Dealing with vaccinated and non-vaccinated employees at the workplace - Is the employer allowed to ask about vaccination status and deploy its employees differ-ently depending on the answer?

In many companies in Germany, company doctors are all set to vaccinate employees against Covid-19. The official go-ahead for this is imminent and employers now have cause to hope for the "return" of their workers from home office and a normalisation of company procedures. At the same time, however, this gives rise to very important questions of labour law and data protection law, which we would like to answer for you below:

1. Are employers allowed to ask employees about their corona vaccination status?

As vaccination is not compulsory in Germany to date, the question arises as to whether the employer is entitled to ask its employees about their vaccination status and to demand proof from them of any voluntary vaccination.

1.1 Right to ask questions

Pursuant to § 106 of the German Industrial Code (Gewerbeordnung, GewO), the employer may, within the limits of the employment contract, collective bargaining regulations and applicable laws, stipulate more detailed requirements for the performance of the employment relationship. Accordingly, the employee is fundamentally obliged to provide the employer with the information necessary to perform the employment relationship. Case law grants the employer the right to ask questions "if the employer’s interest in having the employee answer its question is justified, equitable and merits protection for the performance of the employment relationship and if the employee's interest in keeping his data confidential does not outweigh the employer's interest in collecting such data". On grounds of the employer's duty of care and in order to reduce the risk of infection at the company and during performance of the work owed, a justified request by the employee for information about the employee's state of health can therefore be argued in principle.

1.2 Admissibility under data protection law

However, since the request for information is only permitted within the framework of the applicable statutory provisions, the employee data protection provisions in particular must be observed in this respect. Proof of (non-)vaccination constitutes personal health data within the meaning of Art. 9 (1) GDPR. Data processing in the employment relationship is therefore generally governed by Art. 9 (2) GDPR or Art. 88 GDPR in conjunction with § 26 (3) German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG). Accordingly, the data processing may be allowed either (i) on the basis of a balancing of interests or (ii) with the employees’ consent.

1.2.1 Consent

Consent cannot be used as a suitable legal basis across the board, since its validity often fails because of its voluntary nature. If the employer uses the information on the vaccination status to decide on measures regarding individual employees that entail negative consequences for such employees, then the employees are only disclosing the desired information under the pressure of these consequences. The resulting lack of voluntariness leads to the invalidity of the consents.

However, consent remains a valid legal basis for individual processing purposes. An example of this is voluntary surveys through which the employer wishes to gain an overview of what proportion of the workforce at its company has been vaccinated. When conducting such surveys, however, the results definitely should not be analysed on a personalised basis, as this is not necessary to achieve the purpose. In addition, employers must provide clear information prior to participation in the survey – besides complying with other requirements - that the evaluation will be based on aggregated data and that there will be no consequences if an employee refuses to participate or indicates that he or she has not been vaccinated (despite possibly already having had the opportunity to be vaccinated).

1.2.2 Balancing of interests

On the basis of § 26 (3) sentence 1 BDSG, data processing is permissible if (i) it is necessary for the performance of the employment relationship and (ii) there is no reason to assume that the data subject's legitimate interest in the exclusion of the processing prevails.

Based on the latest scientific findings and current statements by the Robert Koch Institute (RKI) on the transmissibility of SARS-CoV-2 by fully vaccinated persons, it is justifiable in individual cases to consider the need to process the vaccination status as more important than the employees’ interests. The decisive factors here are the circumstances at the respective company and the measures for the purpose of which the information on vaccination status is being processed. Individual data protection authorities take a different view, categorically rejecting any processing of employees' personal data on their vaccination status on the basis of § 26 (3) sentence 1 BDSG.

Particularly questionable to date was the 'necessity' characteristic of the data processing, as there was no reliable information on whether vaccination prevents transmission of SARS-CoV-2. However, the information situation on this issue has since improved considerably. The RKI states that virus transmission by fully vaccinated persons is "greatly reduced" and that "vaccinated persons no longer play a significant role in the epidemiology of the disease". The RKI estimates that the risk of transmission of SARS-CoV-2 by fully vaccinated persons is lower than by asymptomatic persons with a negative rapid antigen test. Accordingly, fully vaccinated persons are exempt from quarantine measures after exposure to a confirmed infected person. A highly topical study from Great Britain comes to the conclusion that, already after the first vaccination, transmissions within families decrease by 40 to 50 percent.

Taking the new findings into account, in our opinion there will frequently be good arguments in support of assuming both the necessity and the predominance of the employer's interests. Depending on the circumstances of the individual case, the vaccination status of individual employees can have a very significant impact on the performance of the employment relationship. Take, for example, companies whose business model requires them to employ part of their workforce in the field, possibly in high-risk areas. Only knowledge of the vaccination status of their employees will allow such employers to determine who they can deploy in these areas, without having to accept a high risk of transmission/infection or subsequent quarantine. Businesses with open-plan offices could also argue that their interest in processing the data outweighs the rights of the data subjects, as fully vaccinated individuals can return to work on site due to the massively reduced risk of infection. In addition, there are situations in which it is only the information about the vaccination status of individual employees that enables the employer to assess whether it has to pay compensation for loss of earnings pursuant to § 56 (5) German Protection against Infection Act (Infektionsschutzgesetz, IfSG) due to an employee's quarantine obligation. This is because the obligation to pay compensation does not apply if the respective employee could have avoided the quarantine by being vaccinated (§ 56 (1), sentence 4 IfSG).

To the extent the employment relationship can be conducted without an increased risk by conventional milder means, such as those arising from the SARS-CoV-2 Occupational Health and Safety Ordinance (in particular distance and hygiene rules), however, the sooner the legitimate interests of the employees are likely to prevail.

However, it must be taken into account that in any balancing of interests, a not inconsiderable evaluation risk and thus the risk of a data protection violation remains. Individual German data protection authorities have vehemently opposed any processing of personal data on the vaccination status of employees on the basis of § 26 (3) sentence 1 BDSG and still adhere to their strict view. The State Commissioner for Data Protection and Freedom of Information [Landesbeauftragte für Datenschutz und Informationsfreiheit] of Baden-Württemberg, for example, categorically considers it impermissible to enquire as to the vaccination status and calls for a clear prohibition by the legislator. He reiterated this position - explicitly on employee data protection - on 20 May 2021 in the context of a presentation at the euroforum's Data Protection Congress 2021. This view is shared by the State Commissioner for Data Protection and Freedom of Information ofNorth Rhine-Westphalia in FAQ on questions and measures of the employer to protect against corona infections. However, neither authority differentiates according to the concrete circumstances at the respective company. They also do not address the current findings and statements of the RKI on the probability of fully vaccinated persons transmitting SARS-CoV-2 and fail to consider the aspect of exemption from quarantine obligations. It therefore remains to be seen whether case law will follow the authorities' argumentation. Until judicial clarification, companies run the risk of fines under the GDPR, which can be in the millions.

1.2.3 Shop agreement

For companies with a works council, there is ultimately the possibility of data processing on the basis of a shop agreement in accordance with § 26 (4) sentence 1 BDSG. However, it is questionable to what extent this can justify a processing of data in respect of which a balancing of interests according to clause 1.2.2 has shown that the employees’ interests in the exclusion of the processing prevail. The German data protection authorities are once again taking a strict line here, according to which shop agreements cannot justify a lowering of the level of protection under the GDPR under any circumstances. This can be countered with the fact that § 26 (4) BDSG would ultimately be superfluous if it did not even allow the specification of regulations on operational concerns within the framework of considerations.

1.3 Exceptional circumstances of § 23a IfSG

The legal situation is simpler in the cases of the newly introduced § 23a German Protection against Infection Act (Infektionsschutzgesetz, IfSG), which explicitly allows employers to ask employees about their vaccination status. However, the legislator's exemption only covers certain health care professions. According to this, managers of hospitals or nursing services, for example (§ 23 (3) IfSG), may demand proof of the vaccination status of their employees.

2. What points need to be considered when introducing a company vaccination register?

If, in individual cases, the interests of the employer in the processing of data on the vaccination status of individual employees prevail, a vaccination register in which the data are recorded can in principle also be created. However, the data processing in the context of such a register has to comply with all of the obligations generally imposed on data controllers.

• In particular, employees must be informed transparently about the data processing in accordance with Art. 13, 14 GDPR. This concerns, for example, information on the processing purposes pursued and deletion deadlines.
• The general data protection principles of purpose limitation and data economy (Art. 5 (b), (c), (e) GDPR) require that data is only stored for as long as necessary to achieve the purposes pursued.
• In addition, access to the vaccination register is to be granted according to an appropriate role and authorisation concept only to those employees who need information on the vaccination status in order to achieve the processing purposes. This follows from the basic principle of data minimisation under data protection law (Art. 5 (1) (c) GDPR) and the requirements of Art. 25 GDPR (data protection through technological design).

Employers should be cautious about additionally introducing company "corona passes". In contrast to a vaccination register which, as described above, may only be used for strictly specific purposes, a company corona pass has the potential to enormously stigmatise workers who exercise their right not to be vaccinated despite having had the opportunity to do so. This is because a corona pass is publicly visible evidence of an employee's vaccination status, which should not regularly be necessary to achieve the purposes pursued by the processing operation.

3. Can the employer only allow access to the company with proof of a corona vaccination?

An indirect obligation to get vaccinated or to provide proof thereof must also be legally measured against the requirements set out in question 1. This means that if, within the framework of the examination of the individual case, one draws the conclusion that the employer is legally not allowed to ask about the vaccination status and to demand proof, the employer could indeed deny the employee access to the company on the basis of its domiciliary rights in the absence of such proof. However, in this case the employee concerned would have a claim to a default of acceptance wage pursuant to § 615 sentence 1 German Civil Code (Bürgerliches Gesetzbuch, BGB). Hence, in such cases the claim to work "beats" the domiciliary right. Any further action by the employer against employees who lawfully refuse to provide proof of vaccination in accordance with the principles described above would also violate the prohibition of victimisation (Maßregelungsverbot) under § 612a BGB. If the employee suffers disadvantages as a result, the employer is obliged to compensate him.

If, on the other hand, one comes to the conclusion that the employer is legally entitled to ask about the vaccination status on the basis of the compromise of interests to be carried out and, accordingly, that it can also demand proof, then the refusal of access in the absence of such proof would not have the consequences described above.

In light of the claims to default of acceptance wages, however, caution is advised here: As already mentioned, an assessment risk still exists with regard to the question of "necessity" in the context of the balancing of interests under data protection law. Even if one could justify a prevailing interest of the employer in the collection of data in relation to the individual employee and his or her workplace, this still does not constitute a corresponding general access restriction for all employees of the company. Employers should therefore carefully consider the risks of a more general restriction of access in practice.

4. Are employers allowed to treat vaccinated and non-vaccinated employees differently?

There always has to be an objective reason for the permissible different treatment of vaccinated and non-vaccinated employees. This objective reason could be that, in the opinion of the Robert Koch Institute, vaccinated persons pose a significantly lower risk of infection. However, there are no reliable scientific findings as yet at present. However, as is well known, the legislator has also taken this assessment by the RKI as cause to initiate relaxations with regard to the corona restrictions for (i) fully vaccinated persons and (ii) persons who have fallen ill with Covid-19 but have fully recovered as well as (iii) persons who have tested negative, which means that - in our opinion - employers will also be able to rely on the existence of an objective reason to treat vaccinated, recovered and negatively tested employees differently to the rest of the workforce.

Moreover, different treatment is always permissible and even necessary in cases where, in the context of the risk assessment at the respective workplace, the particularly increased risk of infection requires that vaccinated employees be deployed first in the sector in question. In such cases, the principles of occupational health and safety law require that workers be treated differently because of an increased risk of infection. This will be true in particular in areas where general concepts of protection can only offer limited protection.

Accordingly, the employer has a legitimate interest - particularly with regard to its duty of care - to employ only vaccinated employees (or employees who have contracted Covid-19 and have fully recovered or have currently tested negative) where the risk of infection and serious consequences is particularly high. According to § 15 German Occupational Health and Safety Act (Arbeitsschutzgesetz, ArbSchG), employees are obliged in this context - within certain limits - to accept and implement measures for their own safety. This is because compliance with occupational health and safety regulations is not at the discretion of employees.

In line with the current corona relaxation regulations and in view of the fact that not every person is currently eligible to receive a vaccination offer and, for example, pregnant women are not to be vaccinated, with the result that discrimination on the basis of characteristics of anti-discrimination law such as age and gender is also likely to become an issue the event of a differentiation, we would, however, recommend not currently differentiating on the basis of vaccination status alone, but that vaccinated persons should be treated in the same way as those who have recovered and those with an up-to-date negative rapid antigen test.

5. Is the employer allowed to prohibit unvaccinated employees from entering social areas?

In certain circumstances, exclusion from certain benefits is also likely to be lawful. It is conceivable, for example, that an employer could deny non-vaccinated employees access to usual contact points, such as the canteen or social rooms, where this is not absolutely necessary for the performance of the work. At first glance, such measures may seem to put vaccinated employees in a better position. However, the ban is at the same time a necessary protective measure and therefore essentially serves to fulfil the employer's duty of care to protect the entire workforce.

It is questionable whether this can constitute a violation of the prohibition of victimisation pursuant to § 612a BGB. Discrimination can be assumed if the employer was able to choose between different measures. Currently being discussed in this context is whether rapid tests might be an alternative to access bans. Although one can also cite the latest appraisals of the RKI here, which assesses the risk of transmission of SARS-CoV-2 by fully vaccinated persons as lower than by asymptomatic persons with a negative rapid antigen test, there is still the risk that a court might view the admission of rapid tests as a milder remedy than the exclusion of employees from social facilities.

6. Assuming the employee voluntarily discloses his or her vaccination status to the employer, can the employer then request proof?

The employer's request for proof of the existence of a vaccination by means of a suitable document is inadmissible if the prerequisites for the right to ask questions and the admissibility under data protection law set out in question 1 above have not been met. Rather, it is the voluntary decision of the employees how and to what extent they wish to inform the employer about their personal vaccination status. A compulsory obligation to present a specific document (vaccination certificate, medical certificate) therefore does not exist in these cases.

Back to list