Health data is generally considered very sensitive and requires, in principle, the explicit consent of the data subject. However, in the context of the COVID-19 pandemic, circumstances may occur where an employer may raise the question of the possibility of processing personal data.




The regulatory authorities in the field of personal data protection and the case law in the field, agree that it is allowed to question employees regarding specific and limited situations, such as whether they have been infected or have recently traveled to high-risk areas, or if they had contact with anyone who has been infected with the new virus.


On the contrary, most of the regulatory authorities in the field of personal data protection state that a request to the employee to undergo a body temperature test or a medical examination cannot be carried out, as it would exceed the limits of the legitimate purpose pursued by the employer.




  • the processing is necessary for the purpose of fulfilling the obligations and exercising specific rights of the operator or of the data subject in the employment field, social security and social protection;


  • the processing is necessary for reasons of major public interest;


  • the processing is necessary for purposes related to preventive medicine or work, to the assessment of the employee’s working capacity, to the establishment of medical diagnosis, to the provisions of medical or social care or to medical treatment, or to the management of health or social care systems and services;


  • the processing is necessary for reasons of public interest in the public health field, such as the protection against serious cross-border threats to health or ensuring high standards of quality and safety of healthcare and medicinal products or medical devices.




If the employees inform their employer that they are positive to the testing with the new coronavirus, the employer shall:


  • First of all, announce the authorities and


  • He may also notify interested persons or employees of the risk of being exposed, but without disclosing the name of the infected employee or any personal data that could result in the identification of the latter.





Bucharest 25/03/2020





The Law Firm ”Christian Bogaru” (BCHLAW) is an international law firm, being ranked amongst the 30 most renowned Law Offices in Romania, having an established experience in International Business Law, with internationally trained lawyers that have a vast and sustained experience in different legal fields, essential for starting, developing, operating a business in Romania and in Eastern Europe. The Law Firm ”Christian Bogaru” has strong assets, such as Romanian and Francophone lawyers, proficient speakers in English, with a legal qualification in several European jurisdictions, consolidated legal expertise in several fields of law (corporate law, labor law, mergers and acquisitions, taxes, real estate, transport, criminal business law, GDPR, etc.) assisting and representing foreign and Romanian companies of all sizes and reputations (Multinationals, SMEs, etc.)