This post is part of a series on contact tracing apps. You can read our introduction to the series and get links to the other entries here.
A specific legal framework is being created by the Government
In the context of the fight against the spread of COVID-19, the French government has recently presented a bill to extend the state of the public health emergency up to 10 July 2020. The bill has been adopted by the Parliament and validated, for the most of it, by the Constitutional Council on 11 May 2020. It has entered into force on 13 May 2020.
Further to this law, the Government may process personal data without the consent of the data subjects for the sole purpose and duration of the struggle against the COVID-19 outbreak, with a long stop date set 6 months after the end of the state of the public health emergency. Within this framework, personal data storage will be limited to 3 months.
The processing purpose will be to identify people that are or may be infected and collect their medical information and tests, identify people who have been in contact with them, assess infection risk, and direct the relevant people to medical treatment or quarantine, and provide an overall assistance to the health ministry’s action.
In a nutshell the law permits bringing together multiple data sources and interconnecting them that would not have been possible otherwise and waives the medical secrecy for this definite purpose and time.
Finally, the law clarifies that it does not apply to a tracing app that could be developed and would be offered to the public. In practice, it should only apply to a newly established processing which would be operated by the ministry for health and to the existing “Ameli-Pro” website which is already used by health professionals. It thus remains under the full control of health professionals and does not have a general public arm. In this respect, the Constitutional Council has invalidated, and thus removed from the law, the possibility to access the data by entities which are active in the social support of the infected persons but not directly in the medical struggle against the outbreak.
As to a tracing app that would be available to the general public, the Government happens to be late against its previous announcements, as it had initially announced such “StopCovid” app would be ready by 11 May 2020, i.e., the end of the “full lockdown” regime. The Government does not seem to be following many other European governments in relation to such an app, and seems to be in the process of developing the app on its own. The Minister for health announced on 9 May 2020 that some parts of code would start to be made public on 12 may 2020 in an open source approach.
The law specifically provides that the identification of the infected person cannot be disclosed to the persons who are found to have been in contact with this person.
Restrictions to the use by employers of infection / contact detection tools
Generally, it must be remembered that the French Labour Code requires employers to take the necessary measures to ensure the safety and protect the physical and mental health of their workers (Article L 4121-1 of the French Labour Code).
However, the day the StopCovid app is effectively launched, if it is, employers will not be able to make its use by employees, visitors, and customers mandatory: in its opinion of 24 April 2020, the CNIL made clear that the use of the StopCovid app should be on a voluntary basis only, and that refusing to download the app should not have any negative consequences.
Thus, the fact for employers to make certain rights or access conditional on the use of the application would constitute discrimination according to the CNIL’s opinion. Although the latter is not formally binding on employers (as it was addressed to the Government), the CNIL would most likely take action to enforce it, if needed, on the basis of its usual legal powers. Similarly, employers cannot force their employees to make a test, and no right or access can be made conditional on it.
As a confirmation, on 3 May 2020 the Ministry for labour has issued the national deconfinement protocol for companies on how to ensure the health and safety of employees. The protocol, which lists the technical and organisational measures to be taken to protect employees, does not make any reference to the StopCovid app. This confirms that the app is not intended to be a tool for the employer to use in order to ensure the employees’ safety.
Employers can only put in place social distancing measures and protocols and favour home working where possible. They can also put in place some access control based on, e.g., temperature (although not recommended by the Ministry) or other indicators. A bunch of private initiatives targeting the work world are flourishing in this respect (such as, e.g., building a score of risk on the basis of a questionnaire, ensuring that social distancing is maintained during the working time, etc…). However, all these initiatives will need to comply with a series of strict legal regimes such as the medical secrecy, the prohibition of excessive surveillance of employees under labour law, the need to inform and/or consult with the works council in advance of any surveillance measure and, of course, the GDPR.
Other posts in this series:
- Round 1: What’s happening?
- Round 2: Legal considerations for companies that want to use contact tracing
- Round 3: Are companies required to use contact tracing?
