Legal uncertainty over collection of information on vaccination against COVID-19 by employers
Although a significant number of SARS-CoV-2 infections occur in the workplace, there are still no regulations in Poland allowing employers to collect information on their employees’ vaccine status. This creates legal uncertainty for employers.
Information on a person’s vaccine status is an element of information on health, and thus is a special category of data (sensitive data). Sensitive data is subject to a higher standard of protection. Since the explicit consent of an employee (art. 9(2)(a) GDPR) may be considered not freely given due to the imbalance in the relationship between the employer and employee, processing of such data in an employment context de facto requires a legal basis in national laws (see Art. 9(2)(i) GDPR).
However, in Poland there are no regulations currently in force that enable employers to collect information on employees’ vaccine status.
At the end of August 2021, a proposal was announced to allow employers to obtain information on vaccination, SARS-CoV-2 recovery status, or confirmation of a negative SARS-CoV-2 test result from their employees and, in certain circumstances, also of their clients.
Under the bill, an employer would be able to order a person who has not been vaccinated to work outside their regular workplace or perform a different type of work with a salary corresponding to that type of work. That person could be sent on unpaid leave even if they did not have the SARS-COV-2-infection. The same would apply to employees who have a positive SARS-CoV-2 test result.
However, according to press reports, work on the bill has been suspended and it is not yet clear whether it will be resumed.
Until laws explicitly allowing employers to process such data come into force, we do not recommend collecting such data from employees. Given the strict position of the Polish DPA in this regard, there is a significant risk that it would find processing of vaccination data by employers to be unlawful and impose a fine. We recommend that employers monitor the regulatory changes in this regard.
The lack of legislation enabling employers to collect information on their employees’ vaccine status creates legal certainty for private business at a challenging time of epidemic. It remains to be seen whether the Polish government will take steps to provide employers with the necessary tools to protect their employees before the number of COVID-19 cases surges again in Poland.