In late October 2021, Bulgarian web portal www.actualno.com published an article which brings closer the ongoing topic on processing employee’s vaccination status data in accordance with General Data Protection Regulation (GDPR).
As said by the online portal, the pandemic of COVID 19 opened up a number of new issues. More and more employers are now facing with whether it is allowed or not to collect personal data about vaccination of their employees.
Vaccination status data of employees is considered a special type of personal data. Processing of sensitive data, according to Art. 9, para. 1 of the General Data Protection Regulation (GDPR), is strictly prohibited. In some cases processing these kind of data is permissible but only under certain conditions.
EU hasn’t made consensus yet. In some European countries (Italy, Germany, Belgium) it is consider that employers are not allowed to collect such kind of data and their main argument is the lack of an explicit legal provision in domestic legislation. Other European countries (UK, Austria, Spain), on the contrary, have a more flexible approach which allows employers to collect vaccination data.
According to the Bulgarian Supervisory Authority – CPDP, processing of personal data for vaccination of employees against COVID-19 by the employer should be done under determined rules and not to lead to discrimination against unvaccinated staff in no case.
The employer must clearly define the purpose for which he will collect personal data for vaccination of his employees. It is recommended that employers process as little data as possible and that the data collected must be kept for as short as time as possible, must not be disclosed to third parties and strict access to them must be applied.
Christian Ivanov, Dimitrov, Petrov & Co.
The reasons why employer will process this information must be openly and clearly explained to the employees as well as for how long, what protection measures they will apply and to whom they would possibly disclose it. – said on web portal.
Christian Ivanov, associate at Dimitrov, Petrov & Co., SELA member law firm from Bulgaria, shared his opinion on this subject: “The opinion of the CPDP aims to ensure a balance in the implementation of both the orders of the Minister of Health and the legislation on personal data protection. Employers are given the opportunity to collect only summary information on the vaccination status of their employees to assist them in ensuring healthy and safe working conditions. As an example of a lawful approach in collecting such information, the CPDP provides the use of anonymous and voluntary surveys.
A second option is provided – to perform checks on the EU digital COVID certificate without storing the results. These actions can be performed only upon voluntary presentation of the certificate, and the lack of such presentation cannot be used to restrict the rights and freedoms of individuals.
Change of the regulation in this area is extremely dynamic. In this regard, this week’s new order from the Minister of Health gives reason to believe that the powers of employers in this area should be significantly expanded. In particular, in certain cases, entities subject to the last order should be able to require the provision of certain information on vaccination / health status by their employees, customers, visitors, etc. in order to comply with the requirements of the order. At this stage, it is not clear how the order will be interpreted in the context of the opinion. It is not ruled out that the Commission will soon come up with new clarifications.”
Article taken from www.actualno.com
The whole article available here.