Information on vaccination or recovery from COVID-19 in the employment relationship

Right to information in case of mandatory vaccination by way of exception

If employers can demand that employees be vaccinated against COVID-19, they can also insist that employees provide them with proof confirming the vaccination. However, vaccination in the employment relationship may only be mandatory in very exceptional cases, i.e. potentially only for certain groups of employees – this is mainly discussed and advocated with regard to medical staff in hospitals and employees in the care sector – and even then only if the health intervention, which a vaccination against COVID-19 represents, is adequate and reasonable in the individual case.

We have already taken a closer look at the issue of mandatory vaccination in the employment relationship in our article "(No) mandatory vaccination in the employment relationship“.

Right to information from employees performing certain activities in health care facilities

To the extent necessary to prevent so-called "hospital-acquired infections" and to prevent the spread of pathogens, employees who are employed in certain healthcare facilities (including, but not limited to hospitals, facilities for outpatient surgery, medical or dental practices as well as other practices in the field of human medicine) are obliged to provide their employer with information on vaccination against COVID-19 (vaccination status) or their immune status with regard to COVID-19 (serostatus), so that the employer can decide on the establishment of an employment relationship or on the type and manner of employment (paragraphs 23 (3), 23a German Infection Protection Act).

The requirement that the information must be necessary to prevent "hospital-acquired infections" and to prevent the further spread of pathogens means that information on the vaccination or immune status cannot be demanded from all employees across the workforce. Instead, it always depends on the specific circumstances of the individual case. In particular, it is relevant whether COVID-19 can actually be transmitted to patients as a result of an employee's job-related activities.

In all other cases, right to information only permissible under data protection laws

In all other cases, a right to information only exists if it is permissible under data protection laws. The reason for this is that asking about a person's vaccination or recovery status and recording the answer constitutes a processing of personal health data. The processing of health data in the employment relationship is only permissible if it is necessary for the employer to exercise his or her rights or to comply with legal obligations under the employment relationship and if the employer’s interest in processing the health data outweighs the employee’s interest in not having his or her health data processed.

The occupational health and safety provisions currently in force in Germany – in particular the SARS-CoV-2 Occupational Health and Safety Regulation (SARS-CoV-2-Arbeitsschutzregel) and the SARS-CoV-2 Occupational Health and Safety Ordinance (SARS-CoV-2-Arbeitsschutzverordnung) – still make no distinction in their specifications which occupational health and safety measures employers are required to take with respect to whether or not an employer's workforce consists of employees who have been vaccinated against COVID-19 or employees who have recovered from a COVID-19 infection. Thus, employers currently do not need to know the vaccination or recovery status of their employees in order to determine occupational health and safety measures and the question about it is, at least at present, impermissible under data protection laws.

Conclusion

Employers can currently only request information on whether employees have been vaccinated against COVID-19 or have already recovered from a COVID-19 infection if vaccination is mandatory by way of exception or if employees perform certain activities in healthcare facilities.

In all other cases, employers currently do not need to know the vaccination or recovery status of their employees in order to determine occupational health and safety measures, and asking about it is, at least at present, impermissible under data protection laws.