These concerns saw employers turn to DPAs for advice on the legal requirements relating to the collection and processing of such data. A large majority of DPAs’ statements considered data processing in the context of employment, with authorities agreeing that data protection must not be jeopardised by emergency measures, although appropriate derogations may apply. However, evidence collected by FRA suggests that the guidance provided by the supervisory authorities is not harmonised across Member States. For some DPAs (Belgium, Estonia, France, Hungary, Italy, Luxembourg or the Netherlands (see Table 1 in the Annex), employers may not collect and process personal data related to either symptoms or infection among employees unless workers have voluntarily provided their personal data and agreed to their processing. Others (Austria, Denmark, Finland, Germany, Ireland, Lithuania, Poland, Slovakia or Spain), however, indicated that employers can request personal information related to symptoms and/or infection, if such collection is proven to be necessary. Similarly, DPAs are divided regarding the possibility to disclose the identity of infected staff. In Belgium, Finland, Ireland, Latvia, Lithuania, Luxembourg and the Netherlands, the identity of affected employees cannot be disclosed, but staff may be informed that there is a verified case in the company. For the Danish, French, German, Italian or Spanish DPAs, however, employers may disclose the identity of sick colleagues. The same applies to a lesser extent concerning the collection of personal data on recent travel. Some DPAs consider that employers have the right to request information related to a recent trip to a “risk area”. This is the case for the data protection authorities of Denmark, France, Ireland, Latvia, Lithuania, Luxembourg, Poland and Spain. However, other DPAs advised that employers should not oblige employees to disclose personal information related to a recent trip. This is the case in Belgium, and to some extent in Finland, Hungary, Italy and the Netherlands, where such information may be processed, but not requested. These DPAs indicate that employers can only collect such information when employees have voluntarily accepted to disclose it. 4.2.2 Data processing by the media Some media have also faced questions about the legality of processing personal data, mainly in relation to the public disclosure of personal information about infected individuals. In Cyprus, the DPA explicitly recalled that publishing the personal data of patients is illegal.253 The evidence collected by FRA suggests that the media largely apply this rule publishing only aggregated information related to COVID-19 that does not contain personal data. 42