Even in a crisis situation, any data controller should consider
and ensure the lawfulness of the processing of personal data that
it wishes to carry out.
The data controller may only process personal data based on one
of the lawful grounds provided for by the General Data Protection
Regulation ("GDPR" - Article 6) and, in case of sensitive
data (such as health data), if it can rely on one of the exceptions
to the prohibition on processing sensitive data provided for by the
GDPR (Article 9).
Many data controllers, such as employers, wish to collect (e.g.
by means of a questionnaire) personal data of any person accessing
their premises (including employees, visitors, consultants, etc.)
and, in particular, data relating to the dates and destinations of
business and personal trips since the beginning of the epidemic,
any symptoms possibly experienced by the persons concerned or their
relatives (e.g. fever) or other health information.
