Requesting the information on vaccination status from employees has currently no basis in law

According to the conclusions of the European Data Protection Supervisor (‘EDPS’) and the Slovak National Labour Inspectorate (‘NLI’), there is currently no basis in EU or Slovak law for employers to request COVID-19 vaccination status information from their employees. It is more a question of the employees’ voluntary decision whether or not to provide such information to the employer. Employers are not entitled to ask for this information.

 

On 9 August 2021, the EDPS issued guidance to specific employers^[1] in relation to screening on return to the workplace applicable to the screening of both COVID-19 test results and vaccination certificates. We are of the opinion that the information contained in this guidance can also be applied to any other employer as the EDPS’s conclusions are based on general principles.

 

Below we provide a summary of the most important recommendations in relation to the processing of special categories of personal data (i.e. in this case, data relating to health) of employees, visitors or any persons entering the employer’s premises (‘Natural Persons’), namely information about their vaccination status or test results, to ensure that it is processed in accordance with the GDPR^[2] and that its processing minimises the impact on the rights and freedoms of individuals:

1. Employers are required to ensure that the lawfulness of the processing of personal data of Natural Persons in relation to COVID-19 complies, in particular, with (i) the national legislation of the particular Member State, (ii) the latest public health guidelines and (iii) the recommendations of the relevant national data protection authority.

2. Manual verification of a test result or COVID certificate (in paper or electronic form) of a particular Natural Person without further registration or recording would not qualify as processing of personal data under the GDPR.

3. Given the current voluntary nature of COVID-19 vaccinations in the EU (with the exception of specific sectors – e.g. healthcare in some EU Member States and other sectors), the EDPS considers that there is no legal basis for employers to process information on the vaccination status of Natural Persons (this may, however, change as the national legislations evolve). Vaccination status constitutes sensitive health data and the processing of these data may represent an intrusion into the right to private life within the meaning of the Charter of Fundamental Rights of the European Union. It appears that it could prove difficult to safeguard the confidentiality of these data in practice should they be used to organise the presence of employees in the employer’s workplace. In the EDPS’s view, this may lead to discriminatory treatment.

4. In the light of the above, the EDPS strongly recommends that employers do not ask employees for their personal vaccination status and, at the same time, do not further process this information. As mentioned in point 1 above, any action taken by employers in this regard depends on the development of national legislation.

5. Nevertheless, the EDPS recommends that, in this respect, employers process aggregated anonymised data on the vaccination status of their employees, which may help them in the context of workplace risk assessments. In order to obtain such aggregated data, employers may use, for example, anonymous surveys, which may be repeated at certain intervals in order to obtain the most up-to-date information.

 

As regards the national level, for the time being the NIL has closed the debate on whether employers may ask their employees about their COVID-19 vaccination status or test results. In this respect, the NIL noted the following in its opinion:^[3]

1. In labour relations, employees must always be treated in compliance with the principle of equal treatment and no employee may be discriminated against on the basis of their status, such as, for example, their COVID-19 vaccination/testing.

2. At the same time, the NIL noted that requesting vaccination status information from employees, including, if applicable, ordering compulsory testing by the employer with a requirement for the employee to present a negative test result has (at present) no basis in any legislation that would authorise employers to obtain and process data on the vaccination status of their employees. Employers may only process data that they are designated to process by law or other legislation.

3. Should an employer collect information on COVID-19 vaccination status and test results and subsequently segregate employees into two groups on that basis, this would constitute segregation and unequal treatment of employees on the basis of a different status.

4. In the NIL’s opinion, should an employer restrict or prohibit the access of, for example, unvaccinated employees to its premises and, as a result, not assign work to that group of employees, within the meaning of the Labour Code this would constitute an obstacle to work on the part of the employer.^[4] According to the Slovak Labour Code, for the duration of this obstacle, the employer would have to compensate its employees for their wages in the amount of their average earnings.

In conclusion, it should be noted that this issue has been approached differently by various Member States where the employer’s entitlement has been defined directly in their national legislation.

As regards possible future approaches to this matter, everything will depend on the development of the pandemic situation in the Slovak Republic and possible legislative changes.

 

 

Viktória Poliaková, Zuzana Krajčovičová