Processing data on Covid-19 vaccination status in the employment context: FAQ(s) from the Italian Data Protection Authority (Norme & Tributi Plus Diritto – Il Sole 24 Ore, 23February 2021 – Vittorio De Luca, Martina De Angeli)

The FAQ(s) aim to support employers in the correct application of existing legislation resulting from the combination of personal data protection applicable law, workplace health and safety applicable law and emergency regulations.

On 17 February 2021, the Italian Data Protection Authority (the “Authority”) published on its institutional website some FAQ(s) (“Frequently Asked Questions”) concerning the processing of data related to Covid-19 vaccination in the work context.

First of all, the Authority clarified that the employer is not among the persons entitled to request employees to provide information on their vaccination status or, in any case, a copy of the documents proving that they have been vaccinated against Covid-19.

According to the Authority, such processing of personal health data by the employer would not be permitted either by the emergency provisions in force nor by the applicable legislation on health and safety in the workplace, currently contained in the “Consolidated Law on Health and Safety at Work” (“Legislative Decree No. 81/2008.

The FAQ(s) clarify that in the employment context not even the consent of the employee him- or herself legitimises such data processing; consent, in this case, cannot constitute a valid condition of lawfulness. This is because of the imbalance and lack of equality in the relationship between the employer, the Data Controller, and the employee (the data subject), whereby the latter’s expression of consent cannot be guaranteed to be freely given (on this point, see recital 43 of (EU) Regulation 2016/679 on the protection of personal data).

Continue reading the full version published in Norme & Tributi Plus Diritto de Il Sole 24 Ore.