EN
HR Legal Technology

Can companies ask to see their employees’ corona passport?

logo
Legal news
calendar 10. June 2021
globus Denmark

The corona passport plays a big part of the current reopening plan, and the new app is now available for download. Both as a customer, guest or participant, the corona passport is needed in different situations. But can companies require to see their employees’ corona passport as part of a safe reopening of the workplace? Or can companies request to see it on a voluntary basis?

The corona passport must be shown in certain situations, for example when at the gym, hairdresser or restaurant. But can companies at the workplace require employees to show their corona passport without notice, and can the company process the health information that the passport contains?

The Danish Health Information Act limits access to use corona passports

Although the new corona passport does not directly show if the employee is tested positive, negative, vaccinated for coronavirus or has not been tested, the company’s request to see the corona passport remains a request for information on the employees’ health information.

The reason for the corona passport being covered by the Danish Health Information Act is that information regarding whether the employee is tested negative, positive or is vaccinated is health information.

Under the Danish Health Information Act, the main rule is that a company cannot ask for, collect, receive or otherwise make use of health information in connection with or during the employment, to determine the employees’ risk to develop an illness or get sick, unless one of the narrow exceptions under the rules are applied.

As a direct consequence of the narrow exceptions under the Danish Health Information Act, new rules were introduced at the end of 2020, allowing companies to require that their employees get tested for coronavirus and to receive the test results. However, these new rules presume that the requirement to test is reasonable and relates to limiting the spread of infection at the workplace, including work environment considerations or significant operational reasons. Introduction of test requirements will thereafter for example be considered reasonable, if it is based on the requirement from buyers of the company’s products to take preemptive measures against coronavirus. Oppositely, the requirement to test would not be considered reasonable if the employee is not in contact with people or animals as part of their job.

When companies apply the new rules in accordance with the requirements, and then requests to see the employees test results, the new corona passport provides for a facilitated process. However, companies should be aware that the employee is only allowed to show the Danish version of the corona passport, and not the version for international travel. This is because the international travel version contains information about the employee’s health status, for example their vaccination status.

The new rules currently apply until 1 July 2021, but a new draft bill proposes to extend the access to require employees to get tested and receive the result until 1 November 2021. We have previously written more about the rules here and here

Remember GDPR when using the corona passport

The corona passport gives a ”consent based” overview of the employees ”corona status” via a QR-code, but while it might appear that the corona passport ensures a lawful basis for processing the data, consent is hardly the correct basis or sufficient for companies to comply with the rules under the Danish Health Information Act.

Companies should therefore be aware of the special rules that apply when processing sensitive information. We have previously briefly described the rules here.

IUNO’s opinion

While the new corona passport gives new opportunities for an effective reopening, companies must be aware if the corona passport is used as part of reopening the workplace. Health information is a special category of data under applicable data protection rules. Such data triggers increased requirements and risks when processing takes place. We have previously written about the requirements here.

IUNO recommends that companies thoroughly consider the special requirements that apply with respect to requesting health information from employees, requiring testing for coronavirus and other data protection issues before guidelines or policies are introduced, requiring that employees use or show their corona passport as part of their work.

[Tripartite agreement on the plan for reopening of Denmark between the government (Socialdemokratiet) and Venstre, Dansk Folkeparti, Socialistisk Folkeparti, Radikale Venstre, Enhedslisten, Det Konservative Folkeparti, Liberal Alliance and Alternativet agree on a joint framework agreement for the reopening of Denmark of 22 March 2021 and draft bill amending the Act on the employers access to require employees test for covid-19 etc., Act on prevention of infection of covid-19 when employers provide housing for employees, Act on duty to ensure covid-19-tests of travelling workforce when entering Denmark and Act on posting of employees etc. of 22 May 2021]

The corona passport must be shown in certain situations, for example when at the gym, hairdresser or restaurant. But can companies at the workplace require employees to show their corona passport without notice, and can the company process the health information that the passport contains?

The Danish Health Information Act limits access to use corona passports

Although the new corona passport does not directly show if the employee is tested positive, negative, vaccinated for coronavirus or has not been tested, the company’s request to see the corona passport remains a request for information on the employees’ health information.

The reason for the corona passport being covered by the Danish Health Information Act is that information regarding whether the employee is tested negative, positive or is vaccinated is health information.

Under the Danish Health Information Act, the main rule is that a company cannot ask for, collect, receive or otherwise make use of health information in connection with or during the employment, to determine the employees’ risk to develop an illness or get sick, unless one of the narrow exceptions under the rules are applied.

As a direct consequence of the narrow exceptions under the Danish Health Information Act, new rules were introduced at the end of 2020, allowing companies to require that their employees get tested for coronavirus and to receive the test results. However, these new rules presume that the requirement to test is reasonable and relates to limiting the spread of infection at the workplace, including work environment considerations or significant operational reasons. Introduction of test requirements will thereafter for example be considered reasonable, if it is based on the requirement from buyers of the company’s products to take preemptive measures against coronavirus. Oppositely, the requirement to test would not be considered reasonable if the employee is not in contact with people or animals as part of their job.

When companies apply the new rules in accordance with the requirements, and then requests to see the employees test results, the new corona passport provides for a facilitated process. However, companies should be aware that the employee is only allowed to show the Danish version of the corona passport, and not the version for international travel. This is because the international travel version contains information about the employee’s health status, for example their vaccination status.

The new rules currently apply until 1 July 2021, but a new draft bill proposes to extend the access to require employees to get tested and receive the result until 1 November 2021. We have previously written more about the rules here and here

Remember GDPR when using the corona passport

The corona passport gives a ”consent based” overview of the employees ”corona status” via a QR-code, but while it might appear that the corona passport ensures a lawful basis for processing the data, consent is hardly the correct basis or sufficient for companies to comply with the rules under the Danish Health Information Act.

Companies should therefore be aware of the special rules that apply when processing sensitive information. We have previously briefly described the rules here.

IUNO’s opinion

While the new corona passport gives new opportunities for an effective reopening, companies must be aware if the corona passport is used as part of reopening the workplace. Health information is a special category of data under applicable data protection rules. Such data triggers increased requirements and risks when processing takes place. We have previously written about the requirements here.

IUNO recommends that companies thoroughly consider the special requirements that apply with respect to requesting health information from employees, requiring testing for coronavirus and other data protection issues before guidelines or policies are introduced, requiring that employees use or show their corona passport as part of their work.

[Tripartite agreement on the plan for reopening of Denmark between the government (Socialdemokratiet) and Venstre, Dansk Folkeparti, Socialistisk Folkeparti, Radikale Venstre, Enhedslisten, Det Konservative Folkeparti, Liberal Alliance and Alternativet agree on a joint framework agreement for the reopening of Denmark of 22 March 2021 and draft bill amending the Act on the employers access to require employees test for covid-19 etc., Act on prevention of infection of covid-19 when employers provide housing for employees, Act on duty to ensure covid-19-tests of travelling workforce when entering Denmark and Act on posting of employees etc. of 22 May 2021]

Receive our newsletter

Anders

Etgen Reitz

Partner

Kirsten

Astrup

Senior associate

Similar

logo
HR Legal

26 September 2021

Seven extensions did not create a permanent employment

logo
HR Legal

26 September 2021

Removing work tasks did not constitute a termination

logo
HR Legal

17 September 2021

Do standard clauses give an automatic right to set off?

logo
Technology

9 September 2021

Failure to comply with retention periods resulted in EUR 1.75 million fine

logo
Technology

1 September 2021

Can companies “snoop” in former employees’ e-mail accounts?

logo
HR Legal

29 August 2021

The team

Akina

Ørum Masaki

Legal assistant

Anders

Etgen Reitz

Partner

Caroline

Wochner

Communication assistant

Cecillie

Groth Henriksen

Associate

Julie

Meyer

Communication assistant

Kirsten

Astrup

Senior associate

Mathilde

Baudry

Communication assistant

Nora

Tägtgård Coter

Legal assistant

Sofie

Aurora Braut Bache

Associate

Søren

Hessellund Klausen

Partner