Last year, all over the world but also in Latvia, due to the spreading of Covid-19 infection, it has arised many and different questions about the processing of health data on the working place: how and what can ask an employer to an employee about his/her health conditions?
By the government announcement that Latvialan have been vaccinated against Covid-19, others have still continued to benefit from smart working, meanwhile a number of people hoped to return back to work and take back their activities thanks to the Covid-19 vaccinations that they received.
The State Data Inspectorate tries to answer this question: the employer, by putting an internal order, can oblige employees to provide information on their vaccination status, which will be recollected and stored in the inner registration system?
The personal data protection shall not be an obstacle in the fight against infectious illnesses (including Covid-19). The prevalence of personal data protection shall be an instrument in order to prevent the improper and disproportionate appropriation of information.
The Inspectorate detects that health conditions information (for example if an employee has been infected by specific virus or not, and if to the employee is taken the vaccination against Covid-19) is a special categories of personal data, meanwhile you can get information, by including them into documents and files or by storing them in a electronic system, it is a processing of personal data.
Information of people’s health status (in this case employees) can be processed only according to the procedure states in the article 9 of the Regulation. Before starting the processing, it is necessary to understand if it will be justified.
In addition to offer a legal basis, according to article 5 of the Regulation, the data controller shall respect other conditions required by the Regulation, based on which any personal data processing must be lawfully, fairly and in a transparent manner only for the purpose and in the necessary measure.
In order to explain if there is or not a legal basis for the employer, in order to request information on the reception status if the Covid-19 vaccination and storage the obtained information into the storage system, the State Inspectorate shall take into account the Gabinet Regulation n. 330 of the 26th of September 2000 “Vaccinations legislations”.
The paragraph 30 of this Regulation requires professional vaccination against the following infectious illnesses: Hepatitis B, rabies, tick encephalitis, yellow fever. At the same time, the article 31.4 and the subparagraph 31.5 establish that employees and heads of educational institutions are obliged to control the vaccination of employees which must be in line with the instructions of the vaccination use and to control health passports of vaccinations, as well as keep list and documents about vaccinations and on laboratory tests for at least 10 years since the test, the storage period of risks cases of hepatitis B is 40 years.
Please notice that these legislations do not require the mandatory vaccination against Covid-19, for this reason the employer has not the right to oblige the employee to get vaccinated against Covid-19 or process information about the vaccination.
In the light of what is said before, the Data Inspectorate does not establish that the employer has a legal basis for processing those information, obtaining and storing them.
So, the State Data Inspectorate indicates that the employee is not required to provide this information to the employer.