COVID-19 (“new coronavirus”) disease, declared as a global pandemic with the decision of World Health Organization, continues to spread quickly throughout the world and affect the daily lives of people, commercial and economic relations, social life and all activities seriously, and critical measures are implemented by all governments accordingly. Within this scope, identification of COVID-19-infected patients or carriers, who are under risk, and implementation of quarantine measures are of vital importance. At this point, there are some doubts about the means and methods for the processing and sharing of health data, which are under superior protection as per personal data protection legislation.
As known, personal data of special nature are defined as follows in Article 6 subclause 1 of Personal Data Protection Law no. 6698. “Personal data relating to the race, ethnic origin, political opinion, philosophical belief, religion, sect or other belief, clothing, membership to associations, foundations or trade unions, HEALTH, sexual life, convictions and security measures, and the biometric and genetic data are deemed to be personal data of special nature.”
As per the relevant provision, there is no doubt that health data of persons are personal data of special nature. Information obtained for diagnosis and treatment -such as high fever, respiratory insufficiency and cough- in consequence of COVID-19- related examinations are personal data of special nature because they are health data. In addition, information related to travels, location and places of people are personal data within the scope of Law no. 6698.
In the light of this information; although Personal Data Protection Board have not still made any declarations about the consequences of employers’ sharing the relevant data of their employees -especially health data and travel information- with competent authorities in terms of Personal Data Protection Law and related legislation, it is possible to make the following assessments on this issue:
First of all, as per Law no. 6698, personal data of special nature relating to health and sexual life may only be processed, without seeking explicit consent of the data subject, by any person or authorized public institutions and organizations that have confidentiality obligation, for the purposes of protection of public health, operation of preventive medicine, medical diagnosis, treatment and nursing services, planning and management of health-care services as well as their financing. Therefore, it is possible that health data of persons are processed by healthcare personnel such as doctors and nurses without the express consent of the person, for the purposes of protecting public health. However, it is understood that employers cannot be considered a part of this exclusion, and the health data of persons can be processed by employers only with the express consent of persons as per provision 6/II of the Law.
However, the issue should be assessed considering that the right to request protection of personal data is fundamental under the right of privacy, and is subject to the restriction of fundamental rights and freedoms pursuant to the Constitution. Within this scope, as per Article 13 of the Constitution, fundamental rights and freedoms can only be restricted only due to the reasons specified in the relevant articles of the Constitution, and only by law, without interfering with their essence. As per Article 20 setting out the fundamental right of privacy, it is possible to restrict the abovementioned right by law in cases requiring protection of general health. Indeed, Article 61 of Public Health Law no. 1593 sets out an obligation to inform competent authorities in the presence of one of the diseases listed in the Law due to the performance of their duties, including employers. Although the Regulation on Communicable Diseases Surveillance and Control Principles referenced by law covers the former type of coronavirus but COVID-19 (new type of coronavirus) is not added to the list yet, employers are also obliged to inform competent authorities on suspected cases of communicable diseases as per Article 9 of the abovementioned Regulation.
Finally, based on the right to life regulated in the Constitution and related legal regulations, it is thought that employers’ sharing symptoms, which are present in their employees and may constitute a risk in terms of COVID-19 case, with healthcare authorities will be considered within the scope of relevant regulations. At this point, it should be noted that the obligation to comply with the principles of being relevant, limited and proportionate when processing personal data as stipulated in Law no. 6698 prevails. Indeed, the obligation to take necessary and adequate administrative and technical measures when processing personal data of special nature also prevail for employers.
We kindly submit for your information.