HOW DOES THE CORONA-ALERT APP WORK?

The Corona Alert App (“App”) is used to exchange anonymised contact IDs of smartphones when users with the installed app come close to each other. The IDs are stored decentrally on the respective devices. To prevent the creation of motion profiles, the contact IDs are changed regularly. A list containing the anonymized contact IDs is the only thing stored centrally. The app accesses these at a regular basis in order to identify possible problematic contacts.

If a user tests positive for COVID-19, it’s entirely up to the user to share the test result via the app. If the user shares the result, a list of contact IDs including the time they were valid and a confirmation code is sent to the central server. If another user’s app recognizes that one of the stored foreign IDs (i.e. the contact IDs of other smartphones) reports a positive test during itsregular synchronization with the central server, it informs the user of a possible infection nearby.

Depending on how long they are in contact with or the distance to the infected person, an individual “risk score” is determined and displayed to the user as a message. As soon as this risk score exceeds a certain threshold, the user will receive a respective alert in the App.

VOLUNTARY USE BY EMPLOYEES

Employees are at liberty to use the App voluntarily on their personal devices. However, an employer’s consent is required for installation on a company mobile phone provided exclusively for business use.

Just as in the case of an infection with COVID-19, the employee must immediately inform the employer of any suspected infection indicated to him by the App due to his fiduciary obligations under his employment contract. Even if only a low risk is indicated, the employer must be able to decide in each individual case on the appropriate employment of the employee in order to minimise the risk of infection at the workplace environment (e.g. working from home).

CAN EMPLOYERS OBLIGE EMPLOYEES TO USE THE APP?

Employers cannot oblige employees to use the App on a private or company mobile phone outside of working hours. Moreover, employers cannot oblige employees to use it on their personaldevice during working hours. Such intrusion in private life and/or property of the employees is generally unjustifiable.

However, particularly in professions with changing and frequent contact to (unknown) third parties, the question arises whether the employer can at least order or carry out the installation of the App on a company mobile phone. One argument in favour of this is the extended infection protection at the workplace environment, which benefits all employees (including users of company mobile phones). Nevertheless, this is mostly viewed critically, because such an order could conflict with the data protection compliant use of the App, since a compulsory use on the part of the employer would exclude the required voluntary (and only then effective) consent of the person concerned (i.e. the user) to use the app. In light of this, members of the parliamentary group Bündnis 90/Die Grünen have already proposed a draft legislation that would explicitly prohibit an obligation to use the App in the employment relationship (BT-Drs. 19/20037).

Even if an instruction to use the app on a company mobile phone during working hours, as is at least partly argued, would be permissible under individual employment law, the works council would have to co-determine this instruction. In addition, it would still be unclear how the employer should ensure or control the use or activation of the App during working hours.

As it is still unclear whether employees can be instructed to use the App – at least on their company mobile phone during working hours – no disciplinary measures should be taken (e.g. warnings, dismissals) in the event of violations of an expressed request to use the app.

RECOMMENDATION

Due to the uncertain legal situation, employers should not unilaterally order their employees to use the App. Instead, employers should recommend its use to their employees. If there is a works council and/or a data protection officer, a suitable joint recommendation wording could be created and published in collaboration with them to increase acceptance among the workforce.