Can companies ask to see their employees’ corona passport?

The corona passport must be shown in certain situations, for example when at the gym, hairdresser or restaurant. But can companies at the workplace require employees to show their corona passport without notice, and can the company process the health information that the passport contains?

The Danish Health Information Act limits access to use corona passports

Although the new corona passport does not directly show if the employee is tested positive, negative, vaccinated for coronavirus or has not been tested, the company’s request to see the corona passport remains a request for information on the employees’ health information.

The reason for the corona passport being covered by the Danish Health Information Act is that information regarding whether the employee is tested negative, positive or is vaccinated is health information.

Under the Danish Health Information Act, the main rule is that a company cannot ask for, collect, receive or otherwise make use of health information in connection with or during the employment, to determine the employees’ risk to develop an illness or get sick, unless one of the narrow exceptions under the rules are applied.

As a direct consequence of the narrow exceptions under the Danish Health Information Act, new rules were introduced at the end of 2020, allowing companies to require that their employees get tested for coronavirus and to receive the test results. However, these new rules presume that the requirement to test is reasonable and relates to limiting the spread of infection at the workplace, including work environment considerations or significant operational reasons. Introduction of test requirements will thereafter for example be considered reasonable, if it is based on the requirement from buyers of the company’s products to take pre-emptive measures against coronavirus. Oppositely, the requirement to test would not be considered reasonable if the employee is not in contact with people or animals as part of their job.

When companies apply the new rules in accordance with the requirements, and then requests to see the employees test results, the new corona passport provides for a facilitated process. However, companies should be aware that the employee is only allowed to show the Danish version of the corona passport, and not the version for international travel. This is because the international travel version contains information about the employee’s health status, for example their vaccination status.

The new rules currently apply until 1 July 2021, but a new draft bill proposes to extend the access to require employees to get tested and receive the result until 1 November 2021. We have previously written more about the rules here and here

Remember GDPR when using the corona passport

The corona passport gives a ”consent based” overview of the employees ”corona status” via a QR-code, but while it might appear that the corona passport ensures a lawful basis for processing the data, consent is hardly the correct basis or sufficient for companies to comply with the rules under the Danish Health Information Act.

Companies should therefore be aware of the special rules that apply when processing sensitive information. We have previously briefly described the rules here.

IUNO’s opinion

While the new corona passport gives new opportunities for an effective reopening, companies must be aware if the corona passport is used as part of reopening the workplace. Health information is a special category of data under applicable data protection rules. Such data triggers increased requirements and risks when processing takes place. We have previously written about the requirements here.

IUNO recommends that companies thoroughly consider the special requirements that apply with respect to requesting health information from employees, requiring testing for coronavirus and other data protection issues before guidelines or policies are introduced, requiring that employees use or show their corona passport as part of their work.

[Tripartite agreement on the plan for reopening of Denmark between the government (Socialdemokratiet) and Venstre, Dansk Folkeparti, Socialistisk Folkeparti, Radikale Venstre, Enhedslisten, Det Konservative Folkeparti, Liberal Alliance and Alternativet agree on a joint framework agreement for the reopening of Denmark of 22 March 2021 and draft bill amending the Act on the employers access to require employees test for covid-19 etc., Act on prevention of infection of covid-19 when employers provide housing for employees, Act on duty to ensure covid-19-tests of travelling workforce when entering Denmark and Act on posting of employees etc. of 22 May 2021]