In the Netherlands, people are currently being vaccinated against the coronavirus on a wide scale. The first in line are certain professional groups, elderly people and people in medical risk groups; the rest of the Dutch population will follow afterwards. It is not compulsory to get a vaccination against the coronavirus, but there are campaigns encouraging people to get the shot. Only by large-scale vaccination can society be re-opened little by little.
The vaccinations against the coronavirus also raise questions among employers. Can employees in the Netherlands be made by their employer (directly or indirectly) to get a vaccination? For example, because employees who have not been vaccinated are not admitted to the workplace anymore? Or can employers introduce a vaccination leave in order to encourage people to get vaccinated?
Registration is contrary to privacy law
Employers are not allowed to force their employees to get vaccinated. Besides, privacy laws do not allow employers to record whether or not an employee has been vaccinated. This rule applies also if an employee voluntarily discloses his/her vaccination status to the employer. Since employers cannot record the vaccination status of their employees, this information cannot be used either to attach consequences to an employee's refusal to take the vaccination. The employer is not supposed to be aware of this information. Therefore, employees cannot be refused access to the workplace for this reason.
The General Data Protection Regulation (GDPR) only allows the processing of personal data – including information about a person's health, such as the vaccination status – for an explicit, specified and legitimate purpose. The Dutch Data Protection Authority – the Dutch DPA – maintains that it is not certain whether employers can comply with this rule if they record corona vaccinations. This has to do with the fact that it is not yet certain, according to the National Institute for Public Health and the Environment (RIVM), whether vaccinated persons are contagious. Therefore, both vaccinated and non-vaccinated persons have to follow the same rules for the use of personal protective equipment. The Dutch DPA maintains that as long as this is the case, recording the vaccination status of employees servers no explicit, specified and legitimate purpose. This means that there is no reason for employers to record this information.
The GDPR also provides that employers are not allowed to process any data relating to the health of their employees, unless there is a statutory exception. Such an exception may be the express consent of the employee, or it may follow from rules of national law, such as the Dutch GDPR Implementation Act (“UAVG”). The Dutch DPA believes that employees are usually not 'free’ to give their consent, since they are in a relationship of dependency. However, consent is only valid if it has been freely given. Employees may feel obliged to share this information because their employer registers the vaccination status of the employees. They may feel this way, for example, if employees with a vaccination are given more rights than employees without a vaccination. According to the Dutch DPA, consent is therefore not a legally valid ground for the processing of the vaccination status of employees. Only in special situations, where the withholding of consent has no adverse consequences for employees at all, consent given to the employer may be valid.
In summary: at present, the rules of the GDPR and other (employment-law) Dutch laws do not offer sufficient ground to allow the processing of the vaccination status of employees. There is no specific exception under national law that allows employers to register data about corona vaccinations of employees. The Dutch DPA emphasizes the fact that the processing of such health data can only be done by an arbodienst (occupational health and safety service) or by a company doctor. Under certain circumstances the company doctor might advise the employer to let the employee work in a different place, for example if the employee does not take the vaccination but does work in a place where there are extra health risks. This could be the case in a care institution.
Vaccination leave
There are also employers who want to give their staff some hours off to get the injection. Extra time off may make it easier for employees to get vaccinated. However, this will not always be possible. After all, if an employer introduces ‘vaccination leave’, it will also have to register which employees are taking or not taking this leave. This way, the employer would still register who has had the injection, which is a registration of health data.
On certain conditions employees may also use the existing ‘contingency leave’ for getting the injection. This leave is meant for visits to a doctor or hospital that cannot reasonably be scheduled outside work hours. During contingency leave, the employee is entitled to wages. Therefore, this option exists if the appointment for the vaccination can only take place during work hours. However, the tricky point remains that employers cannot register the reason why an employee takes contingency leave.
Conclusion
In the Netherlands, vaccinations against the coronavirus are voluntary. Employers too are not allowed to force their employees to get vaccinated. Besides, privacy laws do not allow employers to record whether or not an employee has been vaccinated. This rule applies also if an employee voluntarily discloses his/her vaccination status to the employer. A company doctor is permitted to inquire about vaccinations and other medical information if there is a good reason to do so. However, the company doctor is not permitted to share this information with the employer.
If you have questions on this topic, you are welcome to contact Soo-Ja Schijf or Laura Poolman.
