Right of Employers to Collect Data on Employee Vaccination Against COVID-19 – Confidentiality
To print this article, simply register or connect to Mondaq.com.
Unlike previous announcements, the Polish government has decided not to send back for further work a bill explicitly providing for the right of employers to require employees to present a COVID-19 vaccination certificate. What does the absence of this regulation mean in concrete terms? Does this prevent employers from verifying the fact of vaccination?
What does the GDPR say about this?
Information relating to vaccination must indisputably be considered as data relating to health within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of individuals with regard to processing. of personal data and on the free movement of such data and repealing Directive 95/46 / EC (General Data Protection Regulation) – the “GDPR”. Indeed, the GDPR considers as such data all personal data concerning the past, current and future physical or mental health of an individual – including the provision of health services – which reveal information on the state of health of the individual. ‘individual. Information about the acquisition of immunity to COVID-19 undoubtedly falls within this definition of health condition.
On the other hand, the processing of data relating to health, as sensitive data, is in principle prohibited. However, the prohibition on processing this data is not absolute. The GDPR provides for many exceptions in this regard. The following exceptions may apply to labor relations in the field of vaccination certificates:
- the explicit consent of the data subject; and
- the need for processing for the purposes of fulfilling obligations and exercising specific rights by the controller or the data subject in the field, inter alia, of labor law.
Therefore, the answer to whether it is permissible to request information from employees about COVID-19 vaccination should, in our opinion, be sought in labor law.
What does labor law say about this?
The Labor Code contains a catalog of information that employers can request from employees and employee applicants. These include, among other things, first and last name information, basic contact details, education information or career history. There is no information on the employee’s state of health on this list. Therefore, some have concluded that it is not acceptable to ask employees to provide details about their health, including information about the medical procedures they have undergone.
However, it should be noted that the catalog described above is open. The employer may request other personal data, if this is necessary to exercise the right or to comply with the obligation resulting from the provisions of the law. In addition, although in principle the provision of personal data is carried out on the basis of the employee’s declaration, the employer has the right to verify such a declaration and to request the presentation of documents confirming its veracity. Does this apply to vaccination information and vaccination certificate?
In our opinion, yes.
Healthy and safe working conditions
First, the source of this employer’s right lies in the legislation on the responsibility for the health and life of employees.
The right of an employee to work in safe and healthy conditions is one of the economic rights and freedoms protected by the Constitution along with the right to property, the right to freedom of work, the right to health care or the right to work. right to social security.
In turn, the employer’s obligation to ensure safe and hygienic working conditions is one of the basic principles of labor law. In doing so, the employer is required to protect the health and life of employees by making appropriate use of the achievements of science and technology, thus applying scientific “innovations”, even anticipating the legislator in this regard.
According to the Labor Code, the employer must in particular:
- organize work in such a way as to guarantee safe and healthy working conditions; and
- meet health and safety needs and adapt measures taken to improve the current level of protection of workers’ health and life, taking into account changing working conditions.
In the context of a pandemic, one of the factors that an employer must consider when organizing work is, among other things, the risk of the spread of COVID-19 among the staff.
For example, in the context of the large-scale COVID-19 pandemic in Poland, the Polish legislator introduced the obligation to wear masks, among other things, in the workplace if there is more than one no one in the room, unless the employer decides otherwise. Therefore, the final decision on how to organize work in this regard has been delegated by the legislator to the employer.
At the same time, it is important to stress that hygienic working conditions should not only mean that workers have access to running water or personal hygiene products, but also that they feel at home. comfortable in carrying out their work. Many workers complain about the discomfort of working with masks. This is particularly the case for workers who, due to the nature of their tasks, do not have the possibility of removing their mask during the entire working day. These people often made the decision to be vaccinated with the idea of being able to remove their masks and work in more comfortable conditions. The pressure from vaccinated workers to relax internal restrictions on mask wearing is therefore not surprising, especially during the significant drop in the number of cases of infection observed during the summer.
This decision, because of its potential impact on the health and possibly the lives of workers and their families, as well as the potential liability of the company to those who fall ill, must be made on the basis of reliable data. . At the same time, taking into account general guidelines on how employers should proceed in terms of occupational health and safety, as well as widely available information on the effectiveness of COVID-19 vaccines and the relatively low percentage of ‘post-vaccination side effects, making a decision on whether to wear masks in the workplace based on information about the vaccination level seems to be the most reasonable from the point of view of medical knowledge and rationality of such a decision.
In addition, it should be noted that although the sphere of safe and hygienic working conditions is regulated by the Labor Law. The above comment applies not only to persons employed under an employment contract as such, but also to those performing tasks under civil law contracts due to the extended efficiency. provisions of the Labor Code in this regard.
However, it should be borne in mind that the processing of personal data should always be proportionate. It may therefore not be justified in all cases to request vaccination data on the basis of the employer’s obligations to ensure safe and healthy working conditions. This may be the case, for example, with employees who are not in contact with third parties in the performance of their duties, for example those who, on the employer’s instructions, work permanently away from their home.
When implementing the GDPR in the area of labor law, the Polish legislator decided to introduce the employer’s right to process employee personal data on the basis of the employee’s consent. Previously, the institution of consent was not implemented in Polish labor law, as it was supposed to be applied by the employer in labor relations due to the specific nature of the relationship between the parties. After the modification of the Labor Code in this regard, the validity of such an argument seems limited.
Thus, as long as employees voluntarily provide their COVID-19 vaccination certificates to the employer and can withdraw their consent at any time, the employer will legitimately process employees’ personal data in this regard.
In view of the above, in our view, the absence of an explicit provision allowing employers to request information on COVID-19 vaccination does not amount to denying employers such a right. In fact, it can already be deduced from the general provisions of labor law. However, the need for explicit legal confirmation reported by employers is not surprising given the level of sanctions threatening for violation of GDPR provisions.
However, it should be borne in mind that before deciding to require employees to present vaccination certificates, an analysis of the adequacy of this mechanism in the particular case should be carried out. Such a request may not always be justified or the introduction of appropriate house rules may be necessary.
The content of this article is intended to provide a general guide on the subject. Specialist advice should be sought regarding your particular situation.