An organization conducts body temperature checks as a part of COVID-19 monitoring. Body temperature is measured manually and is not followed by registration, documentation or other processing of an individual’s personal data.
Which of the following best explain why this practice would NOT be subject to the GDPR?
The practice described does not involve the processing of an individual's personal data by automated means or any subsequent processing such as registration or documentation. GDPR applies to the processing of personal data, which includes any data that can identify an individual. Since body temperature checks in this scenario do not involve recording or further processing of the data, it falls outside the scope of the GDPR.
A person’s body temperature is personal data concerning their health and therefore constitutes “special category” personal data under Article 9 of the GDPR. Processing of that data can only be lawfully done in very limited circumstances.