After working from home for an extended period of time, many organizations are allowing their employees to (partially) return to the office workspace. Their return to the office brings up a lot of (HR and privacy related) questions amongst employers, such as “can we require our employees to be vaccinated against Covid-19?”; and “can we ask the vaccination status of our employees”? In short, what are the possibilities for an employer to ensure a safe working environment during the Covid-19 pandemic, while complying with labor and employment law and/or data protection law requirements in The Netherlands?
Vaccination status
Employers may have reasons to be interested in the Covid-19 vaccination status of their employees, which is considered to be ‘personal data’ regarding the employee. When this information is being processed (e.g. stored, registered or filed), the General Data Protection Regulation (“GDPR”) should be taken into account.
Special category data
The vaccination status of an employee is considered personal data relating to health, which is considered a special category of personal data. As a consequence, a more stringent regime of the GDPR applies; processing of these special category data is prohibited, unless one of the exceptions in the GDPR applies. These possible relevant conditions are (in short) either (i) conditions with a basis in law; or (ii) based on consent of the employee, as further described below.
(i) Conditions with a basis in the law
In other European Union countries, processing health data (i.e. vaccination status) could be possible based on a national equivalent of the employer’s duty of care. This duty of care states that the employer must behave as a reasonable and fair employer (e.g. by taking care of the health of its employees). However, the Dutch data protection authority has a strict interpretation when it comes to processing health data, and does not seem to consider this basis in law as a possibility for an employer to process health data.
(ii) Consent
When asking for consent, it is required that the employee has a genuine choice (i.e. a real choice and control) to provide, refuse or withdraw its consent. The foregoing is usually not the case if there is a clear imbalance of power, which is a particular issue in employment relations. However, even in an employment relation, there are still situations possible where consent is freely given. This will be the case if the employer makes clear (and ensures) that the processing is optional and that there are no adverse consequences to those who do not provide consent. Whether the foregoing is indeed possible to achieve in practice, depends on the specific reason and context for requesting this information.
Conclusion
Processing (e.g. storing, filing, using) the vaccination status of an employee will in most cases be prohibited. It should be noted, however, that the GDPR does not apply when information is just asked in an oral conversation, and not registered, stored, filed and/or otherwise processed afterwards. In certain cases, this could be a possibility for organisations (although other legislation could still apply, see 2. Below). In addition, we notice in practice that organizations try to develop a deeper understanding of the underlying reason for processing this information (e.g. is the vaccination status indeed necessary, or is general information whether an employee is eligible to travel (despite the specific reason) sufficient?.
Mandatory vaccination
In principle, an employer cannot require its employees to get vaccinated against Covid-19, since this would violate the employees’ fundamental rights. However, it could be argued that a limitation of the employees’ fundamental rights can be justified under special circumstances. The Dutch Supreme Court ruled in 2007 that such a limitation is only justified when (i) the limitation is necessary, (ii) the limitation is proportional, and (iii) no less drastic measures can be applied. In this regard, it should also be considered that under Dutch law, the employer has a duty of care towards its employees, which includes the obligation to ensure a safe workspace and the obligation to protect employees (from Covid-19). Nonetheless, it is uncertain whether an employer can actually require employees to get vaccinated, and attach negative consequences to a refusal to get vaccinated (e.g. a dismissal or a change of position), except in special circumstances.
Conclusion
Some companies, such as LeasePlan, have already introduced a policy to only allow vaccinated employees to return to the office. We recommend carefully determining whether it can be argued that such a limitation of the employee’s fundamental rights can be justified given the specific circumstances, before implementing such a policy. Hopefully, new case law in the coming months will further clarify which special circumstances may justify such a limitation.
