Publication of mr. Leonie Ouwersloot-Koster, JPR Lawyers, preferred partner of Liesker.
Work-at-home counseling has changed since the end of September 2021. We are seeing more and more companies asking their employees to come back to work (partially) in the office. This movement back to the office is being embraced by many again. People enjoy working (partly) in the office again. On the other hand, there are also concerns. Is it safe in the office? Have my colleagues been vaccinated? Many employers, for the safety of their staff as well as their customers, want to know if employees have been vaccinated. The question, however, is whether this is in line with privacy laws (particularly the AVG).
Special personal data
In order to assess whether it is possible to process certain information, it is necessary to consider what type of personal data is involved and whether the AVG imposes further rules on the processing in question. The AVG states that it is not permitted to process, collect or retrieve data about a person’s health. This is only possible at the time when there is a legal basis for it or when the person in question has given explicit consent. Since asking about someone’s vaccination says something about the health of the employee in question, it can be assumed that it should be classified as health data. Processing this information is therefore prohibited in principle.
Exception?
As mentioned, it is still possible to process health data under circumstances. One of the exceptions is when there is a legal duty. In the Netherlands, however, we have no legal duty to process coronavaccination data by employers. Therefore, this exception cannot be invoked.
Alternatively, the special personal data could be processed with the consent of the data subject. However, in the employer/employee relationship, consent is not considered a valid exception by the Personal Data Authority and the EDPB (European Data Protection Board). Given this, therefore, an employer will not be able to invoke the exception of consent.
And now?
The AVG does not currently allow for the processing of employee vaccination data. However, the employer is always free to ask an employee if he has been vaccinated. As an employer, however, be aware that you are not allowed to record this information.
Several companies have announced they will only allow vaccinated employees into the workplace. How this will be handled in the courts remains to be seen. We will, of course, continue to keep you informed of developments.
