As the Covid-19 vaccination process gathers steam, employers around the world consider what their vaccination strategy will be once (and if) the vaccine becomes available to all employees. In this context, companies examine to what extent they can require employees to take the vaccine and/or restrict those who are not vaccinated from entering the workplace.
The Luxembourg Data Protection Authority (“CNPD”) addressed on 11 February 2021 some of these issues in its recommendations with respect to personal data collection in the Covid-19 sanitary crisis context (the “Recommendations”). We have summarised below how the CNPD proposes to answer some of the most pressing questions of the moment and review these in light of the Luxembourg employment law.
Key take-aways
- At present, employers cannot oblige their employees to get a vaccine but may consider setting up a vaccination campaign to encourage employees to get vaccinated.
- Vaccination data is a “data concerning health” falling under the category of special category personal data pursuant to the General Data Protection Regulation (“GDPR”). Its processing, including by (i) requiring employees to disclose their vaccination status, (ii) keeping records thereof, and (iii) taking actions on that basis (such as granting or refusing access to the workplace), is not allowed as the law currently stands.
1. Can employers oblige their employees to take the vaccine?
Luxembourg companies cannot oblige their employees to take a Covid-19 vaccine. It is indeed (i) not part of the mandatory measures taken by the Luxembourg government in the context of Covid-19, and (ii) it is consistent with the core principle under Luxembourg employment law according to which employers cannot compel their employees to take any vaccine and more generally speaking, are not entitled to information on the health of their employees.
Under the current legislation, employers whose employees are or may be exposed to Covid-19 according to the risk assessment are simply encouraged to provide their employees with the opportunity to get vaccinated if they are not already immune1. Employers specifically operating in the healthcare sector whose employees are or may be exposed to Covid-19 according to the risk assessment, have to provide their employees with the opportunity to get vaccinated2. Under no circumstances can these employers mandate vaccination on that basis either.
2. Can employers require employees to disclose and/or keep a record of their vaccination status?
Employers can in no event force employees to disclose their vaccination status, be it under Luxembourg employment or data protection law. Consequently, any information provided in this context would have to be obtained on a purely voluntary basis.
Keeping a record of employees’ vaccination is not allowed either. Vaccination data is a “data concerning health” which is considered a special category of personal data and has to be processed in line with the applicable regulations.
Article 9 of the GDPR prohibits any use of such personal data, unless it is carried out under specific listed circumstances. It also provides Members States with the ability to introduce additional limitations with regard notably to the processing of data concerning health.
Accordingly, the CNDP specifically clarified in its Recommendations that private or public bodies cannot themselves collect any data concerning health related to Covid-193, which should reasonably include data collected in connection with employee vaccination. It results from such broad scope of the CNDP ban that employers cannot rely on any legal ground to justify any processing of vaccination data.
3. Can employers take actions (e.g. refuse access to the premises or mandate working from home) against employees who refuse to be vaccinated?
This is not permitted under Luxembourg employment law pursuant to which employers have a duty to give work to their employees. Not allowing access to the workplace could be a breach of this obligation which may be fulfilled by offering the opportunity for the employee to work remotely – teleworking must be agreed between the employer and employee.
Furthermore, non-vaccinated employees could bring claims for discrimination on the basis of health or possibly religious belief shall they be treated differently from vaccinated employees by not being given access to the workplace.
4. How can employers encourage employee vaccination?
To encourage their employees to get vaccinated, employers can set up a “vaccination campaign” to inf orm and encourage employees to get a vaccine as soon as this is made available to them.
5. What to expect next?
We all know that Covid-19 related legislation evolves at a fast pace and should be monitored closely. At the level of the European Union, the European Commission is discussing the possibility of introducing a vaccination passport/certificate within the Schengen area. Whether or not such passport will effectively be implemented and have an impact on vaccination in the workplace, is currently unknown.
1 Article 14 paragraph 3 and Annex VII of the Grand-Ducal Regulation of 4 November 1994 on the protection of workers from the risks related to exposure to biological agents at work
2 Article 4 paragraph 3 of the Grand-Ducal Regulation of 29 April 2019 related to prevention from sharp injuries in the hospital and healthcare sector.
3 “(...) public and private entities cannot put in place files or processing activities relating to health d ata linked to COVID-19 even if an employee voluntarily informs his or her employer that he or she has tested positive for COVID-19 or may present symptoms of the disease. Entities also cannot collect files or data relating to the body temperature of their employees or agents or to other diseases (the “comorbidities”) which may be aggravating factors in the event of a COVID-19 infection. Furthermore, it is not the role of the employer to carry out investigations or “contact tracing”. This task falls to the H ealth Inspection from the moment where an employee or agent tests positive for COVID-19.”
