An employer should always exercise caution when processing personal data relating to health conditions. An employer is subject to a confidentiality obligation and cannot disclose information about the health condition of an employee, as per the Sick Pay Act (Sw. Sjuklönelagen). This applies irrespective of the type of illness, whether it is COVID-19, depression, a regular cold or an upset stomach.

When it comes to processing of personal data relating to health conditions, this is generally prohibited, but it may be allowed under the condition that there is an appropriate legal ground for such processing as per Article 9(2) GDPR, such as explicit consent of the data subject or if such processing is necessary for carrying out rights or obligations of a controller or of the data subject in the context of employment, social security and social protection law, or a collective agreement.

Hence, during the ongoing situation with COVID-19, an employer should follow these tips:

  • Processing personal data relating to health conditions of an employee may occur where there is an employment law/social security/social protection right or obligation for e.g. administering sick pay (Sw. sjuklön).
  • Be mindful that valid consent in an employment context is difficult to obtain.
  • If there is a need for informing other employees of a case of illness, try to inform employees or other third parties without processing special categories of personal data, such as by saying that the persons in question are absent, or in other ways avoid disclosure or processing of personal data to third parties. Avoid disclosing the identity of the infected employee.If it is absolutely necessary to disclose the identity of the employee, assess and document which legal obligation forms the basis for the disclosure.
  • If there is a need to document cases or employees in quarantine, that can be done provided that there is a legal ground for that, as identified by the employer. Information about a person being in quarantine does not per se constitute personal data regarding health, as long as no supplemental information is added that may reveal health information or similar circumstances. What may also be documented is the number of people that may have been infected, or the number of people in quarantine.

Lastly, the employer should endeavor to give clear general guidelines on the appropriate conduct during COVID-19 so that employees can exercise caution and know what to do in the event they become infected or suspect that they are infected.

If you want to learn more please contact your Synch contact or send an email to