As the Covid-19 vaccination process gathers steam, employers around the world consider what their vaccination strategy will be once (and if) the vaccine becomes available to all employees. In this context, companies examine to what extent they can require employees to take the vaccine and/or restrict those who are not vaccinated from entering the workplace.
The Luxembourg Data Protection Authority (“CNPD”) addressed on 11 February 2021 some of these issues in its recommendations with respect to personal data collection in the Covid-19 sanitary crisis context (the “Recommendations”). We have summarised below how the CNPD proposes to answer some of the most pressing questions of the moment and review these in light of the Luxembourg employment law.
Key take-aways
- At present, employers cannot oblige their employees to get a vaccine but may consider setting up a vaccination campaign to encourage employees to get vaccinated.
- Vaccination data is a “data concerning health” falling under the category of special category personal data pursuant to the General Data Protection Regulation (“GDPR”). Its processing, including by (i) requiring employees to disclose their vaccination status, (ii) keeping records thereof, and (iii) taking actions on that basis (such as granting or refusing access to the workplace), is not allowed as the law currently stands.
