Back to the Workplace After the Virus: Can an Employer Request Proof of Immunity from Employees? If So, What Data Protection Obligations Apply?<\/p>\n
In the weeks following the third wave of the COVID-19 pandemic, an increasing number of employers have decided to resume in-person work, which may result in the mass return of employees to their former workplaces, or even to entirely new ones. The following article examines the employment law and data protection issues that may arise during this return.<\/p>\n
The Hungarian Labour Code provides that an employer may require an employee to make a declaration or provide personal data that is relevant to the establishment, performance or termination of the employment relationship, or to the enforcement of employment-related claims (Section 10(1)).<\/p>\n
It is self-evident that information concerning infection or immunity status is relevant to the performance of the employment relationship. Consider the impact that a confirmed infection of an employee, who had previously worked in close proximity to colleagues, could have on workplace organisation in the following weeks. Based on the lessons learned during the first two waves of the pandemic, employers have a clear interest in preventing such disruptions.<\/p>\n
In this regard, the Hungarian Occupational Safety and Health Act provides that, in order to ensure safe and healthy working conditions, employers must take all necessary measures to protect the safety and health of employees, while taking changing circumstances into account (Section 54(7)).<\/p>\n
The fact that all employees attending the workplace have received an approved vaccine and are therefore highly likely to possess immunity may justify reducing certain health protection measures. Consequently, employers have a legitimate interest in obtaining timely and comprehensive information about the vaccination and immunity status of their workforce. This is particularly important because it enables employers to organise on-site work more efficiently and bring productivity closer to pre-pandemic levels.<\/p>\n
This reasoning is supported by recent guidance issued by the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) (Reference No. NAIH-3903-1\/2021). The authority expressly states that, for employment, occupational safety, occupational health or workforce management purposes, and based on an objectively conducted risk assessment concerning workplace biological exposure threatening employees’ health and safety, it may be necessary and proportionate in certain roles or groups of employees for an employer to learn whether employees possess immunity against the coronavirus.<\/p>\n
The authority’s objective closely mirrors the intention underlying the Labour Code. According to the NAIH guidance, the purpose of this regulation is to protect, on the one hand, the immunised employee; on the other hand, fellow employees; and, thirdly, third parties who may come into contact with the employee, such as clients. It also supports employers in complying with their legal obligations.<\/p>\n
The NAIH emphasises that information relating to vaccination status constitutes health data under the GDPR.<\/p>\n
As employers qualify as data controllers under the applicable data protection rules (Article 4(7) GDPR), they bear responsibility for ensuring the lawfulness of any data processing they undertake. Employers must clearly inform employees, without undue delay, of both the purpose and legal basis of the data processing.<\/p>\n
The purpose of processing, consistent with the considerations outlined above, is relatively straightforward: ensuring workplace safety and facilitating lawful workforce management. The importance of acquiring protected status, most commonly through vaccination rather than through recovery from illness, hardly requires further explanation.<\/p>\n
The NAIH further points out that the sole purpose of such data processing may be to enable employers to take the measures necessary to comply with employment law, occupational safety, occupational health and organisational requirements, and therefore to determine whether employees possess immunity against COVID-19.<\/p>\n
The authority also stresses that the purpose must be genuine and demonstrable. Accordingly, if an employer decides to collect such information, it must actually use the information to take appropriate measures and properly document those actions. In addition, the scope of data processed must be suitable and necessary for achieving the intended purpose.<\/p>\n
It is also important to mention the GDPR principle of data minimisation (Article 5(1)(c)), which requires that only health data that is strictly necessary and proportionate for the stated purpose may be processed.<\/p>\n
Government Decree No. 60\/2021 (II.12.) on the certification of immunity against coronavirus regulates the official registers in which vaccination status is recorded and identifies the authorities responsible for maintaining those records. The decree further provides that immunity may be evidenced either through an application provided by the operator of Hungary’s Electronic Health Services Space (EESZT) or through the official immunity certificate.<\/p>\n
Based on these rules, employers may process only the data contained in the application or the immunity certificate, which qualifies as an official public document. No additional information relating to immunity against coronavirus may lawfully be collected or processed for this purpose.<\/p>\n
Regarding the necessity and proportionality of processing health data, the NAIH also emphasises that such measures can only be justified where the level of risk is sufficiently high. For example, the need for extensive collection of immunity-related information cannot be demonstrated in the context of permanent remote work, where exposure to infection in relation to colleagues is not a relevant factor.<\/p>\n
The principle of proportionality further means that employers may only require employees to display the application or present the immunity certificate. Employers may not make copies, scans or photographs of these documents, nor may they store the information contained in them in any form.<\/p>\n
By reviewing immunity certificates, employers may implement appropriate organisational measures. For example, they may require colleagues who are not yet protected to continue working remotely, or they may position a non-immune employee’s workstation next to that of an immune colleague.<\/p>\n
It is therefore clear that vaccination and the resulting immunity status have significant employment law, occupational health and safety, and data protection implications. This summary has highlighted the most important considerations.<\/p>\n
Should you require legal advice on this topic or any other matter, whether as an employer or an employee, please do not hesitate to contact our office.<\/p>\n<\/div>","protected":false},"excerpt":{"rendered":"
Back to the Workplace After the Virus: Can an Employer Request Proof of Immunity from Employees? If So, What Data Protection Obligations Apply? In the weeks following the third wave of the COVID-19 pandemic, an increasing number of employers have decided to resume in-person work, which may result in the mass return of employees to […]<\/p>\n","protected":false},"author":32,"featured_media":55421,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[139],"tags":[],"class_list":["post-55420","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-en"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\t