On March 11, 2020, the World Health Organization declared COVID-19 a pandemic pointing to the large number of cases of the coronavirus illness in over 110 countries and territories around the world and the sustained risk of further global spread.
In Romania, the situation has been declared state of emergency for 30 days by President’s Decree dated March 16, 2020, thus allowing authorities to impose political, economic and public order exceptional measures for limiting the virus spread. The above decree declares state of emergency in Romania for 30 days and will enter into force as of its publication into the Official Gazette.
In this context, legal entities may encounter various legal issues deriving mainly from handling the relationship with their employees in order to protect their health, while also ensuring a good continuation for company’s activity. Amongst such issues, of an immediate application will be the legal aspects related to employment and data protection matters. I. Employment considerations
The Romanian legislation provides several solutions that can be used by employers to reduce the risk of infection with COVID-19 among their employees:
• Setting up individualized work schedules, namely different hours of starting / ending the work schedule, with the approval or at the request of the employee, as per art. 118 of the Labour Code
• Changing the place of work at the employee’s home on a temporary basis by implementing telework or work from domicile
The law defines two categories of work from home: telework which means that the information and communication technology is used into the work carried out away from employer’s premises at least one day per month and work from domicile when the job-related tasks are performed at the employee’s domicile/residence and refers to cases not covered by telework.
As a rule, changing the place of work at the employee’s home in case of both telework or work from domicile must be made with the employee’s consent, by signing an addendum to the employment contract.
By exception, under art. 33 of Annex 1 to the President’s Decree dated March 16, 2020 on setting up the state of emergency in Romania, the employers must implement, where possible, during the state of emergency, work from domicile or work from home, by employer’s unilateral deed. This measure is of direct and immediate applicability.
• Suspension by law of the employment contract in case of quarantine or self-isolation at home
The quarantine/ self-isolation at home is established for a period of 14 days in the context of COVID-19.
The quarantine is a cause of suspension by law of the employment contract, meaning that the employee does not work and is not entitled to receive salary.
According to a recent order of the Health Ministry, people affected by quarantine measure and those who are not allowed to continue their activity due their self-isolation at home in the context of COVID-19 benefit by medical leave and indemnity for quarantine on the basis of certificates issued by the public health authorities.
Although the measure of self-isolation at home is not expressly provided by law as a case of suspension by law of the employment contract, it follows the same legal rule as quarantine in the context of COVID-19.
The indemnity for quarantine/self-isolation at home is of 75% of the average gross monthly income for the last 6 months within the limit of 12 minimum gross salary at national level on a monthly basis and is fully supported by state.
• Suspension by law of the employment contract in case of force majeure
In exceptional cases, assessed on a case by case basis, if the virus spread is qualified as an external, unpredictable, absolutely invincible and inevitable event which does not temporarily allow the continuation of the employment relationship, the employment contract is suspended by law. For example, if the authorities decide to temporary close some activities due to virus spread, the employment contracts of the affected employees are suspended by law for force majeure if they do not have the possibility to work from home.
In this case, the employees are not entitled to receive any wages.
• Unpaid leave for personal reasons
During this period, the employer may agree with its employees to suspend without payment the employment contract for personal reasons.
• Granting additional paid rest leave
The employer may grant additional paid rest leave, based on the addenda to employment contract concluded in such respect.
• Scheduling/rescheduling the existing paid rest leave
The employer and employees may agree to schedule/reschedule the existing paid rest leave in order to be granted in this period.
• Granting paid days off to full-time employees, whereby the overtime performed in the next 12 months will be compensated
The employer must approve by decision the exact paid days off whereby the overtime performed in the next 12 months will be compensated. If the employment contract is terminated and no overtime is performed, the employee must repay to employer the amounts paid for the above days off.
• Suspension of the employment contracts due to the temporary reduction of the activity for economic, technological, structural or other similar reasons
During the suspension period, each employee is entitled to an indemnity which cannot be less than 75% of the base salary.
• Reducing the work schedule from 5 to 4 days per week
If the temporary reduction of activity exceeds 30 business days, the employer may reduce the work schedule from 5 to 4 days per week with the corresponding reduction of the wages.
• Implementing preventive occupational health and safety measures
These measures should be implemented in line with the health and safety legislation and the recommendations of the authorities, including those issued by the Labour Ministry in the context of COVID-19 which include, among others:
determining the activities with high risks of exposing the employees to COVID-19;
identifying the employees who have the technical equipment to work from home;
informing the employees on the procedure of granting the medical leave in case of quarantine and self-isolation at home;
providing the proper hygienic and sanitary materials (masks, gloves etc.);
using e-mails and teleconferences for reducing physical contacts, reducing as much as possible business travels.
• Paid days off for working parents
As per Law no. 19/2020, recently implemented, the employer must allow one parent, the legal representative of the child or any other person assigned to take care of the child to take paid days off in case the schools close due to unfavorable weather conditions or an extreme situation confirmed by the authorities.
Such benefit is offered only to parents whose jobs do not allow telework, if their children are enrolled in the educational system and are under 12 or under 18 in the case of disabled children. During such paid days off, the employees will be entitled to 75% of their salary, but no more than 75% of the average gross salary in Romania, which is paid by employer and born by the state budget.
By President’s Decree on setting up the state of emergency in Romania dated March 16, 2020, all the activities within the educational system are suspended for 30 days. During this period, the provisions of Law no. 19/2020 are fully applicable. II. Data protection implications
Assessing the opportunity and implementing the above-mentioned measures implies the processing of certain categories of personal data, including sensitive data (e.g. data concerning health).
Therefore, although the data processing activities are performed due to exceptional circumstances, which impose all companies to use their best endeavors to contribute in limiting the virus spread, such companies will still be qualified as data controllers in the sense granted by the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“GDPR”) and thus subject to a series of data protection legal obligations.
Although certain data protection authorities in different EU member states have already issued guidance in what regards the processing of certain employees’ personal data in relation to COVID-19 – e.g. countries recently visited or whether the employees or their close persons are experiencing COVID-19 symptoms – the interpretation of such authorities regarding the possibility to perform the processing activities and the steps to be followed in order to ensure data privacy compliance of such activities is not unitary. Moreover, no official guidance in this respect was issued by the Romanian data protection authority as of the date of this article.
Therefore, when performing any personal data processing operations in the context of the COVID-19 pandemic, data controllers must consider the legal requirements generally applicable to the data processing activities, as follows:
• Assessing the necessity and proportionality of the processing
Considering that as of March 16, 2020 the COVID-19 situation has been declared state of emergency in Romania, companies should have no difficulties in providing adequate justification for processing employees’ data concerning health or recent travels. However, if a company would intend to process more extensive categories of personal data, the opportunity of such processing must be duly grounded, in consideration of the data minimization principle.
• Legal ground for processing
Given that any data processing activity performed for the limitation of the COVID-19 virus spread would naturally imply also the processing of health related data, which is a sensitive category of personal data, employers acting as data controllers must ensure the applicability to their processing activity both of a processing ground provided within art. 6 paragraph (1) GDPR and of a ground stated within art. 9 paragraph (2) GDPR.
Depending on the processing purpose and the categories of personal data effectively performed and considering the relationship of employer-employee between the data controllers and the data subjects (which may render invalid a prospective consent of employees for the processing), we deem that companies may rely on their legitimate interest or even on a legal obligation to protect the health and safety of their employees (art. 6 paragraph (1) letters f) and c) GDPR) for performing such processing. Also, art. 6 paragraph 1 let. d) GDPR may be applicable, according to which the processing is necessary in order to protect the vital interests of the data subject or of another individual, which vital interest may consist in the protection against contracting the virus.
In what regards art. 9 GDPR, the processing may be grounded on reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy (art. 9 paragraph (1) let. i) GDPR). However, data controllers may justify also the applicability of other grounds, on a case by case basis.
• Adequate measures for the protection of the personal data and storage period
Given the sensitive character of certain personal data processed in the case at hand, companies must ensure adequate technical and organizational measures for the protection of the data, especially in what regards the access rights. The measures effectively applied depend on the manner in which the processing is performed (i.e. hard copy or by electronic means) as well as by a series of other concrete circumstances of the processing (e.g. data transmission methods, processing activities necessary in consideration of the scope, disclosure obligations etc.).
Also, companies must implement strict retention rules, in consideration of the storage limitation principle and must ensure that adequate deletion/anonymization rules are implemented so that the data will not be stored longer than reasonably necessary for achieving the purpose for which it was collected. A reasonable retention period may be one month after the pandemic will be officially declared ended, except for the cases when data controllers are able to duly justify longer retention periods.
• Transparency in performing the processing activities
Companies must ensure that their employees are clearly and completely informed on the particularities of the processing activities that are intended to be performed in relation to their personal data, prior to the initiation of such processing activities.
Such information obligation may be fulfilled by means of separate information notices for each processing activity to be performed or by means of a single information notice comprising all the data processing activities, considering that the processing purposes will be most likely connected.
• Other obligations
According to the Romanian secondary legislation on data privacy, data controllers must perform a data protection impact assessment when they intend to process on a large-scale personal data concerning health.
Given that a concrete numeric value qualifying a processing as being performed on a “large-scale” was not clearly determined, but certain criteria for determining such qualification has been provided within the applicable doctrine, companies must assess on a case by case basis, based on aspects such as number of data subjects, volume of data processed etc. whether the processing they intend to perform requires a data protection impact assessment or not.
Also, if the legitimate interest will be used as a processing ground, a balancing of interest test will be necessary in order to prove the existence of a legitimate interest for performing the processing and also to determine if the interests and fundamental rights of the data subjects override or not data controller’s interest.
The above considerations are addressing general requirements applicable to the processing of personal data having the same characteristics but performed in normal conditions. Therefore, considering the current exceptional situation in Romania, where a state of emergency has been declared and measures to avoid the virus spread and also to protect the population must be implemented by any company or individual, an official approach of the Romanian Data Protection Authority addressing specific measures and requirements applicable in the consideration of these exceptional circumstances would certainly be welcomed.
Authors: Ileana Lucian, Bogdan Mihai and Maria Dosan