Personal Data Protection Implications of Thermal Screening

MG Law Office, through the contribution of partners Archil Giorgadze and Nicola Mariani, joined by senior associates Ana Kochiashvili, Tamar Jikia, associate Mariam Kalandadze, junior associates Ana Jikia, Lasha Machavariani and Nino Sakvarelidze, is partnering with InterPressNews on a regular section of the paper which provides updated information regarding significant legal changes and developments in Georgia. In particular, we highlight significant issues which may impact businesses operating in Georgia.

After a full year into the COVID-19 pandemic governments around the world are allowing businesses to reopen within a new framework of health and safety regulations. In Georgia it is now mandatory for businesses to perform temperature screenings at all public venues, including entertainment and hospitality sector. In this sense, businesses are trying to adapt to new regulations and look for optimal solutions to identify potential cases of the virus and prevent contracted individuals from accessing public areas.

As a result, the demand for thermal screening cameras has increased at a rapid rate. These cameras detect elevated body temperature by scanning the thermal image of an individual and comparing the temperature against the base line average. Thermal screening is deemed to allow businesses to minimize the spread of the COVID-19 and offer customers a safe environment.

While the thermal cameras are indeed a convenient solution to comply with the health and safety regulations, this entails processing of a sensitive personal data and gives rise to concerns related to personal data protection (PDP).

PDP Regulations in Georgia

The Law of Georgia on Personal Data Protection (the Law on Personal Data) is the main legislation regulating the collection, storage and processing of personal data in Georgia. The Law on Personal Data generally establishes two types of personal data – Personal Data and Special Category of Data. A personal data is any information related to identified or identifiable individual, whereas the special category of data includes information regarding person’s ethnic origin, political views, religious beliefs, sexual life, and information related to a person’s state of health. In this respect, any operation performed to such data by automated, semi-automatic or non-automatic means constitutes the processing of personal data.

As a general rule, companies processing the personal data are bound to observe the constitutional rights and carry out processing without impugning the dignity and privacy of a data subject. In this sense, the processing of personal data is only permitted under limited circumstances, such as data subject’s consent, statutory duties and significant public interest. Moreover, the processing of specific category of data is permitted with the written consent of a data subject or in exceptional circumstances as set out in the Law on Personal Data. Notably, the data processor is bound to comply with the principles of fairness, proportionality, accuracy and adequacy throughout the processing.

The Law of Georgia on Personal Data further envisages specific rights for data subjects designed to safeguard fair processing of the personal data. Accordingly, a data subject is entitled to request information regarding the processed data, purpose, legal grounds and means for processing, as well as information regarding the persons accessing such data. A data subject is also entitled to withdraw consent on data processing and request deletion of the processed data at all times.

PDP Considerations for Thermal Screening

While there are no major red flags related to the compatibility of thermal screening with PDP regulations, the companies considering to install the thermal cameras may wish to consider some of the aspects discussed in detail below.

The thermal cameras are usually set up at the entrances of buildings and are connected to individual computers. This allows the thermal cameras to transmit real time footage zoomed-in to a person’s face and measure temperature of individuals entering the premises. Therefore, the thermal cameras enable identification of an individual and collect health-related information, which qualifies as the processing of both - the personal data and special category of data.

Currently, the requirement to measure body temperature of individuals entering the public venue is based on the governmental regulation and represents a precondition for operation of respective businesses. This requirement constitutes a valid basis for processing of personal data and special category of personal data. However, the legality of such processing is closely tied with the health emergency and the processing shall not exceed the mere screening of body temperature.

There is a wide variety of thermal screening technology available on the market and depending on the capacity of the thermal camera, it may also include additional functionalities, such as image capture and video recording, as well as performing face recognition of individuals. Notably, such additional features go beyond the scope of health and safety regulations and do not fall under the governmental requirement. Accordingly, the companies applying such extra functionalities of the thermal camera will be required to come up with a separate statutory basis, otherwise not applicable to the present circumstances. Therefore, it is highly recommended to consider strictly limiting the features of the thermal camera to the control and screening of individual’s body temperature.

To ensure compliance with the Law on Personal Data, the companies are further encouraged to undertake a set of security precautions and safeguard the collected personal data from unauthorized disclosure and unlawful processing. This may include password-protecting a computer connected to the thermal camera and allowing only limited number of staff members to access the personal data. If possible, access to a computer shall be permitted only with individually assigned guest username and other credentials. Also, computers shall not be connected to any network and the personal data cannot therefore be accessed other than by using a computer. Moreover, the companies may be required to keep detailed, accurate and up-to-date written records of any operation performed on any personal data, including, the information on users’ log in, log out and activities carried out in-between (so called “logging”).

To summarize the companies shall ensure PDP safeguards as follows:

• Deactivate any additional feature of the thermal camera not related to the screening of body temperature;
• Limit number of staff members authorized to access personal data to the extend necessary;
• Block any external network access to the computers connected to the thermal camera;
• Implement password-protection for computers connected to the thermal camera;
• Assign individual username and other credential to authorized staff members;
• Keep records of logging related to any action performed on the personal data.

Overall, since the thermal screening is a relatively new phenomenon, there are no exhaustive guidelines on the proper implementation of the thermal cameras and the companies may have to grapple with individual cases. Nevertheless, the businesses are required to thoroughly understand utilized technology and observe applicable PDP regulations, as the pandemic continues to loom over our lives in 2021.

Note: this article does not constitute legal advice. You are responsible for consulting with your own professional legal advisors concerning specific circumstances for your business.

MG Law is the first full-service law firm in Georgia to be founded by international partners. The firm advises a diverse group of Georgian and foreign companies, financial institutions, investment funds, governments and public enterprises.

Among many other areas, the firm primarily focus on the following sectors: Banking & Finance, Capital Markets, Arbitration & Litigation, Labor & Employment, Infrastructure and Project Finance, Energy Law, Real Estate, Tax and Customs, Investment Law, Corporate Law, and Cryptocurrency & Blockchain.

For more information, please visit www.mglaw.ge or contact Archil Giorgadze at archil.giorgadze@mglaw.ge and Nicola Mariani at Nicola.mariani@mglaw.ge

(Ad)