Employers shall not reveal the identity of employees with COVID-19, questions regarding the employees’ health status when working remotely are not allowed


The employer must notify its employees if one of their colleagues is diagnosed with COVID-19. Yet, the employee’s identity shall not be revealed. Otherwise, the employer will be in breach of the General Data Protection Regulation for unlawfully processing medical information, the Bulgarian Commission on Personal Data Protection (the “CPDP”) argued.

In a recent statement, the CPDP instructs employers that only the affected employee himself/herself may reveal information on his/her health status and share with his/her colleagues that he/she is positive for a coronavirus infection. This must be the employee’s own choice and the employer may not force the revealing of such information.

Therefore, employers have to be rather careful when sharing information with the personnel so that the identity of the employee is not unwillingly revealed. As we know, personal data include the employees’ names but also information on their sex, position, age, etc. So, if in a department there is only one female employee and the notification says that “a female colleague has been diagnosed with COVID-19” in the said department, that would also be unlawful disclosure of personal data. 

It goes without saying that any provision of information about a sick employee has to be made once it is categorically proven that the employee is positive with COVID-19. This is the moment when the medical authorities get involved in the case and begin the search for any individuals, including colleagues, who have been in contact with the infected employee. Therefore, employers must also instruct their personnel that all employees are bound by the obligation not to disclose the identity and any health data for their colleagues.

The CPDP imposes an additional prohibition on employers to ask for the employees’ and their families’ health status when the employees work remotely (home office). The CPDP reasons that employers are only obligated to secure that there are no potentially infected employees on premises but not in the employees’ homes as well. When the employees are socially isolated and work remotely, they do not endanger the health of the other employees.

Certainly, this prohibition needs to be revised when the employer has implemented a mixed work from home – work from the office regime as in those cases the employees may be in contact with one another during some days of the week. If that is the situation, the employer has to implement access control regime and must not allow on premises employees and any third-party individuals who display symptoms of acute contagious diseases. It could be also argued that the employer has a legitimate interest to further limit the access of symptom-free employees where such employees are proven to have been recently in contact with individuals who are diagnosed with COVID-19.

For further information contact:

Ilya Komarevski, partner

Mileslava Bogdanova-Misheva, senior associate