Vaccination registration: is it allowed?

We can be brief about a (direct) mandatory vaccination policy: it does not exist and will not be introduced for Dutch residents. Employers also cannot obligate their employees to get vaccinated. Such an obligation would conflict with several fundamental rights, such as the right to physical integrity and the freedom of religion.

Nevertheless, a vaccination passport may be introduced. The question then presents itself whether employers may ask employees whether they have been vaccinated against corona and whether employers may register that information.

One of the general principles of personal data processing is that it serves a legitimate purpose. It remains to be seen whether registering corona vaccinations of employees will serve such a legitimate purpose, since it is currently unclear whether vaccinated persons are in fact no longer contagious.

If a vaccinated person can still pass on the virus, there would appear to be no real difference in terms of risk or employability between vaccinated and unvaccinated employees; in that case an employer has no legitimate interest in registering corona vaccinations.

If it is established that vaccinated persons can no longer be contagious, an employer may have a legitimate reason to register vaccinations. In principle, however, the processing of health data, such as vaccination data, is prohibited, unless the data processor (in this case the employer) can rely on one of the exceptions set out in the General Data Protection Regulation (GDPR).

The exceptions listed in the GDPR currently do not provide a legitimate ground for the registration of corona vaccinations by employers. The “data subject’s express consent” exception does not suffice, because it is generally assumed that employees in an employment relationship cannot “freely” give their consent. Moreover, there are currently no laws in the Netherlands that allow employers to process employee health data. Only the Arbodienst (Occupational Health and Safety Service) or the company doctor may do so.

The latter has already been confirmed by the Dutch Data Protection Authority in the Uniper Report, which addressed the question whether employers may use alcohol and drug tests in the workplace. Also in that report the conclusion was that that was not permitted, because employers lack the legal authority to process employees’ medical data (including the outcome of these tests).

Employers’ organisations have been calling for some time for the legislation on this point to be broadened. Last year that was reason for the State Secretary for Social Affairs and Employment to make preparations for allowing alcohol and drug tests in the workplace in specific high-risk situations. The State Secretary has stated that she wants to discuss this matter further with the social partners. It is not yet known whether corona testing and vaccination registration will form part of those consultations. We will keep you informed of any developments.

For information or advice on this subject please contact Lise van den Heuvel (+31-6-23492248).

This article was published in the Newsletter Vestius of March 2021