Contrary to earlier announcements, the Polish government has decided not to refer for further work a bill explicitly providing for the right of employers to require employees to show a COVID-19 vaccination certificate. What does the lack of this regulation mean in practice? Does it prevent employers from verifying the fact of vaccination?

What does GDPR say about this?

The information regarding vaccination must undoubtedly be considered as data concerning health within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) – the "GDPR". Indeed, the GDPR considers as such data any personal data about an individual's past, current and future physical or mental health – including the provisions of health care services – that reveals information about the individual's health status. Information about the acquisition of immunity to COVID-19 undoubtedly falls within such definition of health status.

On the other hand, the processing of data concerning health, as sensitive data, is in principle prohibited. However, the prohibition to process such data is not absolute. The GDPR provides for numerous exceptions in this regard. The following exceptions may apply to employment relationships in the area of vaccination certificates:

  • the explicit consent of the data subject; and
  • the necessity of the processing for the purposes of carrying out obligations and exercising specific rights by the controller or the data subject in the field of, inter alia, employment law.

Therefore, the answer to the question of whether it is permissible to request information from employees about COVID-19 vaccination should, in our opinion, be sought in the labour legislation.

What does labour law say about this?

The Labour Code contains a catalogue of information that employers may request from employees and candidates for employees. These include, among others, information on name and surname, basic contact details, information on education or previous career history. There is no information on the employee's state of health on this list. Therefore, some have concluded that it is not acceptable to ask employees to provide details of their health, including information about any medical procedures they have undergone.

However, it should be noted that the catalogue described above is open. The employer may request other personal data, if it is necessary to exercise the right or to comply with the obligation resulting from the provisions of the law. What is more, although in principle the provision of personal data takes place on the basis of the employee's statement, the employer has the right to verify such a declaration and to request the presentation of documents confirming its truthfulness. Does this apply in the case of information about undergoing vaccination and the vaccination certificate?

In our opinion, yes.

Healthy and safe working conditions

Firstly, the source of this entitlement of the employer lies in the legislation on responsibility for the health and life of employees.

An employee's right to work in safe and healthy conditions is one of the economic rights and freedoms constitutionally protected alongside the right to property, the right to freedom of work, the right to health care or the right to social security.

In turn, the employer's obligation to ensure safe and hygienic working conditions is one of the basic principles of labour law. While doing so, the employer is obliged to protect the health and life of employees by making appropriate use of the achievements of science and technology, thus applying scientific "innovations", even anticipating the legislator in this respect.

According to the Labour Code, the employer should in particular:

  • organise work in such a way as to ensure safe and healthy working conditions; and
  • respond to health and safety needs and adapt the measures taken to improve the existing level of protection of workers' health and lives, taking into account changing working conditions.

In a pandemic context, one of the factors an employer should consider when organising work is, among others, the risk of spreading COVID-19 among the personnel.

For example, in connection with the large-scale COVID-19 pandemic occurring in Poland, the Polish legislator introduced the obligation to wear masks, among others, in workplaces if there is more than one person in the room, unless the employer decides otherwise. Therefore, the final decision on how to organise work in this respect was delegated by the legislator to the employer.

At the same time, it is important to emphasise that hygienic working conditions should not only mean that workers have access to running water or personal hygiene products, but also that they are comfortable when performing their work. Many workers complain about the discomfort caused to them by working in masks. This is particularly the case for workers who, due to the nature of their duties, do not have the opportunity to remove their masks for the entire working day. These people often made the decision to vaccinate with the idea of being able to remove their masks and work in more comfortable conditions. The pressure of vaccinated workers to loosen internal restrictions on the wearing of masks is therefore not surprising, particularly during the significant reduction in the number of cases of infection observed during the summer.

This decision, because of its potential impact on the health and perhaps even the lives of workers and their families, as well as the company's potential liability towards those who become ill, should be taken on the basis of reliable data. At the same time, taking into account the general guidelines on how employers should proceed in terms of occupational health and safety, as well as the widely available information on the effectiveness of COVID-19 vaccines and the relatively low percentage of post-vaccination side effect, making a decision on the obligation to wear masks in the workplace based on information about the level of vaccination seems to be the most reasonable from the perspective of medical knowledge and the rationality of such a decision.

Additionally, it should be noted that although the sphere of safe and hygienic working conditions is regulated in the Labour Law. The above comment applies not only to persons employed under an employment contract as such, but also to those performing tasks under civil law contracts due to the extended effectiveness of the Labour Code provisions in this respect.

However, it should be borne in mind that the processing of personal data should always be proportionate. It may therefore not be justified in every case to request vaccination data based on the employer's obligations to ensure safe and healthy working conditions. This may be the case, for example, with respect to the employees who are not in contact with third parties in the course of their duties, e.g. those who, on the employer's instructions, work permanently remotely from their home.

Employee's consent

When implementing the GDPR in the sphere of labour law, the Polish legislator decided to introduce the employer's right to process the employee's personal data on the basis of the employee's consent. Previously, the institution of consent was not implemented in Polish labour law, as it was assumed to be enforced by the employer in employment relations due to the specific nature of the relationship between the parties. After the amendment of the Labour Code in this respect, the validity of such argumentation seems to be limited.

Thus, as long as employees provide their COVID-19 vaccination certificates to the employer voluntarily and can withdraw their consent at any time, the employer will legitimately process the employees' personal data in this regard.

Summary

Given the above, in our view, the absence of an explicit provision entitling employers to request information about COVID-19 vaccination is not equivalent to denying employers such a right. In fact, it can already be derived from general labour law provisions However, the need for explicit statutory confirmation signalled by employers is not surprising given the level of penalties threatening for breach of the GDPR provisions.

It should be borne in mind, however, that before deciding to require employees to present vaccination certificates, an analysis of the suitability of this mechanism in the particular case should be made. Such a request may not always be justified or that introduction of appropriate internal regulations may be necessary.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.