2

A German higher-education institution recently introduced a new measure to facilitate Covid-19 contact tracing: next to each door (i.e. entrances to the building, the lecture rooms, the labs and some other places), there is a QR code that must be scanned using an app by a company. The goal is to track who was in a specific room at a specific time. The rule applies to employees, students and visitors.

People who don't have a smartphone, should visit a specific URL on the contractor's website and enter their data manually. People who do not wish to provide these data should not enter the building at all.

The higher-education institution claims that this is all perfectly legal because it conforms to the local Corona Law (i.e. Baden-Wüttemberg's Corona law, in force since 30 September 2020, which is also available in English) and because the contractor's treatment of the data conforms to the GDPR. However, I am not totally convinced that the reference to these two pieces of legislation is sufficient:

  • §6 of Baden-Wüttemberg's Corona law allows organisations to collect certain data about attendees, participants etc. but does not state that these persons can be forced to submit their data to a third party (i.e. a contractor to the organisation they are visiting).
  • The GDPR is relevant when people willingly submit their data but does not seem to be a legal basis for forcing people to submit data to a third party.

Note that this contractor is not mentioned in employee contracts as a company with which the higher-education institution might share data.

So my question is whether an employer can force employees and students to submit data to a contractor without violating the principle of informational self-determination.

Improve this question
6
  • It will not be sufficient that the contractor merely follows the GDPR; but the institution can contract the contractor to process the institution's data, the point being that the data does not "belong" to the contractor but rather to the institution. The right contracts must be on file to make that happen.
    – o.m.
    Oct 6, 2020 at 17:15
  • @o.m. In this case, the institution is not providing the contractor with data that the institution owns. It wants employees etc. to provide personal data directly to that contractor.
    – Tsundoku
    Oct 6, 2020 at 18:07
  • 1
    As I understand it legally the institution collects employee data and uses a contractor to provide the systems -- if that is what the contract with the contractor says. Collecting data doesn't mean an employee has to do the data entry.
    – o.m.
    Oct 6, 2020 at 19:00
  • 1
    This topic is similar to Working time measurement done through 3rd parties. EuGH-Urteil zur Arbeitszeiterfassung und Datenschutzfragen | Compliance | Haufe. The 3rd party must conform to the gdpr rules (DSGVO Artikel 28, § 62 BDSG).
    – Mark Johnson
    Oct 6, 2020 at 19:24
  • 1
    @Tsundoku, you explained who is actually doing the collection, but that is not the same as who is legally controlling it.
    – o.m.
    Oct 7, 2020 at 5:27

2 Answers 2

Reset to default
4

The university has a legal obligation to collect certain data from attendees, including employees an visitors. It has decided to keep these records in digital form, and offers a smartphone app as a convenience.

The university has outsourced the data processing activity to a third party. This is perfectly legal under the GDPR, if that third party is contractually bound to only process the data as instructed, and not for their own purposes. Whereas the university acts as a data controller (Verantwortlicher), the third party would be a data processor (Auftragsverarbeiter).

I have some doubts though whether an app or a website is indeed the solution that offers the best data protection, especially taking into account the GDPR's data minimization principle. Requiring updates when entering or leaving any room is potentially excessive. Given the sensitivity of the data, the university should have performed a data protection impact assessment to weigh the consequences of this measure. At least for employees, the measure would likely have to be approved by the union (Personalrat) as well.

Improve this answer
2
  • I don't see how it is excessive to collect data on entering and leaving a room, when you should collect the data on the "Zeitraum der Anwesenheit".
    – K-HB
    Oct 6, 2020 at 20:40
  • 1
    @K-HB I think this would depend on how granular this is done and for which rooms. A lecture hall? No problem. But do I have to log my movements each time I leave the lab to go to the toilet? That's none of the university's business, especially if there are no students in the lab.
    – amon
    Oct 6, 2020 at 20:59
1

You misinterpret §6: It states "Zum zweck X dürfen erboben werden" - "is allowed to take data for reason X". This does alter other law that otherwise would preclude taking these data. The more relevant sentence is the first one, which defines the reason X as data that is required by this ordinance. And the ordinance does in fact demand that this at is gathered, and then stored for 4 weeks under §6 for all the groups that are listed in §14.

Not providing the data means that the company that is obligated to gather the §6 data under §14 may not provide service.

GDPR does not apply, as the submission is not voluntary and bound to the rules of the §6 only. Use for anything BUT the §6 is forbidden.

Improve this answer
1
  • The law allows the employer to gather these data. We already agree on that. However, I don't see anything in the law that allows the employer to require employees and students to turn over their data to an external company. Your answer does not show that this is allowed.
    – Tsundoku
    Oct 6, 2020 at 19:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .