COVID19 and Personal Data Protection

Executive Summary

 Argentine law categorizes personal health data as sensitive data and submits its treatment to rigorous protection. Its collection and subsequent use must be carried out with special care, respecting data owner´s privacy in accordance with Law 25,326 on Personal Data Protection (LPDP).

As a general rule, the disclosure of the name and health data of a COVID19 patient requires its prior, express and informed consent.

Exceptionally, health authorities and, to a lesser extent, private parties (eg employers) can collect and process health data from specific people as long as it is strictly necessary to comply with legal obligations.

In compliance with the requirements of the law, non-sensitive personal data that is relevant for the management of the COVID19 pandemic may also be processed, such as information on trips from or with contact with declared affected areas within the last 14 days, that allows identifying if a person should comply with the mandatory quarantine.

Who can process people’s health data regarding COVID19 and under which conditions?

Health facilities (hospitals, sanatoriums, health centers, biochemical laboratories, etc.) and health professionals (doctors, nurses, biochemists, pharmacists, etc.) can process health data of the patients they serve, exclusively in relation with their medical treatment and always in compliance with professional secrecy. In order to use patient personal information for other purposes than medical treatment, it is required its full, free and informed consent.

The branches of the Government can also process health data collected in the exercise of their own functions. The Federal Ministry of Health and Provincial Health Ministries are empowered to request, collect, transfer to each other and process health information without patients´ consent, in accordance with the powers conferred to them by law.

DNU 260/2020 expressly empowers them to require a health status affidavit as a mandatory sanitary control measure for travellers and other people when deemed necessary, even at the time of departure, before or during their arrival in the country and, in general, to adopt any other necessary measure to mitigate the effects of the pandemic generated by COVID19. At the same time, it obliges those who have access to this information to keep confidentiality about the identity of the people affected and to protect professional secrecy.

Finally, personal health data can also be processed when there is a legal obligation to do so.

Health information can be transferred without the patience´s consent when necessary for reasons of public health, emergency or to carry out epidemiological studies, as long as the patient’s identity is preserved through appropriate dissociative mechanisms.

In this sense, article 7 of DNU 260/2020 obliges people who meet the conditions listed below to remain isolated in their place of residence for 14 days (“compulsory quarantine”) and all public officials, health workers, personnel in charge of schools and authorities in general who become aware of breaches of said isolation, to file a criminal complaint to investigate the possible commission of the crimes provided for in Articles 205 (infringement of measures adopted to prevent the spread of an epidemic), 239 (contempt of court) and concordants of the Criminal Code:

19. “suspected cases” who are those who have fever and one or more respiratory symptoms (cough, sore throat or respiratory distress) and in the last days, have a history of travel to “affected areas” or have been in contact with confirmed or probable cases of COVID-19.
20. people with medical confirmation of infection with COVID – 19.
21. “close contacts” of the persons indicated in a) and b).
22. people who arrive in the country having circulated through “affected areas”, who must also provide information on their itinerary, declare their domicile in the country and undergo a medical examination as less invasive as possible to determine the potential risk of infection and the preventive actions to be adopted that must be complied, without exception.

The DNU empowers the Ministry of Health to monitor the evolution of sick people and those who have been in contact with them, and requires people who have symptoms compatible with COVID-19 to immediately report them to health providers.

By virtue of this regulation and of those issued by the Ministry of Health from now on, exceptions are enabled, which must be interpreted in a restrictive manner, that expand the universe of people obliged to treat health data of third parties.

Can employers request information from its employees or other visitors to the workspace about whether they have symptoms of the disease as a measure to prevent the spread of Covid-19? Can they be required to give information about the health of people with whom they have close relations? Is it legal to take the temperature before entering the workplace?

Yes, limited exclusively to the fulfilment of its legal obligations and making sure not to incur in acts of discrimination and to dispense a due dignity treatment to the employees.

 In this sense, Resolution MTSS 202/2020 obliges workers included in any of the cases of compulsory quarantine to inform their employer about it, within 48 hours, in a reliable and detailed manner.

The regulation also obliges employers and workers to facilitate and comply with the general preventive actions and the follow-up on the evolution of sick people or in contact with them and to report to the Ministry of Health any situation that falls within the definition of suspected cases and close contacts with suspected cases.

Finally, it forces employers to strengthen security measures in the workplace and to comply with the protocols set by the health authority to prevent the spread of COVID19. In compliance with this obligation, employers are empowered to request and process their employees and others who attend workplaces´ health information and to take reasonable preventive measures to prevent the spread of the disease, always in the less restrictive possible manner and taking care at all times of the dignity of the people involved.

In this sense, it is recommended that if measures such as the taking of employees´ temperature are implemented, they should be done in a non-invasive way and by health professionals (nurses or doctors) who are under the obligation to keep professional secret, and that the data thus collected be treated exclusively by the company’s HR and management personnel who need to know it in order to comply with the company´s legal duty.

In any case, the processing of the data necessary to comply with the legal duty must be limited to a minimum as possible and for a limited term, as long as it is necessary and useful for the purposes indicated by the law.

Whenever possible, the collection and processing of employees´ health data should be avoided, for example, MTSS Resolution 627/2020 established a special duty of confidentiality that allows medical staff that has to issue certificates to justify the exception to the duty of assistance to the workplace, provided by the DNU 260/2020 for workers included in the “risk groups” (eg with respiratory chronic diseases, diabetes, immunodeficiency, cancer or transplant), to issue it only mentioning that the worker is in a “risk group”, without the need to detail the pathology or condition that affects it.

May employers process recent travel data of their employees?

Yes, with the scope and limits of article 7 of DNU 260/2020.