As jurisdictions around the world grapple with the effects of the more contagious Delta variant, many governments have either taken more restrictive measures or are considering taking more restrictive measures to reduce infection rates and the spread of COVID-19 in the community. As we discussed earlier, France is a country that has taken a tougher stance on promoting COVID-19 vaccinations and even requires employees in certain sectors and industries under Article 12, I of Law No. 2021-1040. to get a vaccination. The French government recently also issued the Pass Sanitaire (ie health passport). Now the French Data Protection Agency (“CNIL”) has issued guidelines on employers’ obligations in relation to the collection of health passport information and COVID-19 vaccination data.
On September 29, 2021, the CNIL published a question and answer style guide analyzing how employers (i) share their employees’ personal data on the Pass Sanitaire and (ii) to check compliance by employees with the COVID-19 vaccination requirements. We summarize some of the CNIL’s legal recommendations and best practices below, but all employers should fully review the guidelines.
Obligations of the “Affected Companies”
Basically, employees or agents of “affected companies” must show their health card to the public during operating hours in order to visit their workplace. The health pass does not require a COVID-19 vaccination, but unvaccinated individuals must have recently tested negative for COVID-19 or have recovered from COVID-19. The health passport can be presented in paper or digital form, especially in the TousAntiCovid application. Only farm managers can apply for the health pass for employees or agents. Farm managers are not allowed to use employees or agents on their own initiative (i) according to their vaccination status or vaccination schedule (e.g. vaccination or (iii) presentation of a vaccination card or the results of a screening test. However, employees and agents of the companies concerned can give their employers the vaccination status on their own initiative It is important that the CNIL guidelines confirm that this approach must remain voluntary and employers must not require employees or agents to provide evidence of their vaccination status as a condition of admission to the job.
Note that only certain authorized persons (e.g. HR) should have access to information about the vaccination status of employees and agents. Therefore, neither hierarchical supervisors of employees nor agents should have access to vaccination status data. For example, the CNIL advises that employers should not require all workers and agents to record vaccination information in a common access document.
Send health pass or vaccination pass by email / SMS
The CNIL guidelines state that employers must not ask employees or representatives to send their health card or vaccination card by email (not even via a business email address) or SMS. This is the case because the employer is not allowed to keep a health passport or vaccination card. If employers receive the health passport or the vaccination certificate from employees or agents by e-mail or SMS, the employers must process and delete the information.
Requesting the health passport for applicants
Employees and agents do not have to present their health passport until they start working at their workplace. A health pass cannot therefore be applied for in the recruitment phase. However, employers are obliged to inform applicants of the submission of their health passport when they start work.
Facilities not affected
Employees and representatives of employers who do not fall under the definition of “affected companies” and are not required to present their health passport may not be asked for information about their vaccination status. If employees and agents are neither affected by the obligation to present a health passport nor by an obligation to vaccinate, employers are not allowed to receive information about their vaccination status. Unless employers have a basis for collecting vaccination information, they are not allowed to collect vaccination information to calculate the vaccination rate of their workforce, even in statistical form. Therefore, employers who are not “affected establishments” cannot restrict access to the workplace only to people who have either been vaccinated or who have a health card. Nonetheless, these employers must comply with all health and safety and social distancing requirements.
We continue to monitor how jurisdictions outside of the United States continue to respond to the evolving COVID-19 pandemic.