May employers collect and process information on whether an employee was in a risk area or had direct contact with a sick person, etc.?
Due to their duty of care and in accordance with the Occupational Safety and Health Act (ArbSchG), employers are obliged to take the necessary measures to ensure the occupational safety and health of their employees. This also includes the employer's duty to ensure that other employees are protected against infection by a sick person. For this purpose, it is permissible under data protection law to collect information about the persons who have been in contact with the sick employee. In accordance with Article 6 paragraph 1 letter c of the Basic Data Protection Regulation (DSGVO) in conjunction Article 9 paragraph 1, paragraph 4 DSGVO and Article 26 paragraph 3 sentence 1, Article 22 paragraph 1 number 1 letter b of the Federal Data Protection Act (BDSG), the employer may process the necessary data for the purpose of occupational health precaution.
According to this, the employer may, for example, also ask holiday returnees whether they have stayed in a risk area defined by the Robert Koch Institute. Negative information from the employee is regularly sufficient. If there are further indications, a further inquiry can be made if necessary.
Source: The Baden-Württemberg State Commissioner for Data Protection and Freedom of Information (available at https://www.baden-wuerttemberg.datenschutz.de/faq-corona/)