Last issue, we discussed the Italian Data Protection Authority (DPA) guidance^[1] regarding the health data of employees. The DPA stated the responsibility for handling health data lies with public entities—not employers. Since then, several other DPAs in Europe have come out with guidance for companies about how to handle the movement and security of personal data. Under the GDPR, health data are considered to be sensitive. In an advisory brief sent out to organizations around the world, Cordery Compliance outlined the general stance toward health data,^[2] ways in which organizations can gain consent to process the data and concerns regarding data security while employees work from home. The brief states,