Employers' rights to collect data on employees' COVID-19 vaccinations.

Contrary to earlier announcements, the Polish government has decided not to proceed with a draft bill that would explicitly grant employers the right to require employees to present a COVID-19 vaccination certificate. What does the absence of this regulation mean in practice? Does it prevent employers from verifying vaccination status?

What does the GDPR say about this?

Vaccination data should undoubtedly be treated as health data within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) – ‘GDPR’. The GDPR considers such data to be any personal data relating to the past, present and future physical or mental health of a natural person – including the use of healthcare services – which reveals information about that person's health. Information about the acquisition of immunity to COVID-19 undoubtedly falls within this definition of health status.

On the other hand, the processing of health data, as specially protected data, is generally prohibited. However, the prohibition on processing such data is not absolute. The GDPR provides for numerous exceptions in this regard. The following exceptions may apply to employment relationships in the area of vaccination certificates:

consent of the data subject; and

the necessity to process the data in order to fulfil the obligations and exercise specific rights by the controller or the data subject in the field of, inter alia, labour law.

Therefore, in our opinion, the answer to the question of whether it is permissible to request information from employees about COVID-19 vaccination should be sought in labour law provisions.

What does labour law say about this?

The Labour Code contains a list of information that employers may request from employees and job applicants. This includes, among other things, information about their first and last names, basic contact details, education, and professional career to date. This list does not include information about the employee's health. Some people conclude from this that it is not permissible to require employees to provide information about their health, including medical procedures they have undergone.

However, it should be noted that the catalogue described above is open-ended. The employer may also request other personal data when it is necessary to exercise a right or fulfil an obligation under the law. Furthermore, although personal data is generally provided on the basis of a statement by the employee, the employer has the right to verify such statements and request documents confirming their accuracy. So, does this apply to information about vaccination and vaccination certificates?

In our opinion, yes.

Safe and hygienic working conditions

Firstly, the source of this employer's right lies in the provisions on responsibility for the health and life of employees.

The right of an employee to work in safe and hygienic conditions is one of the economic rights and freedoms protected by the constitution, alongside the right to property, the right to freedom of work, the right to health protection and the right to social security.

In turn, the employer's obligation to ensure safe and hygienic working conditions is one of the fundamental principles of labour law. The employer is obliged to protect the health and life of employees by making appropriate use of scientific and technical advances, and therefore by applying scientific ‘innovations’, even ahead of the legislator in this respect.

According to the Labour Code, the employer should, in particular:

organise work in a manner that ensures safe and hygienic working conditions; and

respond to the needs in the field of occupational health and safety, as well as adapt the measures taken to improve the existing level of protection of the health and life of employees, taking into account the changing conditions of work.

In the context of the pandemic, one of the factors that employers should take into account when planning work is the risk of spreading COVID-19 among staff.

For example, in connection with the large-scale COVID-19 pandemic in Poland, the Polish legislator has introduced the obligation to wear masks, inter alia, in workplaces if there is more than one person in the room, unless the employer decides otherwise. Thus, the legislator has delegated the final decision on how to organise work in this respect to the employer.

At this point, it should also be emphasised that hygienic working conditions should be understood not only as employees' access to running water or personal hygiene products, but also as their comfort while performing their work. Many employees complain about the discomfort caused by wearing masks at work. This applies in particular to employees who, due to the specific nature of their duties, are unable to remove their masks throughout the working day. These individuals often decided to get vaccinated precisely so that they could remove their masks and work in more comfortable conditions. It is therefore not surprising that vaccinated employees are pressuring for the relaxation of internal restrictions on wearing masks, particularly during the significant decline in the number of cases observed in the summer.

Due to its potential impact on the health and even the lives of employees and their families, as well as the company's responsibility, the decision on this matter should be based on reliable data. Taking into account the general guidelines on how employers should proceed in the area of health and safety, as well as publicly available information on the effectiveness of COVID-19 vaccinations and the relatively low percentage of adverse reactions to vaccinations, the decision to make the wearing of masks mandatory in the workplace based on information about the vaccination rate seems to be the most reasonable from the perspective of medical knowledge and the rationality of such a decision.

It should be noted that although the area of safe and hygienic working conditions is regulated by labour law, the above comment applies not only to persons employed under an employment contract as such, but also to those performing tasks under civil law contracts due to the extended effectiveness of the provisions of the Labour Code in this regard.

However, it should be remembered that the processing of personal data should always be proportionate. It may therefore turn out that requesting vaccination data based on the employer's obligations to ensure safe and hygienic working conditions will not be justified in every case. This may be the case, for example, for employees who do not come into contact with third parties in the course of their duties, e.g. in the case of persons who, on the employer's instructions, work remotely from their own homes on a permanent basis.

Employee consent

When implementing the GDPR in the sphere of legal and employment relations, the Polish legislator decided to introduce the employer's right to process an employee's personal data on the basis of their consent. Previously, the institution of consent was not used in Polish labour law. A priori, it was considered in employee relations to be enforced by the employer due to the specific nature of the relationship between the parties. Following the amendment of the Labour Code in this respect, the validity of such an argument seems to be limited.

Therefore, as long as employees voluntarily provide their employers with COVID-19 vaccination certificates and can withdraw their consent at any time, employers will be entitled to process their employees' personal data in this regard.

Summary

In view of the above, in our opinion, the lack of an explicit provision entitling the employer to request information about COVID-19 vaccination does not mean that employers are deprived of such a right. This right can already be inferred from general labour law provisions. However, given the severity of the penalties for violating the provisions of the GDPR, it is not surprising that employers have signalled the need for explicit confirmation.

It should be remembered, however, that before deciding to require employees to present vaccination certificates, the adequacy of this mechanism in a specific case should be analysed. It may happen that such a request will not always be justified, or it may be necessary to introduce appropriate internal regulations in this regard.