In the Netherlands, plenty of people are currently being vaccinated against the coronavirus. First it will be the turn of certain professional groups, the elderly and people belonging to medical risk groups, followed later by the rest of the Dutch population. Vaccination against the coronavirus is not mandatory. However, people are encouraged through campaigns to get the shot. Only through large-scale vaccination can society slowly reopen.
Vaccinating against the coronavirus also raises questions among employers. For: can an employee in the Netherlands be obliged (directly or indirectly) by his employer to be vaccinated? For example, by not allowing the employee to enter the workplace without vaccination. Or: can the employer introduce vaccination leave to encourage vaccinations in this way?
The employer may not require the employee to be vaccinated. In addition, because of privacy laws, the employer is not permitted to record whether or not an employee has been vaccinated. This rule applies even if an employee himself voluntarily discloses his/her vaccination status to the employer. Since the employer is not allowed to record the vaccination status of its employees, this information also cannot be used in practice to draw consequences when the employee chooses to refuse vaccination. The employer is not supposed to be familiar with this information. Thus, it is not possible to refuse to allow the employee to work for this reason.
Under the General Data Protection Regulation (AVG), personal data - including information about a person's health, such as vaccination status - may only be processed if there is a well-defined, explicit and legitimate purpose for doing so. The Dutch privacy regulator, the Personal Data Authority, says that in the case of corona vaccination registration, however, it is not certain whether employers can comply with this rule. This is because, according to RIVM, it is still uncertain whether vaccinated persons are contagious. Therefore, the same rules for the use of personal protective equipment apply to both vaccinated and unvaccinated individuals. As long as this is the case, recording the vaccination status of employees does not serve a well-defined, explicitly defined and justified purpose, according to the Personal Data Authority. Therefore, there is no reason for employers to record this information.
It further follows from the AVG that employers may not process health data of their employees unless there is a statutory exception. This exception may lie in the express consent of the employee or it may follow from rules of national law, such as, for example, the General Data Protection Regulation Implementing Act (UAVG). The Personal Data Authority is of the opinion that, as a rule, an employee cannot give his/her consent "freely," given the dependency relationship. However, freely given consent is a prerequisite for valid consent. An employee - because his/her employer records the vaccination status of employees - may feel obliged to share this information. For example, if employees who did get vaccinated are given more rights than employees without vaccination. Consent is therefore not a legally valid basis for processing employees' vaccination status, according to the Personal Data Authority. Only in special situations, when the withholding of consent has no adverse consequence for the employee, can there be a valid consent to the employer.
In short, the rules from the UAVG and other (labor law) Dutch legislation - at this moment - do not provide sufficient grounds to process the vaccination status of employees. Therefore, a specific national law exemption ground for employers to register data on corona vaccinations of employees is lacking. The Personal Data Authority emphasizes that only the occupational health and safety service and company doctor are permitted to process such health data.
Furthermore, some employers are willing to grant staff a few hours of leave to get the shot. Extra time off can make it easier for the employee to get vaccinated. But even this does not always prove possible. Indeed, when the employer introduces "vaccination leave," it will also record which employees use it or not. In this way, the employer is still registering who has had the shot and thus health data.
Incidentally, under certain conditions, employees can make use of the existing "emergency leave" to have the shot taken. This is intended, among other things, for doctor or hospital visits that cannot reasonably be planned outside working hours. During emergency leave, the employee is entitled to pay. Therefore, if an appointment for vaccination can only reasonably be made during working hours, this is possible. A thorny issue, however, is (again) that the employer will not be able to record why the employee takes emergency leave.
Vaccination against the coronavirus is voluntary in the Netherlands. Employers cannot force their employees to be vaccinated either. In addition, due to privacy laws, the employer is not allowed to record whether or not an employee has been vaccinated. This rule applies even if an employee himself voluntarily discloses his/her vaccination status to the employer. However, an occupational physician may ask about vaccinations and other medical information if there is a good reason to do so. The company physician may not share this information with the employer. The company doctor could advise the employer to allow the employee to work in another place, for example, if an employee does not get vaccinated but works in a place with additional health risks. This could be the case in a health care facility, for example.
