This post is part of a series on contact tracing apps. You can read our introduction to the series and get links to the other entries here.
None of the contact tracking systems recently introduced in Russia are designed to be used by employers. The monitoring was implemented by the state with the exclusive aim of ensuring individuals’ compliance with federal and local anti-COVID-19 laws. Should the systems prove that an individual has breached applicable rules, she/he may be subject to administrative fines and/or criminal charges.
Only one of the three tracking systems described below is actually an application that may be installed on a smartphone. However, it may only be used by a person who refused to be taken to a hospital after testing positive for COVID-19.
Moscow’s patient-tracking app
Individuals who have tested positive for COVID-19 and who undergo treatment at home are requested by medical institutions to use a special app. The app may be downloaded onto an individual’s smartphone but may not be used by a person who has not been added to the users’ list. Upon completion of the individual’s treatment, any personal data that has been processed during the treatment is supposed to be destroyed and the individual will not be able to re-use the app.
A debate has emerged about whether the app uses encryption and collects more data than was originally declared.
Digital travel permits
The digital travel permit system is aimed at controlling traffic use by the local inhabitants in Moscow and the Moscow Region. The local population has been requested to stay at home; leaving home without a permitted legal ground is punishable by a fine.
Whether a person is entitled to leave home using a car or public transport is determined when the person applies for the travel permit. If the individual’s employer is not listed as a company that is permitted to continue operations during the high alert regime announced by the Russian authorities in connection with the COVID-19 pandemic, the individual will be refused the work-related travel permit. Most Russian businesses were ordered to stop work from 1 April. If an individual requests a private work permit more than twice a week, he/she will also be refused. When requesting a work-related permit, individuals must submit their personal information and car number plate, and provide a detailed reason for travel and their employer’s name.
The permits are issued as QR codes that can be checked by traffic police. Information about permits is also transferred to the traffic police, who use surveillance cameras (originally designed to identify drivers breaching traffic rules) to track licence plate numbers of cars in the city / Moscow Region. Traffic police officers verify whether a travel permit was received for such cars. Using public transport and taxis also requires a QR code verified by the driver in case of taxis. The fine for travelling without a permit is approximately 70 US dollars.
Federal tracing system
In Russia, there is as yet no system that would allow users to independently verify whether they are in the immediate vicinity of an infected person or an area of infected persons. The government has instructed government offices and mobile operators to develop such an app but it is unlikely that it will be launched in the near future.
Currently, the federal tracing system operates in quite a limited way: the authorities instruct mobile network operators to either remind individuals who must self-isolate that they must comply with this requirement or to monitor their location using GPS and warn them that breaching of self-isolation requirements will lead to penalties.
You can find more details regarding the above apps/systems/permits on our previous blog.
What to do then?
If a company wants to restrict access to its premises by persons who could potentially spread the virus to employees or visitors, it may ask visitors to fill out a questionnaire in which they should answer questions relating to their health and those they have come in to contact with, as well as provide other personal data. Obviously, the company will have to trust the answers as it has no instrument to verify them. If, when compiling the questionnaire, the company asks only those questions that it is obliged to ask under the law (e.g. currently employers must ask their employees certain health-related questions to confirm that they do not have diseases that are grounds for mandatory self-isolation), it will not need to obtain written data processing consents of the individuals concerned. If the questions go beyond the mandatory ones, it will likely be obliged to collect written consents drawn up in accordance with the form established by law.
As the pandemic in Russia started later than in Continental Europe and the US, Russia has only recently begun discussing easing lockdown restrictions; it is still far from the peak of the coronavirus outbreak. In the coming weeks, we expect the legislator to issue instructions for employers on how they should organise work processes after the lockdown is lifted, including what information they may request of employees and visitors to reduce the risk of contracting the virus.
Other posts in this series:
- Round 1: What’s happening?
- Round 2: Legal considerations for companies that want to use contact tracing
- Round 3: Are companies required to use contact tracing?
