Epidemiological Investigations and Privacy Protection

Israel’s Privacy Protection Authority published its guidelines and emphases for protecting the privacy of individuals when conducting COVID-19 epidemiological investigations in workplaces.

In light of the complexity of the issues relating to protection of employees’ privacy, specific guidelines for conducting epidemiological investigations in workplaces were defined:

Training and supervision of investigators

If epidemiological investigations are conducted by an organization’s own personnel (and not by the Ministry of Health), employers are required to provide training to their own investigators on privacy protection matters. Employers should also regularly monitor investigators’ conduct as it pertains to the safeguarding of personal information and the privacy of questioned employees.

Obtaining employees’ consent to participate in an investigation and disclose information

• Employees are not obligated to disclose personal information to the investigator. Information is to be disclosed solely with the employee’s consent.
• At the outset, the investigator is required to inform the employee that the Ministry of Health is not conducting the investigation and that the employee does not have to participate in the investigation. The investigator is also required to provide the employee with all relevant information so that he or she can decide whether or not to participate in the investigation.
• It is recommended to obtain the employee’s consent to participate in the investigation in writing.

Information collection

• In a workplace, an employer may not ask for or collect information about an employee’s contacts with people who are not coworkers in the same workplace.
• Workplace investigators may not collect information irrelevant to contact tracing and severing the chain of infection, and they may not use the collected information for other purposes.
• Employers may use footage from security cameras in common areas in the workplace to supplement information gaps during their epidemiological investigations. However, this must be done sparingly and to a reasonable extent, and only to maintain the organization’s functional continuity. Employers must inform their employees in advance that footage from security cameras may be used for epidemiological investigations.
• Workplace investigators must refrain from using technological means that may expose employees’ personal information (such as electronic calendars or mobile location data from phones owned by the employer), unless the employees voluntarily used these means as part of the investigation.

Storing collected information

• Information must be stored in conformity with the provisions of the Privacy Protection Law and the Privacy Protection Regulations regarding databases, particularly with regard to information security.
• Access to the information collected is granted solely to authorized personnel and solely for the purpose of performing a role or conducting an epidemiological investigation.
• Employers are required to delete the information they collected at the end of its use, unless there is a practical reason for continuing to retain it. Information must be saved anonymously, to the extent possible, and employers should regularly review the necessity of continuing to retain it (preferably every seven days).
• Anyone exposed to personal information during or as a result of an epidemiological investigation must safeguard the confidentiality of the information and may disclose such information to another person solely for the purposes of tracing contacts with a confirmed patient and severing the chain of infection.
• If personal information is forwarded to another authorized party via the internet, such information must be transmitted using secured systems. (i.e., not through Gmail or WhatsApp).
• Questioned employees may review the information collected about them and demand corrections of incorrect or outdated information. This right also applies to other people not questioned, if information was collected about them during an epidemiological investigation.

***

Our Employment Department is at your service if you need any advice or guidance in this regard.