Corona Vaccinations and the GDPR

About half of Dutch healthcare workers intend to get the Covid-19 vaccine, according to a poll conducted by the Federation of Dutch Trade Unions. The attitude to vaccination varies greatly between sectors: among those working in university medical centres, approximately two thirds are willing to be vaccinated, whereas only 40% of those working in nursing homes are. Older employees also appear to be more willing than younger ones; of those under thirty, only a quarter intend to get the vaccine. Commonly listed worries include the speed of development and possible side effects. In any case, it is not clear who is planning to get vaccinated and who is not. Potentially problematic, as privacy legislation also prohibits employers from asking.

Art. 9(1) of the GDPR prohibits any processing of data concerning health. This means, among other things, that your employer may not ask you what you are ill with, nor may they ask about vaccinations. The Dutch Data Protection Authority (DPA) has made it clear that an employee cannot be asked whether they have Covid-19, nor required to be tested to verify it. However, if it turns out that only half of healthcare workers have been vaccinated, possibly even fewer in particularly vulnerable sectors, that leaves us with a dangerous gamble.

The vaccine was approved by the EMA on 21 December. It has proven to be safe as well as effective; 95% of those vaccinated are protected against Covid-19. The healthcare workers caring for vulnerable groups are precisely the ones due to receive the first vaccinations, on 8 January. But it will not be clear which employees have actually been vaccinated. If an employee’s vaccination status cannot be taken into account, for example when drawing up rotas, efficacy and the development of herd immunity will suffer. It is difficult to prevent a chain reaction if we do not know where the weak links could be.

The new variant of Covid-19, which is plaguing the UK as we speak, provides more reason to worry. Though it does not appear to be more dangerous (so far), it seems to be up to 70% more contagious. Our best weapon against the virus is vaccination, particularly among essential workers. Fortunately, the GDPR leaves some room for a situation of this kind. After all, surgeons and residents are also expected to be vaccinated against hepatitis B, for example. The faculty of medicine at the Vrije Universiteit Amsterdam (VU) said the following on the matter:

“VU University Medical Center’s hepatitis B vaccination policy follows the national guidelines set down by the Health Care Inspectorate, which demands responsible care from hospitals and other healthcare facilities. Patients cannot be subjected to the risk of contamination with, for example, hepatitis B, through contact with healthcare workers. Employees in positions with risk of contamination, such as doctors, nurses and residents must therefore be vaccinated. For both their own and the patient’s safety.”

This is in accordance with the GDPR, which leaves room for such exceptions. One of them is set out in recital 52, under which the prohibition on processing special categories of personal data may be derogated from where Union or national law provides for it and it is in the public interest, particularly for the purpose of preventing or combating communicable diseases and other serious threats to health. That indicates an exception could also be made for Covid-19. It would, however, require a legal basis.

For that to happen, two ministers will have to formulate an exception to the GDPR, which will then have to be approved by both Houses of Parliament. It would be ideal if that process were set in motion now, as it can take a couple of weeks. With the first vaccinations being administered on 8 January, the sooner the better.

---

In cooperation with Saar Hoek