The Data Protection Authority clarifies the Company Physician role

The Italian Data Protection Authority, last May 14 published a document on the Company Physician role regarding the implementation of vaccination plans for the activation of extraordinary anti-Covid-19 vaccination points, provided by the National Protocol signed on 6 April 2021.

In this document, the Data Protection Authority clarifies that the tasks assigned to the Company Physician assume the function of “general prevention measures“ to be implemented in compliance with safety at work regulations, personal data protection principles, safety protocols and updated instructions from the Ministry of Health.

The Company Physician must constantly cooperate with the employer and the health prevention and protection service in the:

• risk assessment;
• identification, implementation and improvement of measures and compliance with anti-contagion protocols;
• information and training of workers on the SARS-CoV-2 infection risks;
• examining the risks for groups of workers who are exposed to infection or particularly “at risk.”

Considering the ongoing emergency, the Company Physician should continue and intensify health monitoring by providing further medical examinations, for example, when employees return to work after the suspension of production activities, or if there is a gradual return of resources “to work premises.”

Recalling what has already been expressly clarified in the FAQ (“Frequently Asked Questions“) of 17 February, the Data Protection Authority reiterates that the employer must ensure that employees “are not assigned a work task without an assessment of suitability” considering “their skills and conditions concerning their health and safety” (art. 18, paragraph 1, letter c), Legislative Decree. no. 81/2008). As part of their health monitoring activities, the Company Physician is the only person entitled to process workers’ health data and check their suitability for the “specific task” (Articles 25, 39, paragraph 5, and 41, paragraph 4, Legislative Decree no. 81/2008).

The document states that compliance with the necessary allocation of roles and responsibilities between employer and physician must be ensured, including vaccination in the workplace. Although this originates from the dual need to contribute to the rapid implementation of the vaccination campaign nationally and increase safety levels in the workplace, it remains a “public health initiative.” “The general responsibility and supervision of this process is in the hands of the regional health service, through the local health authority.”