The corona proof: can you check it as an employer now?

On Nov. 2, Hugo de Jonge announced that it should be possible to require workers to show proof of vaccination or a negative test. A number of scientists from Leiden University argued in a letter to the Trouw of Nov. 9, 2021, that even without new legislation, there are no legal objections to requiring corona proof at work. This position is striking, since the legislature and the Personal Data Authority apparently think otherwise. We hold up the considerations from the letter in this blog.

Duty of care of employer

The scientists hypothesize that it contributes to a safe work environment if only vaccinated, negatively tested or corona recovered personnel are present in the workplace. Indeed, unvaccinated and non-negatively tested workers are more likely to get sick at work, infecting customers and colleagues. Employers must provide a safe working environment and must take all possible measures to do so. It is conceivable that a QR code requirement could fall under the employer's duty of care since it creates a safer work environment. However, it is wiser to first introduce other measures that are less intrusive to employees.

Is asking for corona proof AVG-proof? 

Among other things, the letter (too) briefly discusses the processing of health data, such as the scanning of corona evidence. The General Data Protection Regulation (hereinafter AVG) prohibits the processing of health data. However, exceptions are possible on "grounds of substantial public interest" or because processing of the data is necessary "in view of the obligations of" employers.

Those obligations are detailed in the Netherlands in the UAVG (AVG Implementation Act). The UAVG has a number of exceptions to the ban on processing health data. For example, health data may be processed by employers for the purpose of claims that depend on the employee's state of health. Think of the right to sickness benefits. There is also an exception when an employer processes an employee's health data for the purpose of reintegrating the employee. Such as, for example, the provision of (disability-related) employment services. However, it is, in my opinion, difficult to argue that the processing of health data through the mandatory display and scanning of the corona certificate can be classified under the aforementioned exceptions. After all, this is not carried out for the purpose of reintegrating the employee or for the employee or employer to claim benefits or other provisions.

So the AVG effectively precludes employees from being required to show corona evidence until a specific legal basis for doing so is created as an exception to the health data processing ban.

It is important to realize that with regard to measuring the temperature of employees, some clarification has been given by the Personal Data Authority regarding the application of the AVG. The AVG does not apply when some conditions are met. An employer may only read the temperature, may not record the temperature in a file, the measurement may not be automated, and the processing may not have an automated effect. After all, as long as no personal data is processed, the AVG does not apply. If, as an employer, you do not meet one of these three conditions, then the AVG does apply, you are processing health data, and with it the processing ban. Therefore, you are not allowed to measure the temperature of employees.

It is not yet known to what extent these requirements apply to corona certificates, but it is quite conceivable that they should be applied similarly. This application leads to problems when employers start scanning QR codes, as this processes data. This does not meet the conditions given by the Personal Data Authority. That means that even this exception situation is unlikely to solve the QR code.

Thus, scholars push the AVG aside - unfairly - somewhat easily.

The corona evidence at work in light of the limitation of fundamental rights

When you require employees to display a QR code, in principle - in addition to the possible applicability of the AVG - this entails a violation of both the right to bodily integrity and privacy protection. These fundamental rights may only be restricted under circumstances, and after balancing interests. The scholars believe - on the basis of two Supreme Court rulings - that a balancing of interests with respect to the employer's interest (showing the corona evidence by employees) on the one hand and the infringement on the fundamental rights of employees on the other hand may turn out in favor of the employer. The Supreme Court held in both judgments that a mandatory test - in one case a drug test in Aruba, in the other a test for dangerous substances in the body - was permissible for employees. Incidentally, the choice of the drug test ruling is odd, since the AVG has no effect in Aruba and thus can only be tested in terms of fundamental rights. The problem with the ban on the processing of health data as mentioned above was therefore not an issue in Aruba. Furthermore, both rulings deal with a single test on one employee, whereas the mandatory corona proof showing involves a daily processing of personal data and also requires systematic testing of some employees (non-vaccinated employees).

The standard of review from these judgments has been used by scholars to weigh the interests of the parties. First, it must be assessed whether there is a legitimate purpose for the infringement of the aforementioned fundamental rights. In principle, the overall health and safety of workers is a legitimate goal. Next, the means, the mandatory QR code, must be appropriate to achieve that goal. In this regard, too, the scientists do not foresee any problems. After all, there is less risk of sick workers if there are only vaccinated, negatively tested or recently recovered workers in the workplace. Furthermore, it must be examined whether the invasion of your employees' privacy and right to privacy is proportionate to the employer's interest in achieving the goal. An important difference between the rulings cited by the scientists and the mandatory QR code is that an unvaccinated employee will have to take a test for every working day. Beyond any practical concerns, this also leads to a daily violation of the aforementioned fundamental rights. Scientists step over the intensity or frequency of the infringements rather quickly, which may be decisive in the balancing of interests. However, for each sector or even each company, this balancing of interests may be different. Finally, it must be assessed whether there is a less intrusive measure to achieve this goal. Employers whose employees can perform their work from home without any problems have a less intrusive measure at hand; after all, the employees can work from home. Employers where this is (virtually) not possible may indeed have no less intrusive measure available. However, employers should also consider other measures, such as keeping sufficient distance between employees, wearing face masks and other protective clothing, and cleaning hands. To what extent QR code scanning still contributes to worker safety after these measures have been implemented is difficult to arrow.

Fortunately, the letter acknowledges that different risks must be weighed for each employer and that no unequivocal position can be taken regarding allowing the QR code requirement. Legislation will (most likely) provide more clarity and certainty for employers.

Conclusion

In principle, the AVG applies to the scanning of a QR code by the employer. In that context, a processing ban applies to which there are no statutory exceptions in the Netherlands yet.

In addition, a violation of fundamental rights is possible only if it has been preceded by a careful weighing of interests and that weighing of interests has rightly tipped over to the side of the employer. That will depend on the situation. The balancing of interests will not be in favor of the employer in all cases. Of particular importance is whether the employer has alternatives to achieve the same goal: a safe working environment.

To what extent a QR code requirement is consistent with that, of course, is not yet entirely clear. The considerations in the letter are somewhat brief, but there seems to be an opening to ask employees for corona proof without prior legislation if you disregard the AVG and no health data is processed. However, the infringement of fundamental rights is not easily justified, so some restraint is required.

In addition, because the AVG and UAVG still concretely stand in the way of the QR code requirement, or at least its processing by the employer, waiting for legislation seems a wiser choice. Of course, you can already take other measures (keeping your distance while working, cleaning hands, mouth caps, working from home as far as possible, etc.) to make the workplace safer until then.