Foreword
The epidemic situation has gone far beyond our expectations. However, we are now at the next stage, whereby people are back to work. At present, we are noticing that in order to ensure the epidemic’s control and the safety of citizens, different institutions and channels are using various methods to collect, process and analyze personal 优德88中国官方网站. The question of how to collect personal 优德88中国官方网站 in full compliance with the rights of personal 优德88中国官方网站 subjects, as well as effectively preventing and controlling the spread of the epidemic is a big challenge. It is also a difficult topic, which may not have been addressed in previous legal studies. How enterprises will deal with the challenges raised by remote work during the epidemic is also another relevant issue.
In the following days, we will try to share with you some of our thoughts on the questions related to the collection and processing of personal 优德88中国官方网站 in the epidemic’s prevention and control, based on our understanding and experience in the relevant field of law. We will provide answers to the relevant issues, alongside some relatively short articles.
In this article, based on the specific requirements of the current laws and regulations on the protection of personal 优德88中国官方网站 and from the perspective of a general enterprise, we will address some practical issues relating to the collection and processing of the personal 优德88中国官方网站 of returned employees in a Q&A manner. Due to space limitations, we have not carried out a detailed legal analysis or theoretical discussion, but we have strived to provide the overall ideas and principles for enterprises.
I.What is the legal basis for enterprises to collect employees’ 优德88中国官方网站？
Article 12 of the Law on the Prevention and Treatment of Infectious Diseases stipulates that all entities and individuals within the territory of the People's Republic of China shall accept the preventive and control measures taken by disease prevention and control institutions and medical agencies with respect to the investigation, inspection, sample collection and quarantined treatment of infectious diseases, and they must provide truthful 优德88中国官方网站 relating to such diseases. Disease prevention and control institutions and medical agencies shall not divulge any 优德88中国官方网站 or material relating to personal privacy; Article 21 of the Public Health Emergencies Regulations stipulates that no entity or individual may conceal, postpone the reporting of, misreport or instruct others to conceal, or postpone the reporting of, or misreport, an emergency.
It can be seen that in an epidemic situation, enterprises and individuals have a legal obligation to participate in epidemic prevention and control and truthfully provide relevant 优德88中国官方网站. Therefore, in case of a request by the competent authorities, enterprises need to collect the relevant 优德88中国官方网站 of employees and report to the disease control department and other relevant authorities in a timely manner.
II.Is the consent of employees returning to work required for the collection of their personal 优德88中国官方网站?
The Cybersecurity Law requires that the purpose, method, and scope of personal 优德88中国官方网站 to be collected should be clearly notified to the personal 优德88中国官方网站 subject, and the collection of personal 优德88中国官方网站 is allowed only after obtaining consent from the personal 优德88中国官方网站 subject’1. In addition, according to the “Notice on Better Protecting Personal 优德88中国官方网站 and Utilizing Big Data to Support Joint Prevention and Control Work” (“Notice”) issued by the China Cybersecurity Administration on February 4, 20202, without the consent of the employees returning to work, the enterprise shall not arbitrarily collect their personal 优德88中国官方网站 on the grounds of epidemic prevention and control and disease prevention.
In summary, we recommend that, when an enterprise needs to collect its employees’ personal 优德88中国官方网站 related to the epidemic for the purpose of epidemic prevention and control and the protection of the health of all employees, such an enterprise should follow the principle of informed consent, clearly inform its employees of the purpose, method and scope of the collection of their personal 优德88中国官方网站, and only collect their personal 优德88中国官方网站 after obtaining their consent.
III.What personal 优德88中国官方网站 is appropriate to be collected?
According to the provisions of the Cybersecurity Law, the collection of personal 优德88中国官方网站 should follow the principles of legitimacy, justification, and necessity3. In addition, the Notice once again emphasizes that the collection of personal 优德88中国官方网站 during the epidemic outbreak should follow the "minimum scope principle". Therefore, even if the current situation of epidemic prevention and control is still severe, it is still advisable that enterprises pay attention to assessing the necessity of the collection methods and scope, and collect personal 优德88中国官方网站 of the returned employee in a minimum scope that is closely related to the prevention and control of the epidemic, protecting the health of returned employees and the orderly production and operation of the enterprise.
For example, considering that the incubation period of COVID-19 is 14 days according to some experts, the collection of 优德88中国官方网站 about the cities that employees have visited in the past 14 days may be necessary for epidemic prevention and control, it is questionable whether requiring employees to provide detailed records of their whereabouts for the past 30 days is necessary. Another example is whether asking employees to provide their recent health status (such as whether they have a fever or a cough, etc.) is necessary under the premise of epidemic prevention and control. Asking employees to provide previous chronic medical history is not directly related to the epidemic prevention and control, and it is thus not advisable for enterprises to collect such 优德88中国官方网站.
In addition, for the convenience of enterprises, based on the specific requirements4under theGuideline on Epidemic Prevention and Control Measures of Enterprises and Institutions to Resume Work and Production(“Guideline on Work-Resumption”) issued by the Joint Prevention and Control Mechanism for Novel Coronavirus Pneumonia of the State Council, we have prepared a brief summary of the types of personal 优德88中国官方网站 of returned employees that general enterprises may consider to collect as follows:
Employees’ identification 优德88中国官方网站, such as their name, ID number;
Employees’ contact 优德88中国官方网站, such as their mobile phone number;
Recent health and physiological 优德88中国官方网站 of employees, such as whether they have had suspected symptoms of the COVID-19 recently, such as, fever, cough or dyspnea, etc., or whether they have ever been diagnosed with COVID-19;
Recent traveling 优德88中国官方网站 of employees, such as 优德88中国官方网站 relating to the transport they took on their way back to work, and their recent residence or travel history in epidemic outbreak areas.
In summary, when enterprises collect the personal 优德88中国官方网站 of returned employees, they shall not only collect such 优德88中国官方网站 to satisfy the needs of epidemic prevention and control, the protection of their employees’ health, and keep track of the health status of employees, but also take into consideration the relevancy and necessity of the collection of the personal 优德88中国官方网站 of returned employees for epidemic prevention and control, and avoid the collection of large quantities of employee’s personal 优德88中国官方网站 in a general manner so as to avoid unnecessary compliance risks.
IV.How shall enterprises report and disclose employees’ personal 优德88中国官方网站 related to the epidemic situation?
According to the requirements of the Law on Prevention and Treatment of Infectious Diseases5 and the Guideline on Work-Resumption6, enterprises should report to the disease prevention and control institutions and medical institutions truthful 优德88中国官方网站 relating to the prevention and control of the epidemic. Therefore, after collecting the personal 优德88中国官方网站 related to the epidemic of their returned employees, the concerned enterprises shall report the relevant 优德88中国官方网站 in a timely manner in accordance with the specific requirements of the disease prevention and control institutions or medical institutions in various areas.
Except to fulfill the reporting obligations provided by the aforementioned laws and regulations, if an enterprise needs to provide or disclose to a third party the personal 优德88中国官方网站 related to the epidemic situation of its returned employees, it must obtain consent from the concerned employees. The Notice emphasizes that even in the special period of epidemic prevention and control, no unit or individual shall disclose personal 优德88中国官方网站 such as name, age, ID number, phone number, home address, etc. without the consent of the personal 优德88中国官方网站 subjects, except when such personal 优德88中国官方网站 is indeed necessary to be disclosed for the purpose of epidemic prevention and control and it has been desensitized before disclosure7. We advise that if the company really needs to provide or disclose such personal 优德88中国官方网站 to other third parties, it should first communicate with their employees and obtain their consent; if employees do not want to publicly disclose their 优德88中国官方网站 but public disclosure of such 优德88中国官方网站 is necessary for the company to prevent and control the epidemic, such 优德88中国官方网站 should be desensitized before public disclosure.
V.How long can the personal 优德88中国官方网站 of returned employees related to the epidemic be stored?
According to the requirements of the National Standard GB/T 35273-2017, the 优德88中国官方网站 Security Technology-Personal 优德88中国官方网站 Security Specification, the storage of personal 优德88中国官方网站 should follow the principle of minimum storage, and the time limit of the storage of personal 优德88中国官方网站 shall be the shortest time needed to achieve the purpose for which the concerned personal 优德88中国官方网站 is collected and processed. After the time limit of storage expires, the relevant personal 优德88中国官方网站 should be deleted or anonymized in a timely manner.
Therefore, we understand that personal 优德88中国官方网站 of returned employees collected by relevant enterprises should be kept within the shortest period of time necessary to fulfill the purpose of epidemic prevention and control. Generally speaking, before the State and local government announces the end of the epidemic prevention and control, it is still necessary for relevant enterprises to properly keep such personal 优德88中国官方网站. After the epidemic prevention and control work is completed, except if it is indeed necessary for some enterprises to extend the storage period and that consent from relevant employees has been obtained, such personal 优德88中国官方网站 should be deleted or anonymized in a timely manner.
VI.Should enterprises cooperate with 优德88中国官方网站 collection conducted by a third party, related to their workplace?
When an enterprise participates in epidemic prevention work, in addition to the requirements by local government to submit the relevant employees’ personal 优德88中国官方网站, enterprises may also face a situation where they are required by a third party, for example, by a property management company, to submit relevant 优德88中国官方网站. We understand that it is advisable for enterprises to deal with such situations in consideration of the following:
1. If the 优德88中国官方网站 requested by a third party does not fall within the scope of personal 优德88中国官方网站, it is advisable for relevant enterprises to cooperate with such a request. For example, employees may be required to take a temperature measurement before entering the office building, but employees may not have to provide their names or other personal 优德88中国官方网站.
2. If the third party requests the provision of personal 优德88中国官方网站, the concerned enterprises shall take into consideration whether the requesting third party is an authorized institution under the Law on the Prevention and Treatment of Infectious Diseases and the Public Health Emergencies Regulations. If the third party is an authorized institution and the type of personal 优德88中国官方网站 required is indeed necessary for epidemic prevention, the concerned enterprises shall cooperate and provide such 优德88中国官方网站.
3. If the third party is not an authorized institution mentioned above, the concerned enterprises may require that the third party provide authorization documents. If the third party is unable to provide such authorization documents, the concerned enterprises shall not provide their employees’ personal 优德88中国官方网站.
4. If the personal 优德88中国官方网站 requested by the third party is apparently irrelevant to the epidemic prevention and control, the concerned enterprises shall refuse to provide the relevant personal 优德88中国官方网站.
1.According to Article 41 of the Cybersecurity Law, network operators shall abide by the "lawful, justifiable and necessary" principles to collect and use personal 优德88中国官方网站 by announcing the rules for collection and use, expressly notifying the purpose, methods and scope of such collection and use, and obtain the consent of the person whose personal 优德88中国官方网站 is to be collected.
2.According to Article 1 of the Notice on Better Protecting Personal 优德88中国官方网站 and Utilizing Big Data to Support Joint Prevention and Control Work, all the local departments should attach great importance to the protection of personal 优德88中国官方网站. Except for institutions authorized by the health department of the State Council, no other unit or individual shall use personal 优德88中国官方网站 on the grounds of epidemic prevention and control and disease prevention without the consent of the personal 优德88中国官方网站 subject. Where the laws and administrative regulations provide otherwise, they shall be followed.
3.According to Article 41 of the Cybersecurity Law, network operators shall abide by the "lawful, justifiable and necessary" principles to collect and use personal 优德88中国官方网站 by announcing the rules for collection and use, expressly notifying the purpose, methods and scope of such collection and use, and obtain the consent of the person whose personal 优德88中国官方网站 is to be collected.
4. According to the Guidelines on Epidemic Prevention and Control Measures of Enterprises and Institutions to Resume Work and Production, (1) make sure employee health management is properly conducted. ...... Each unit should effectively acquire and keep updated of the situation of the flow of employees......
(2) implement health status report mechanisms. ... health status of employees should be gathered every day ...
5.According to Article 12 of the Law on Prevention and Treatment of Infectious Diseases, all units and individuals within the territory of the People's Republic of China shall accept the preventive and control measures taken by disease prevention and control institutions and medical agencies with respect to the investigation, inspection, sample collection and quarantined treatment of infectious diseases, and must provide truthful 优德88中国官方网站 relating to such diseases, and they shall provide truthful 优德88中国官方网站 about the diseases. Disease prevention and control institutions and medical agencies shall not divulge any 优德88中国官方网站 or materials relating to personal privacy.
6.Guideline on Epidemic Prevention and Control Measures of Enterprises and Institutions to Resume Work and Production.
(All units) shall gather health status of their employees daily and report to the local disease prevention and control department. In case of any abnormal conditions, such units shall report such situations and take relevant preventive and control measures in a timely manner.
7.According to Article 3 of the Notice on Better Protecting Personal 优德88中国官方网站 and Utilizing Big Data to Support Joint Prevention and Control Work, personal 优德88中国官方网站 collected for epidemic prevention and control and disease prevention purposes shall not be used for other purposes. No unit or individual may disclose personal 优德88中国官方网站 such as name, age, ID number, phone number, home address, etc. without the consent of the personal 优德88中国官方网站 subjects, except when such personal 优德88中国官方网站 is indeed necessary to be disclosed for the purpose of epidemic prevention and control and has been desensitized before disclosure.
