Germany: Processing employee sickness data
Germany was the first EU Member State to adopt a national law implementing the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'), the Federal Data Protection Act of 30 June 2017 (implementing the GDPR) ('BDSG'). Dr. Carlo Piltz, Salary Partner at reuschlaw Legal Consultants, provides an overview of the data protection provisions regarding employee sickness that are found within the GDPR and the BDSG, and explains under which circumstances the processing of this data can be deemed necessary.
Certificate of incapacity for work
In principle, Section 5(1) of the German Continued Remuneration Act stipulates that the employee must send the employer a medical certificate stating their incapacity to work at the latest on the fourth day of their illness. This certificate must contain only the fact that the employee is unable to work and the probable duration of the sickness. The employee does not have to provide further information about the reason or type of the sickness, and therefore the employer may not demand it.
However, in exceptional cases, such as highly infectious diseases, the employee may be obliged under Section 241(2) of the German Civil Code ('BGB') to disclose the medical findings so that protective measures can be taken.
Data protection provisions
According to Section 26(1)(3) of the BDSG, the employer is not entitled to demand information from the employee about the reason and type of the sickness, unless this is exceptionally necessary for carrying out the employment contract. In principle, the employer may process the personal data required for hiring decisions or, after hiring, for carrying out or terminating the employment contract in accordance with Section 26(1) of the BDSG. In this respect, one must be aware, however, that the information about the reason and type of a sickness represent sensitive personal data in the sense of Article 9(1) of the GDPR, for which the processing of follows even stricter requirements that are to be considered. According to Section 26(3) of the BDSG, these data may only be processed, 'if it is necessary to exercise rights or comply with legal obligations derived from labour law, social security and social protection law, and there is no reason to believe that the data subject has an overriding legitimate interest in not processing the data.' In other words, the employer may only process these data if the exercise of rights or a compliance obligation under labour law or social law requires them to do so for employment-related purposes, and if a balance of interests between the rights of the employer and the employee does not favour the employee.
On the one hand, according to the BDSG, this is the reason why the certificate of incapacity for work in Germany does not contain any further information on the cause or type of sickness. On the other hand, this is also the reason why the employer is entitled, in individual cases, to demand further information about the sickness from the employee. Specifically, when the reasons mentioned above require the processing of data within the framework of the employment contract.
A further exception to the principles outlined above is that the employees and the employer conclude a collective agreement, a 'works agreement,' within the meaning of Section 26(1) of the BDSG with the works council. This enables the employer, for example, to keep statistics on which employee is sick how often and when, and these data are contained in the certificate of incapacity for work. These statistics, in principle, are not necessary for carrying out the employment contract.
As a rule, the employee only has to inform the employer if the information about the sickness is necessary for the performance of the work. If, for example, the employee has a dust allergy and works in an environment with a lot of dust, this information is also necessary for the performance of the employment relationship and the employee is obliged to inform the employer.
Further data protection aspects regarding the certificate of incapacity for work
According to the BDSG, even the fact of incapacity to work and the breakdown of sick days on the certificate of incapacity for work are indirect health data, under Articles 4(15) and 9(1) of the GDPR, which means that the stricter requirements of Article 9(2) of the GDPR and Section 26(3) of the BDSG are to be considered.
Dr. Carlo Piltz Salary Partner
reuschlaw Legal Consultants, Berlin