Feeling the heat: data protection considerations for commercial landlords regarding temperature testing

Following the peak of the covid-19 outbreak, commercial landlords may use temperature testing to keep workforces safe as they return to physical workplaces. Herbert Smith Freehills global data privacy head Miriam Everett, UK & EMEA real estate head Jeremy Walden and TMT associate Hannah Brown analyse the data protection implications.

Personal data has been at the forefront of the battle against covid-19, due to the use of contact tracing and symptom tracking among other initiatives to tackle the pandemic. As the UK government looks towards the end of lockdown, companies are also now starting to consider how the use of personal data might assist or impact them, particularly in the context of the return to work. Once again, leveraging available data is likely to be key to help everyone transition back to reality, but it remains important that companies manage the complexities of data protection legislation in doing so.

In our return to the physical world of work and workplace settings, a new data protection dynamic is starting to emerge in the shape of the relationship between commercial landlords or building owners and their tenants. The return to work is a sensitive topic, with the protection of employees and the safety of the workplace being balanced against the desire to restart the economy and get back to normal.

Temperature testing, either in the traditional sense or by using new thermal-imaging camera technology, is being seen as a potential tool to help people get back to work, with a low enough temperature being your ticket back into the office. Given their control over shared reception areas, landlords are exploring the possibility of introducing temperature checks, which raises interesting data protection considerations. While landlords could, in theory, ask tenants to share details of employees with suspected covid-19 following tenant-led testing, by that stage infected individuals will have already entered the building and potentially exposed other people. However, conducting tests at building entry points could potentially limit exposure risks for the benefit of all.

The privacy dynamic

The results of temperature testing of any kind can constitute health data, and is therefore special category data under the GDPR, on the basis that inferences can be made about your health from your temperature. This is, therefore, likely to be new territory for landlords, who may not have processed special category data about building users before – if they processed any personal data about them in the first place.

Any landlord that carries out temperature testing will need to think carefully about the practicalities of doing so in a compliant manner. First of all, transparency: nobody expects to read a long and detailed privacy policy on the way into their office building, so how can landlords practically and efficiently provide the necessary fair processing information?

Additionally, landlords will need to identify an appropriate lawful basis for processing the relevant personal data. The employment basis flagged by the UK Information Commissioner’s Office with respect to temperature testing (article 9(2)(b) GDPR, along with Schedule 1 condition 1 of the Data Protection Act 2018) appears to only be available to employers in the context of their health and safety obligations towards employees, rather than the obligations of landlords or building owners to their tenants. Likewise, reliance on an assessment of the working capacity of the individual seeking to enter the building would be likely to require the test to be done by a representative of the employer (rather than the landlord). The public health ground under the GDPR and Data Protection Act 2018 could presumably be relied on at least in the short-term effort to contain the pandemic, but the test would need to be carried out by an appropriate healthcare professional rather than, for example, security staff at the entrance to the building. Alternatively, landlords would need to rely on consent given by the individuals themselves. But is valid freely given consent realistic, if individuals have no choice but to say yes to testing if they wish to enter their place of work (and potentially get paid)? If landlords are only left with consent-based processing, they will also need to come up with creative solutions to ensure that obtaining consent does not cause long queues to get into the office. Admittedly, while every person seeking to gain access will not be turning up at the same time, once you add social distancing, then a delay for the temperature test, then more time to collect consent, you can start to see how getting people back to work may be easier said than done. And what if someone says no?

The data-sharing consequences

To really assist in the battle against the spread of covid-19, temperature testing is likely to have to result in individuals being denied access to buildings, and landlords will want to notify tenants if their employees are being turned away. But in sharing that information, landlords will be sharing personal data. Again, this could be a novel situation for landlords who might have historically received personal data from tenants but may not have sent personal data the other way – especially not health-related special category data. Data sharing between controllers should always be subject to a written agreement, but many commercial agreements between landlords and tenants may not contemplate this kind of data sharing. Further, in a multi-tenanted environment, this may cause issues for landlords where not all tenants take the same position with respect to temperature testing. The practical consequences of this data sharing for individuals – such as employees not getting paid – will need to be managed delicately between landlords and tenants.

To add to the admin, individuals being tested will need to be informed of such data sharing via some form of privacy notice, even though it is arguably a logical consequence of the testing.

As well as legal implications, data sharing in the context of covid-19 also raises moral questions. Data subjects are allowing more intrusions into their privacy than ever before to try and contain the virus – but once that threat has gone, they may not thank data controllers for continuing to use their data for other purposes. Landlords that have introduced temperature testing will need to be cautious about data minimisation and appropriate deletion policies, as well as maintaining the trust of tenants and others who use their buildings. A key question in this context is perhaps how long temperature testing is likely to continue. Is this a short-term solution to get people back to work, or should we expect temperature testing to become the permanent new normal wherever we go in a post-covid world?

Clearly, more thinking needs to be done on this subject and common practices are likely to emerge as we put theory into practice. It will be interesting to see whether landlords coalesce around a shared approach, or if we see divergence based on capacity, location or other factors.