whose body temperature is being measured is not included in the process; and
- Measurement does not in any way involve the recording, further storage or transmission of data.
NAIH emphasises that an elevated body temperature does not specifically mean that the subject is infected with the coronavirus. As a result, the organisation cannot draw any conclusions about the person's state of health based on this temperature measurement. The organisation can only use this information to allow the entry of the individual (because the measured value is lower than a predetermined value) or refuse entry (because the measured value is higher than the predetermined value and thus poses a risk for others).
If the organisation refuses entry to an individual, he/she must deal with this information (i.e. contact a doctor, request sick leave and sick pay administration, inform his/her manager at work, etc.). According to NAIH, identification of the individual is not necessary; the organisation can only collect statistical data (e.g. how many people were not allowed into the building).
NAIH recognises that there may be an exceptional case where someone's body temperature is generally higher than average due to another medical condition or as a result of medication. In this case, the organisation may, in accordance with a pre-established procedure and privacy notice, accept a document issued by the doctor that the relevant person is allowed to enter the community despite having an elevated body temperature.
Organisations who introduced or plan to introduce temperature measurement (e.g. thermometers, thermocameras) must revise their internal procedures and privacy documents (e.g. privacy notices, legitimate interest balancing tests, data protection impact assessments) in line with NAIH’s new guidance.
For more information on this decree and how it could affect your business, contact your regular CMS partner or local CMS experts.