COVID-19 – FAQs by Data Protection Commissioner
The Data Protection Commissioner has issued the following guidelines to frequently asked questions relating to the implementation of the restrictive measures under the Quarantine Law Decree (No.28) dated 08/07/2021.
- In relation to my personal data, how is the Health Minister’s Decree dated 8.7.2021, different from the previous Decrees?
According to the previous Decrees, the employer had the right to check the certificates of his employees on a sampling basis. Now, he/she has an obligation to check that all employees hold a Rapid test or a 72-hour PCR certificate or a certificate of recovery from Covid-19 or a vaccination certificate.
In previous Decrees, the owners/directors/managers of certain premises, such as entertainment establishments, dining places, gyms, etc., had no obligation to check their customers’ certificates. Now, they are obliged to check their customers’ certificates and ask them to show their identity card or passport. Exterior spaces of premises serving fewer than 20 people are excluded from this obligation.
- Does the Decree dated 8.7.2021, in relation to the previous ones, violate the legislation on the protection of personal data?
No, it does not. What differs is that this Decree creates additional obligations due to the current epidemiological conditions.
- What is the role of the Commissioner in relation to these Decrees?
The role of the Commissioner is to advise the state on personal data protection issues when drafting legislation, and to ensure that the legislation provisions are in accordance with the General Data Protection Regulation. The Principle of Proportionality requires that the obligations created by a Decree are proportionate to the objective it pursues at that particular time. In the present case, the present epidemiological situation demands and can justify the additional obligations.
- Are these measures legal and proportionate?
Yes, in relation to the current epidemiological situation. But because they are more intrusive than the measures of previous Decrees, the Commissioner, in the context of the legal consultation, has demanded and ensured that in this Decree there is a legal basis for the owner/director/manager of the premise, to be entitled to check one’s certificate and one’s identity card or passport.
- In my workplace, how will the check of my certificate be conducted?
In any case, the employer is responsible for the inspection (paragraph 2.82 of the Decree dated 8.7.2021). In workplaces where there is a Safety and Health Officer under the relevant Legislation, the certificate should be checked by that Officer.
If a business is exempted from the obligation to appoint a Safety and Health Officer and there is no authorised private security guard, the check should be carried out by the employer.
Also, in workplaces, checks may be carried out by the Police and depending on the activity of the business, by authorised officers referred to in paragraph 2.48(c) of the Decree dated 8.7.2021.
In case an employee refuses to show the certificate he/she holds, the employer should take measures to ensure that he/she and the responsible officer comply with this Decree.
- In a cafe, a restaurant, a hotel, a gym, etc., how will the check be conducted?
In any case, in accordance with paragraph 2.48(a) of the Decree, the owner/director/manager of the premise has the responsibility to conduct the check.
- How can I be sure that the person conducting the check is an authorised officer or a police officer?
I can ask him/her to show me his police or service ID or his/her authorisation.
- Can my employer record evidence of the certificate I hold?
As is clear from the Decree, yes. This is because he/she must know which members of the staff have been vaccinated and/or have recovered from Covid-19 and are therefore exempted from the obligation to produce a 72-hour Rapid test or a PCR test. He/she must also be in a position to know when the 72-hour Rapid test or PCR test certificates of his/her employees expire. It is understood that there is no justification for providing a copy of the certificate.
- The owner/administrator manager of the premise mentioned in the Decree, can record details of the certificate I own or details of my identity/passport?
No. The last Decree does not give him/her the right, nor obliges him/her to keep one’s records.
- In what other cases are the data of my certificate allowed to be recorded?
This information may exceptionally be recorded only in special cases, such as for example in hotels, where one needs to check whether a customer’s stay does not exceed the validity period of the certificate he/she holds. In any case, the person responsible for the premise must be in a position to prove that it is essential for some data must be recorded.
- If I arrange a party or a reception at a hotel or an entertainment or a dining establishment, will I be responsible for checking my guests?
No. According to paragraph 2.48(a) of the Decree, the responsibility rests always with the owner/manager/responsible for the premise.
- Do the measures provided for in this Decree also concern the European Union Digital Covid Certificate (EUDCC)?
No. The EUDCC shall only be used for travel purposes. It cannot be used for the purposes of this Decree.
- If I do not have my certificate with me, could I use my EUDCC?
No, because according to the Decree, the EUDCC does not constitute proof. The Commissioner is in consultation with the competent Ministries so that should the need arise to regulate the use of EUDCCs within the Republic, this should be in accordance with the conditions set out by the European Regulation for EUDCCs.
- If the epidemiological situation improves, can the Commissioner ask for a suspension of some provisions of a Decree?
Yes. If the epidemiological situation improves and the Commissioner considers that the provisions of a decree no longer comply with the General Data Protection Regulation, she may request their temporary suspension until the Decree is amended or repealed.
For any further guidance regarding this procedure or if you require an initial consultation, please do not hesitate to contact our Law Firm at [email protected], +357 22 251 777 or +357 25 261 777 or please visit our office in Nicosia or Limassol.