Use of the Corona-Warn-App in companies

Following the introduction of the Corona-Warn-App in Germany with some initial difficulties, more and more employers now want to use it to protect their employees. However, employers cannot unilaterally order the mandatory use of the app by employees.

1. Functionality of the app

The app is based on the "PEPP-PT" (Pan-European Privacy-Preserving Proximity Tracing) standard. When users of the app meet, their smartphones can recognize each other and exchange certain random number sequences (ID) via Bluetooth. This ID is generated randomly for each user every few minutes and represents a pseudonym. Based on the signal strength, it is possible to determine the distance between the smartphones. If the distance is small enough for a certain period of time, the smartphones store the other phone’s ID locally on the phone.

If a user is infected with Covid-19, he can enter his data into the app by scanning a QR code given to him by his doctor or via telephone TAN procedure. All IDs generated and sent by the app within the last 14 days are then sent to a central server. There, they can be downloaded by other app users. By comparing the data stored on the server with the data stored locally on the user's smartphone, it is possible to determine whether the user has had contact with a Covid-19 patient over the last 14 days. If such contact is established, an individual risk score is determined according to statistical calculation rules on the basis of the data collected on the duration of contact and distance to the patient. The user is notified of the contact via the app and informed of which bodies he can now contact. There is no automatic transmission of data to third parties (e.g. employers or health authorities).

The aim of the Corona-Warn-App is to identify and medically test people at risk as quickly as possible in order to reduce the reproduction rates of the virus. By reporting the infection in the app, people who have had contact with the infected person prior to the report and who are therefore at risk of infection can also be informed. This makes it possible for these persons to take measures quickly to have their own health checked.

According to the German data protection authorities, the installation and use of the Corona- Warn-App is based on the principle of voluntariness. According to the authorities, the only legal basis for data protection is therefore Article 6 (1) lit. a, Article 9 (1) GDPR (consent).

To date, there is neither a legal basis nor any case law on the use and regulation of the app.

2. Order to use the Corona-Warn-App on grounds of the employer's right to issue instructions

At work, the use of the app can lead to considerably more safety for employees. If it is established that an employee is potentially infected, it makes sense to exempt him from attending work against remuneration until a negative test result is obtained. This could prevent the employee infecting other colleagues or customers with the virus and impairing the functionality of the business.

2.1 Obligation to install the app on private smartphones

However, the employer cannot unilaterally order the use of the Corona-Warn-App on a private end device. The employer's right to issue instructions is exclusively work-related and may not affect the employee’s personal life. Moreover, since the employer is also the owner of the private smartphone, the instruction to install the app on the mobile phone constitutes an infringement of the right of ownership of the employee in question. Even with the employee's consent, this declaration of consent could be ineffective in the absence of voluntariness, as an obligation on the part of the employer or even the corresponding mere request could preclude the voluntary nature of the consent.

In the opinion of the German authorities, access to workplaces therefore cannot be made dependent on presentation of the app, since this would constitute an improper use that is irreconcilable with the concept of voluntary consent. The data protection authorities point out that discrimination against persons who do not use the app must be prevented and excluded.

​​​​​​​2.2 Obligation to install and use on company smartphones

In contrast, there are good arguments to support employers being able to oblige their employees to install the app on the smartphones owned by the employer on grounds of its right of instruction according to § 106 German Industrial Code [Gewerbeordnung – GewO]. However, this does not entail any obligation for employees to actually use the app and to carry the smartphone with them outside of working hours.

An order to employees to carry their company smartphones with them permanently, i.e. also outside of work, in order to ensure the effectiveness of the Corona-Warn-App, cannot be based on the right to issue instructions, as this only applies within the employment relationship. As soon as an instruction interferes with the employee's leisure time or private life, it fundamentally has to be considered inadmissible, as this violates the employee's general right of protection of personality. Even though employers have a strong interest in preventing or containing infections among their staff, an employer cannot invoke its duty of protection and care towards its other employees in this respect, as it can already fulfil these duties by complying with hygiene standards, distancing rules and by providing disinfectants.

Due to the principle of the double voluntary nature of the app, persons who have tested positive for Covid-19 are not under a mandatory obligation to report their illness, which means that for this reason alone the app may not be sufficient to ensure that the employer complies with its obligations under occupational health and safety law. In addition, under data protection law, any consent that may have been granted is not generally regarded as voluntary due to the imbalance in the employment relationship and would therefore be deemed invalid under data protection law. The Bavarian data protection authority has already announced that it intends to take action against such violations by imposing fines.

The employer is also unable to represent that it has a prevailing legitimate interest in the use of the app pursuant to Art. 6 (1) lit. f GDPR, as it cannot be considered "necessary" for the protection of the workforce under data protection law. Since the app only fulfils its function if the users (i) also enter in their corona test results if they are positive and (ii) always use the app, i.e. also outside of working hours, neither of which the employer can guarantee, the obligation to use the app also does not necessarily protect the workforce against an infection with SARS-CoV-2. With regard to the necessity of the data processing, the other (milder) means, such as the distancing requirement and obligation to wear a mask, will generally have to be applied.

A different assessment of the permanent use of the app on company smartphones can only be considered for particularly hazardous professions such as doctors, nurses, geriatric nurses, etc. In the current pandemic situation, employers have more extensive rights of instruction over members of these professions for the public good.

We therefore recommend that, instead of imposing a unilateral obligation to use the app, employers urgently ask their employees to voluntarily activate the app and, for greater effectiveness, to also voluntarily carry the company mobile phone around with them permanently.

3. Imposition of the obligation to use the Corona-Warn-App by shop agreement

If the company has a works council, the use of the app on company mobile phones can be agreed by means of a shop agreement based on § 88 No. 1 German Shop Constitution Act [Betriebsverfassungsgesetz – BetrVG]. However, an order to use the app on private smartphones cannot also be imposed by means of a shop agreement. However, the framework conditions for a voluntary use can be agreed in a shop agreement. The works council has a co-determination right insofar if general rules of conduct are to be issued at the business (§ 87 (1) No. 1 BetrVG). These conditions have already been fulfilled in case of an intended recommendation to use the app by the employer. 

Furthermore, the use of the app can also represent a technical means of complying with the statutory occupational health and safety regulations, so that § 87 (1) No. 7 BetrVG can also come into consideration as a basis for co-determination.

A right of co-determination pursuant to § 87 (1) No. 6 BetrVG then only comes into consideration if the employer is able to check the employees’ use of the app.

4. Employee's duty to inform in case of a warning by the Corona-Warn-App

Irrespective of the employee's duty to inform the employer if he falls ill with a contagious infection, the employee is also obliged to inform the employer if the app sends a concrete warning. Please note in this connection that the Corona-Warn-App has three risk levels: "unknown risk", "low risk" and "increased risk". Only in case of the risk status "increased risk" is the employee informed that the risk check has revealed an increased risk of infection, as he has encountered within the last 14 days at least one person who has tested positive. The person is instructed to go home or stay at home, if possible, and to contact a doctor or the public health department to agree on further action. Although this warning does not necessarily mean that the user has actually become infected with the virus, due to the higher probability of infection, however, the employer has a legitimate interest in being notified by the employee, with the result that the employee's duty to inform may be derived from secondary contractual obligations.

5. Practical advice

Due to the aforementioned risks under labor and data protection law, we recommend that employers merely inform their employees and urgently request them to voluntarily activate the app and, if possible - and of course only voluntarily - to carry the company mobile phone with them permanently for greater effectiveness.

The employer should also refrain from pre-installing the app on company mobile phones, leaving it up to the employees to decide whether they want to install the app themselves. If, from a technical point of view, only the employer can install apps on a company mobile phone, the app should only be installed if this is expressly requested by an employee.

Back to list