The European Data Protection Supervisor (“EDPS”) has issued a guidance document entitled “Return to the Workplace and EUI’s (European Institutions, Agencies and Bodies) screening of Covid immunity or infection status” (the “Guidance”).
Basically, the Guidance is to be applied by the EUIs; however, its findings might also be relevant for other employers.
Personal data regarding Covid-19 vaccines
In the view of the EDPS, as long as Covid-19 vaccinations are not obligatory in the EU, processing of employees’ vaccination-related personal data is neither necessary nor proportional. It is also not obvious whether this kind of data processing has an appropriate legal basis. Accordingly, the Guidance recommends that employers avoid collecting and processing employees’ personal data in regard to vaccination status, irrespective of whether providing this data is voluntary or obligatory.
However, the Guidance does not preclude processing of aggregated health data (e.g. for the purpose of preparing a risk assessment), provided that this data is anonymized.
This approach is consistent with the practice of the Hungarian Data Protection Authority (“Authority”) in regard to processing the Covid immunity status of employees as elaborated on in the guidance issued by the Authority on 1 April 2021.
Antigen test required by employers
In connection with data processing related to antigen tests, the Guidance states that introducing obligatory antigen tests may be considered necessary and proportional only in exceptional cases, such as exposed positions or in situations where the health and safety work conditions cannot be ensured by less invasive measures (e.g. social distancing and use of masks).
Use of EU digital Covid certificates
The essential function of EU digital Covid certificates is to ensure freedom of movement within the EU. The Guidance also provides that using the EU digital Covid certificate for other purposes requires explicit authorization under national law. In accordance with the Guidance, EUIs can only use EU digital Covid certificates if the purpose for which the data processing is intended cannot be achieved through a less invasive measure.
By Edina Czegledy, Counsel, and Laura Lukacs, Legal Advisor, Noerr
