The legality of temperature-taking by shops, work center and other establishments in order to prevent contagious diseases spreading

People temperature taking in order to determine the possibility that they may access work centers, shops, educational centers or other types of establishments or equipment represents a veritable data processing.

Moreover, temperature taking involves the processing of sensitive personal data given that this action is based on an interference with the rights of affected persons.

The sensitivity of personal data is not only given by the fact that the value of body temperature represents, in itself, personal data related to a person’s health, but also by the fact that temperature measurement usually takes place in public spaces.

In case of an access denial to an educational center, shopping center or work center, personal data regarding the state of health (a high temperature caused by an illness) will be disclosed to persons who do not present any justification to know this data or to be disclosed to them.

The application of this measure and the corresponding data processing would require the prior determination made by the competent health authority , which may be the Ministry of Health, the Public Health Directorate or the National Center for Special Emergency Situations, of its need and adequacy to the objective of effectively contributing to preventing the spread of the disease in the areas in which they are applied, regulating the limits and specific guarantees for the measure of the personal data of those affected.

In applying this measure it is advisable to perform a usefulness and proportionality test, given that a high body temperature is not always caused by infection with a contagious disease, and the consequences of a possible denial of access can have a significant impact on the affected person.

Like all data processing, the collection of temperature data must be governed by the principles established in the General Data Protection Regulation (GDPR) and, among them, the principle of legality. This measure must be based on a legitimate cause of those provided in the data protection legislation for the special categories of data (articles 6 par. (1) and article 9 par. (2) of the GDPR).

In the case of checking body temperature as a preventive measure of the expansion of contagious diseases this legal basis may not, in general, be the consent of the interested parties. Affected people cannot refuse to submit to measure the temperature without losing, at the same time, the possibility of entering work, educational or commercial centers, or the means of transport to which they are interested in accessing. Therefore, such consent would not be free, one of the necessary requirements to invoke this legitimating basis. Also, the use of the legitimate interest of those responsible for the measure as a legitimizing basis would be excluded in any case.

In the workplace the possible legal basis could be found in the obligation of employers to guarantee the safety and health of the workers at their service in work-related aspects.

If it is determined that a less intrusive method cannot be used to prevent the spread of a contagious disease, it should be noted that the data can only be obtained for the specific purpose of detecting possible infected persons and preventing their access to a certain place and their contact within it with other people and should not be used for any other purpose.

In any case, those affected continue to maintain their rights in accordance with the GDPR and the other guarantees established by the Regulation continue to apply, although adapted to the specific conditions and circumstances of this type of measure