EN
Data protection HR Legal

Can companies ask to see their employees’ corona passport?

logo
Legal news
calendar 10. June 2021
globus Denmark

The corona passport plays a big part of the current reopening plan, and the new app is now available for download. Both as a customer, guest or participant, the corona passport is needed in different situations. But can companies require to see their employees’ corona passport as part of a safe reopening of the workplace? Or can companies request to see it on a voluntary basis?

The corona passport must be shown in certain situations, for example when at the gym, hairdresser or restaurant. But can companies at the workplace require employees to show their corona passport without notice, and can the company process the health information that the passport contains?

The Danish Health Information Act limits access to use corona passports

Although the new corona passport does not directly show if the employee is tested positive, negative, vaccinated for coronavirus or has not been tested, the company’s request to see the corona passport remains a request for information on the employees’ health information.

The reason for the corona passport being covered by the Danish Health Information Act is that information regarding whether the employee is tested negative, positive or is vaccinated is health information.

Under the Danish Health Information Act, the main rule is that a company cannot ask for, collect, receive or otherwise make use of health information in connection with or during the employment, to determine the employees’ risk to develop an illness or get sick, unless one of the narrow exceptions under the rules are applied.

As a direct consequence of the narrow exceptions under the Danish Health Information Act, new rules were introduced at the end of 2020, allowing companies to require that their employees get tested for coronavirus and to receive the test results. However, these new rules presume that the requirement to test is reasonable and relates to limiting the spread of infection at the workplace, including work environment considerations or significant operational reasons. Introduction of test requirements will thereafter for example be considered reasonable, if it is based on the requirement from buyers of the company’s products to take preemptive measures against coronavirus. Oppositely, the requirement to test would not be considered reasonable if the employee is not in contact with people or animals as part of their job.

When companies apply the new rules in accordance with the requirements, and then requests to see the employees test results, the new corona passport provides for a facilitated process. However, companies should be aware that the employee is only allowed to show the Danish version of the corona passport, and not the version for international travel. This is because the international travel version contains information about the employee’s health status, for example their vaccination status.

The new rules currently apply until 1 July 2021, but a new draft bill proposes to extend the access to require employees to get tested and receive the result until 1 November 2021. We have previously written more about the rules here and here

Remember GDPR when using the corona passport

The corona passport gives a ”consent based” overview of the employees ”corona status” via a QR-code, but while it might appear that the corona passport ensures a lawful basis for processing the data, consent is hardly the correct basis or sufficient for companies to comply with the rules under the Danish Health Information Act.

Companies should therefore be aware of the special rules that apply when processing sensitive information. We have previously briefly described the rules here.

IUNO’s opinion

While the new corona passport gives new opportunities for an effective reopening, companies must be aware if the corona passport is used as part of reopening the workplace. Health information is a special category of data under applicable data protection rules. Such data triggers increased requirements and risks when processing takes place. We have previously written about the requirements here.

IUNO recommends that companies thoroughly consider the special requirements that apply with respect to requesting health information from employees, requiring testing for coronavirus and other data protection issues before guidelines or policies are introduced, requiring that employees use or show their corona passport as part of their work.

[Tripartite agreement on the plan for reopening of Denmark between the government (Socialdemokratiet) and Venstre, Dansk Folkeparti, Socialistisk Folkeparti, Radikale Venstre, Enhedslisten, Det Konservative Folkeparti, Liberal Alliance and Alternativet agree on a joint framework agreement for the reopening of Denmark of 22 March 2021 and draft bill amending the Act on the employers access to require employees test for covid-19 etc., Act on prevention of infection of covid-19 when employers provide housing for employees, Act on duty to ensure covid-19-tests of travelling workforce when entering Denmark and Act on posting of employees etc. of 22 May 2021]

The corona passport must be shown in certain situations, for example when at the gym, hairdresser or restaurant. But can companies at the workplace require employees to show their corona passport without notice, and can the company process the health information that the passport contains?

The Danish Health Information Act limits access to use corona passports

Although the new corona passport does not directly show if the employee is tested positive, negative, vaccinated for coronavirus or has not been tested, the company’s request to see the corona passport remains a request for information on the employees’ health information.

The reason for the corona passport being covered by the Danish Health Information Act is that information regarding whether the employee is tested negative, positive or is vaccinated is health information.

Under the Danish Health Information Act, the main rule is that a company cannot ask for, collect, receive or otherwise make use of health information in connection with or during the employment, to determine the employees’ risk to develop an illness or get sick, unless one of the narrow exceptions under the rules are applied.

As a direct consequence of the narrow exceptions under the Danish Health Information Act, new rules were introduced at the end of 2020, allowing companies to require that their employees get tested for coronavirus and to receive the test results. However, these new rules presume that the requirement to test is reasonable and relates to limiting the spread of infection at the workplace, including work environment considerations or significant operational reasons. Introduction of test requirements will thereafter for example be considered reasonable, if it is based on the requirement from buyers of the company’s products to take preemptive measures against coronavirus. Oppositely, the requirement to test would not be considered reasonable if the employee is not in contact with people or animals as part of their job.

When companies apply the new rules in accordance with the requirements, and then requests to see the employees test results, the new corona passport provides for a facilitated process. However, companies should be aware that the employee is only allowed to show the Danish version of the corona passport, and not the version for international travel. This is because the international travel version contains information about the employee’s health status, for example their vaccination status.

The new rules currently apply until 1 July 2021, but a new draft bill proposes to extend the access to require employees to get tested and receive the result until 1 November 2021. We have previously written more about the rules here and here

Remember GDPR when using the corona passport

The corona passport gives a ”consent based” overview of the employees ”corona status” via a QR-code, but while it might appear that the corona passport ensures a lawful basis for processing the data, consent is hardly the correct basis or sufficient for companies to comply with the rules under the Danish Health Information Act.

Companies should therefore be aware of the special rules that apply when processing sensitive information. We have previously briefly described the rules here.

IUNO’s opinion

While the new corona passport gives new opportunities for an effective reopening, companies must be aware if the corona passport is used as part of reopening the workplace. Health information is a special category of data under applicable data protection rules. Such data triggers increased requirements and risks when processing takes place. We have previously written about the requirements here.

IUNO recommends that companies thoroughly consider the special requirements that apply with respect to requesting health information from employees, requiring testing for coronavirus and other data protection issues before guidelines or policies are introduced, requiring that employees use or show their corona passport as part of their work.

[Tripartite agreement on the plan for reopening of Denmark between the government (Socialdemokratiet) and Venstre, Dansk Folkeparti, Socialistisk Folkeparti, Radikale Venstre, Enhedslisten, Det Konservative Folkeparti, Liberal Alliance and Alternativet agree on a joint framework agreement for the reopening of Denmark of 22 March 2021 and draft bill amending the Act on the employers access to require employees test for covid-19 etc., Act on prevention of infection of covid-19 when employers provide housing for employees, Act on duty to ensure covid-19-tests of travelling workforce when entering Denmark and Act on posting of employees etc. of 22 May 2021]

Receive our newsletter

Anders

Etgen Reitz

Partner

Kirsten

Astrup

Associate

Similar news

logo
HR Legal

30 May 2021

Employees risk confiscation of the company car when driving recklessly

logo
HR Legal

30 May 2021

Company was responsible for site manager’s sexual harassment

logo
HR Legal

16 May 2021

New rules for remote working in the making

logo
HR Legal Corporate

2 May 2021

Non-competition clause not covered by the Employment Clauses Act

logo
HR Legal

25 April 2021

Remote working

logo
HR Legal

25 April 2021

Must job applicants disclose their past?

Learning

logo
HR Legal
2 September 2019

Livestream on restructuring in the Nordic Region

logo
HR Legal
2 September 2019

Seminar on restructuring in the Nordic Region (Copenhagen)

logo
HR Legal
3 December 2018

International HR Legal Day 2018

logo
HR Legal
3 December 2018

Seminar on development and employment forms (english)

logo
HR Legal
21 November 2018

Seminar on Employee Influence in the Nordics (Helsinki)

logo
HR Legal
20 November 2018

Seminar on Employee Influence in the Nordics (Copenhagen)