A German higher-education institution recently introduced a new measure to facilitate Covid-19 contact tracing: next to each door (i.e. entrances to the building, the lecture rooms, the labs and some other places), there is a QR code that must be scanned using an app by a company. The goal is to track who was in a specific room at a specific time. The rule applies to employees, students and visitors.
People who don't have a smartphone, should visit a specific URL on the contractor's website and enter their data manually. People who do not wish to provide these data should not enter the building at all.
The higher-education institution claims that this is all perfectly legal because it conforms to the local Corona Law (i.e. Baden-Wüttemberg's Corona law, in force since 30 September 2020, which is also available in English) and because the contractor's treatment of the data conforms to the GDPR. However, I am not totally convinced that the reference to these two pieces of legislation is sufficient:
- §6 of Baden-Wüttemberg's Corona law allows organisations to collect certain data about attendees, participants etc. but does not state that these persons can be forced to submit their data to a third party (i.e. a contractor to the organisation they are visiting).
- The GDPR is relevant when people willingly submit their data but does not seem to be a legal basis for forcing people to submit data to a third party.
Note that this contractor is not mentioned in employee contracts as a company with which the higher-education institution might share data.
So my question is whether an employer can force employees and students to submit data to a contractor without violating the principle of informational self-determination.