Travel and Health data to be obtained by Hotels under the Measures of Epidemic (COVID-19 CORONA VIRUS)

Dear Clients,
We would like to present our report on the issues that should be taken into consideration by the hotels within the scope of “personal data protection” regarding Corona Virus (COVID-19), which is described as “pandemic” by the World Health Organization, keeps threatening the entire world and also, very recently, appeared in our country.
The health data that will be requested from the customers is considered as sensitive personal data according to the Protection of Personal Data Law No. 6698 (“KVKK”). The explicit consent of the data subject is required before these data are processed.
However, the rapid and easy spread of epidemic poses a great danger for all of us. In this case, there may be some initiatives that may be considered reasonable to be taken by enterprises.

I. WITHIN SCOPE OF KVKK, WE CONSIDER THE REQUESTING TRAVEL INFORMATION FOR THE LAST 14 DAYS FROM THE HOTEL CUSTOMERS, ASKING IF THEY HAVE ANY FLU SYMPTOMS AND MEASURING THEIR TEMPERATURE AS FOLLOWS;

Requesting travel information; We can mention that public health and legitimate interest are arising because COVID-19 type is an epidemic disease reaching pandemic size, threatens public health, causing death of thousands of people, tens of thousands of people become sick. In this context, there is a huge social benefit to be obtained by processing the person’s data. However, if it is possible, it would be more accurate to ask the travel information for the last 14 days during the booking. We recommend you that for the reservations made directly from the hotel, the travel information can be asked on the hotel’s website or on the phone, and, for the reservations received via third-party’s websites, the travel information can be asked by warnings made on the relevant pages.

Information about flu or cold symptoms and measuring fever;It is expressed in 6th article of KVKK that “Personal data relating to health and sexual life may only be processed without obtaining the explicit consent of the data subject for purposes of protection of public health, operation of preventive medicine, medical diagnosis, treatment, and care services, planning and management of health services and financing by persons under the obligation of secrecy or authorized institutions and organizations.” Therefore, obtaining flu symptoms information or measuring person’s fever (as it is important in diagnosing the Virus) are to be processed by the workplace doctor. People other than doctors should not be able to process or access these data. According to KVKK, the person whose data are processed / to be processed, must be informed at the latest when the data is received. Also, it will be more accurate to indicate at the booking or before accommodation, that the health data will be received at check-in.

Cases without a workplace doctor; Businesses that do not regularly have a workplace doctor may either accept guests during the hours of the workplace doctor or keep guests waiting until their fever is measured by the workplace doctor. When we look at KVKK and other legislations, there is no exception to this. On the other hand, given the massive danger that may be created in terms of public health, the risk of the violation of KVKK does not disappear, thus, it may be possible for a non-medical person (or one person in each shift) to measure fever and learn the information about flu symptoms. In such a case, measures should be taken to ensure that these non-medical persons do not reproduce, share or keep holding these data. These persons must immediately transmit the information received to the workplace doctor in a way that others cannot access (e.g. by putting it in an envelope if it is taken by physically or by encrypting the media / file if it is kept online, etc.). Another option would be ending the situation (allowed to stay or not accepted as a guest) without processing the data, when the guest’s fever is measured. Considering the danger of the current pandemic epidemic disease, we are of the opinion that although these data should be taken by healthcare personnel, the violations regarding on processing data by person without authorization will be considered as an extenuating circumstance.

Avoiding service by Hotel; Within the scope of KVKK and other regulations, explicit consent cannot be a precondition for service. On the other hand, the data that is planned to be processed, will be processed in the scope of mentioned above, will be possible and reasonable to not render service to guests who have negative results on these issues (have traveled for the last 14 days, have a high fever, with flu symptoms) or guests who abstain from providing this information, without consent,.

II. CLARIFICATION STATEMENT FOR HOTEL’S GUESTS:

We recommend having a Clarification Statement that is consonant with KVKK, at the Hotel entrance. In the context of the KVKK compliance process, it will be appropriate to prepare an additional text for the clarification statements for the hotels.

III.CONSERVING THE DATA RECEIVED:

Duration of conserving the data received should be proportionate to the purpose. In the current situation, when epidemic disease risk factor is considered, it would be appropriate to conserve these data received for a maximum of 1 month and then to dispose all . In the cases where there is no doctor, as we mentioned above, the data should not be saved or should immediately transmitted to the doctor by taking necessary security measures.

IV. CONCLUSION:

Our opinions in relation to the matter are as follows:;
- Travel information can be obtained as much as possible before, without prior consent.
- Limited to the scope above, health data can be obtained without consent before guests arrived.
- Health data should not be obtained through the reservation channel.
- The Clarification Statement should also be displayed at the reception and at places where the health data will be taken (the room where the fever is measured, etc),
- Health data should only be taken by the workplace doctor (or another doctor to be made an agreement), but in cases there are not available, by taking measures mentioned above, a limited number of people may be assigned on this issue (e.g. measuring fever, etc.).
- If the data is received by the doctor, the data must be deleted within a maximum of 1 month (we consider that 1 month is sufficient in the current situation).
- Information received by non-medical personnel should be transmitted to workplace doctor, by taking necessary measures.

If you have any question, you can contact us on 0 212 266 8 777 or info@dedeoglubalaban.com

Hope to see you in healthy days!

Kind Regards,
DEDEOĞLU & BALABAN LAW FIRM
Att. Havva Balaban – Att. Mirkan Dedeoğlu – Att. İhsan Can Aşık