4. Can a Data Controller collect health data in relation to COVID-19 about employees or visitors of ADGM entities?

As an employer, Data Controllers have a duty to ensure employees’ health and safety, but that does not necessarily mean they may gather unnecessary information about their employees.

For example, it may be reasonable in the current circumstances to ask an employee or a visitor if they have visited a particular country or are experiencing COVID-19 symptoms. On the other hand, it would be unreasonable to ask an employee or visitor if they or any of their family members have ever been diagnosed with any other contagious disease.

If additional health data is required, employers must ensure that they do not collect any more Personal Data or Sensitive Personal Data than is necessary (note: Sensitive Personal Data includes health information). In addition, employers must ensure that any Person Data or Sensitive Personal Data that is collected is treated with the appropriate safeguards, as specified under the DP Regulations.