On Covid-19 Vaccination and the Protection of Personal Data: Can Employers Process Vaccination Information?

ON VACCINATION OF COVID-19 AND PROTECTION OF PERSONAL DATA

Can Vaccination Information Be Processed by Employers?

Dr. Murat Volkan Dülger^*

With the Covid-19 epidemic that has taken the whole world under its influence, we are talking about the problems brought by vaccination when we say PCR test result information, drugs used, contact information, PCR test result information of family relatives. Before that, we discussed the nature of the information referred to on various platforms as personal data, and by whom and under what exceptions. In fact, there was no doubt that this information was a special category of personal data under health data; The problem was how this data could be processed. Now, the same problems have come to the fore with vaccination and it has been started to be discussed by whom and under what conditions the "information whether a person has been vaccinated" can be processed.

Can anyone really ask if a person has been vaccinated and be forced to give this

information? How will the balance be established between the public benefit of the information that the person has been vaccinated and the right to protection of personal

data, which is interfered with by being forced to give this information?

Undoubtedly, these questions intensify in the employer-employee relationship. Therefore, in this article, I mainly preferred to discuss how vaccination information will be processed between the worker and the employer. Here, we will try to gather questions about vaccination and vaccination information in the workplace under one roof: So much so that the society, which has changed into a new order with the Covid-19 epidemic, wants to return to its former state with vaccination and needs information about whether or not vaccination is done.

I. Relation of Vaccination in General with Protection of Personal Data

With the Covid-19 vaccine application, the information about whether individuals are vaccinated or not has emerged. This information is undoubtedly a special quality personal data under health data. If so, the sharing and processing of this information must comply with the terms and conditions of the personal data protection legislation. The importance of sharing this information is that it is necessary to return to the old order from the new order passed within the framework of the Covid-19 epidemic. For example, workplaces that have switched to working from home want to determine their old working order again according to vaccination. For this, it is necessary to know who is vaccinated and who is not.

At this point, it should be noted that the debate over whether vaccination can be made compulsory is not the subject of this article. Because this issue is related to the principles of constitutional law discipline. However, as a lawyer, I think that forcing a person to be vaccinated is incompatible with the concepts of human rights and human dignity. In accordance with the provisions regarding the "inviolability, material and spiritual existence of the person" regulated in Article 17 of the Constitution, such a coercion will be unconstitutional.¹ Of course, encouraging practices can be applied in this direction and some explanations and studies can be made as suggestions. For example, while it is a very useful and appropriate practice for workplaces to make announcements to encourage vaccination, it is against both the ideal of human rights and positive legal regulations as I mentioned above.

II. Nature and Processing of Vaccination Information

In order to determine the scope and limits of the processing of vaccination information by employers, let's take a brief look at the nature of this data and the conditions for its processing.

1. What is the Nature of Vaccination Information?

Health information has the qualification of special quality personal data in accordance with the Law on Protection of Personal Data No. 6698 (Law No. 6698); With the Regulation on Personal Health Data published in the Official Gazette dated June 21, 2019 and numbered 30808, it is defined as "all kinds of information regarding the physical and mental health of an identified or identifiable natural person, and information regarding the health service provided to the person".

In this context, all kinds of information concerning the health of the individual, such as disability, infectious diseases, treatment information, and drugs used constitute an element of health-related data. Therefore, there should be no doubt that the vaccines started to be produced with the Covid-19 outbreak and the information about whether the person has these vaccines are included in the "health information" category.

In support of this, the UK Data Protection Authority (“ICO”) also stated that when it evaluates according to the General Data Protection Regulation (“GDPR”), vaccine information is personal health data and must be processed in accordance with Article 9 of the

GDPR.²

Pursuant to Article 9/2-i GDPR, the processing of special categories of data is possible if “processing is required for the public interest in the field of public health, such as to protect against serious cross-border threats to health or to ensure high quality and safety standards for healthcare and medical products or medical devices, based on Union or Member State law which provides for appropriate and specific measures to guarantee the rights and freedoms of the data subject, in particular professional confidentiality”

2. What Conditions Are Subject to the Processing of Vaccination Information?

The processing of data of this nature is only possible in accordance with article 6/3 of the Law No. 6698: “..Personal data related to health and sexual life can only be used for the purpose of protecting public health, providing preventive medicine, medical diagnosis, treatment and care services, planning and managing health services and financing. It may be processed by persons or authorized institutions and organizations that are under the obligation to keep secrets without seeking the explicit consent of the person concerned”.

Accordingly, in accordance with the Law No. 6698, the processing of vaccination information is only possible if the following conditions are met:

- express consent or

- Protection of public health,

- Preventive medicine, presence of

- Execution of medical diagnosis, treatment and care services, any

- Planning and management of health services and financing

- Persons under the obligation to keep secrets, or by

- Authorized institutions and organizations

III. Processing of Vaccination Information within the Scope of Employee-Employer Relationship

I would like to briefly clarify why vaccination information comes to the fore in the employee-employer relationship. As it is known due to Covid-19, it has been switched to working from home since March 2020. While some workplaces have switched to working entirely from home, others have switched to a new system of coming to the office on certain days of the week and working from home on the others. On the days when the epidemic decreased, working from the office continued, if it increased, it was continued to work from home again. At the end of a process that continues in this way, we are witnessing that steps are being taken to move completely from the office to working with vaccination. Of course, this requires employee vaccination knowledge. For example, in some workplaces, vaccination information of employees is requested and processed by the Human Resources department. But is this a correct practice?

Below we will try to clarify the problems that may come to mind in the form of questions and answers.

1. For which legal reason can vaccination information be processed in the workplace?

Since there is no doubt that the vaccination information is health data within the scope of Law No. 6698, the existence of the necessary conditions for the processing of health data should be sought and therefore it should be discussed under which legal reason these data can be processed.

In my opinion, the processing of vaccination information can be processed within the framework of the legal reason "protection of public health" specified in article 6/3, just like the PCR test result information, as well as personal health data that came to the agenda within the scope of the Covid-19 epidemic. As a matter of fact, in the statements made by the Personal Data Protection Board (“Board”) during this process, statements were made that these data are related to public health and that public health is essential.

Indeed, all personal health data linked to Covid-19 is essentially public health related. Although such an acceptance increases the risk of possible interference with personal data, otherwise public health is endangered. I think that public health outweighs when a balance is established between both benefits.

Moreover, over the past 1 year, we have also experienced that the idea that personal data outweighs is not applicable. In this process, our fever measurements were made almost everywhere, our HES codes were read, our test results were reported to people who might be in contact with the danger of being in contact, and we were asked whether we were in contact. Of course, it is unacceptable that all these are done in an unmeasured and unlimited way. However, in the face of such an epidemic that we have never experienced before, it has become necessary to share this information to a certain extent in order to protect the health of the society. It is also not a reasonable approach to expect an exception directly related to the pandemic, taking into account a pandemic during the drafting of the law. As such, I do not see any inconvenience in the protection of personal data in circumventing this process based on the most general and basic exception in the form of protection of public health. At this point, it should only be reminded that the processing to be carried out must comply with the general principles regulated by the Law No. 6698.

As a result, I think that vaccination information can be processed in accordance with the Law No. 6698, within the framework of the legal reason for the protection of public health, like other personal health data that emerged in connection with Covid-19 and gained importance.

2. Who can process vaccination information?

Health information can only be processed by persons under the obligation to keep secrets within the scope of Law No. 6698. Therefore, the place where this information will be collected and kept is the workplace doctor. Therefore, it is possible to process vaccination information in a workplace without obtaining explicit consent from the employees, provided that it is collected and stored by the workplace physician based on the legal reason for the protection of public health. However, this will not be possible for all employers as it is not compulsory to employ a full-time occupational physician in every workplace.

3. How can employers who do not employ a workplace doctor process vaccination information?

In the absence of a workplace physician in the workplace where vaccination information will be collected and stored, the most reasonable method seems to be to obtain explicit consent from the employees.

4. In such a possibility, is the explicit consent of the employees valid?

At this point, the question of the validity of explicit consent will come to the fore. Because the fact that the employees have a lower position in the eyes of the employer creates a resumption that they are under pressure and cannot make a statement of their own free will. However, explicit consent should be given based on free will and with the confidence that if it is not given, a negative result will not be encountered. Otherwise, there will be an invalid consent in accordance with the provisions of the Law No. 6698 and the Board decisions. For this reason, we recommend that employers avoid personal data processing as much as possible by obtaining explicit consent from employees.

However, in this case, there is no other way for an employer who absolutely needs vaccination information. For this reason, I think that explicit consent can be obtained from the employees in a very transparent and sensitive process by following all the rules regarding obtaining explicit consent. The most important issue here is to provide an assurance that employees will not face any negative consequences if they do not give their explicit consent on the subject.

5. Does the obligation to inform continue?

There is no doubt that privacy notice is absolutely necessary in order to process vaccination information. It should not be forgotten that the obligation to inform continues for all kinds of personal processing activities, except for the exceptions listed in Article 28/2 of the Law No. 6698. Therefore, if it is desired to collect the vaccination information of the employees at the workplace, information should be provided at the latest at the collection stage. The fact that this processing is carried out within the framework of the legal reason for the protection of public health or based on the express consent of the employees does not constitute any feature in terms of the obligation to inform.

For example, in the announcement to be made regarding the request for vaccination information, the obligation to inform about the subject can be fulfilled by including all the minimum elements that must be made to inform such as why this information is needed and where it will be kept.

6. Which data can be processed within the scope of vaccination information?

An evaluation should also be made in terms of the data that can be processed within the framework of vaccination information and a process should be carried out accordingly. Because although it can be accepted that vaccination information can be processed under certain conditions, it is not possible to compromise the general principles regarding the protection of personal data. For this reason, the principle of collecting as much personal data as necessary to achieve the purpose should not be abandoned.

In this context, I think that employees can be asked whether they have been vaccinated and, if so, the date of vaccination (for example, to determine the date of going from working from home to working in the office). Apart from this, I believe that there can be no reasonable justification for requesting information such as which type of vaccine was given or which hospital it was given. On the other hand, it is seen that some employers carry out processes such as getting a copy of the cards kept in the vaccination process, such as the vaccination tracking card. I think that such an application would be a data processing that is against the general principles of the Law and therefore against the law.

7. Can vaccination practice be evaluated within the scope of occupational health and safety?

Provisions of Occupational Health and Safety Law No. 6331 are applied in terms of ensuring occupational health and safety in workplaces. Accordingly, the employer is obliged to ensure the occupational health and safety of the employees. Similarly, in accordance with Article 417/2 of the Code of Obligations No. 6098; It is obliged to take all necessary precautions to ensure occupational health and safety in the workplace and to keep the tools and equipment in full.

According to this law, in case of epidemic diseases listed in article 57 of Law No. 6331, vaccination is made possible in accordance with article 72/2 of the same Law. However, for a mandatory vaccination, the names of the vaccines must be clarified by law. However, the relevant Covid-19 vaccine is not included in a mandatory vaccine group within the scope of occupational health and safety legislation. For this reason, it is not possible to accept the vaccine application within this framework and to carry out processing with the mention that it is both compulsory and a processing activity stipulated by law.

At this point, only the employer's practices to encourage vaccination can be mentioned. As a matter of fact, even before the vaccination activities started during the Covid-19 period, employers were subject to certain obligations such as providing masks and disinfectants in their workplaces and ensuring compliance with hygiene and social distance rules. It can be mentioned that the employer's obligation is to show the Covid-19 vaccination as a recommended and encouraged practice like this. For example, giving permission to the employee to go to vaccination, resting in case of any side effects, and practices should be absolutely in every workplace.

However, these issues do not mean that vaccination information can be processed within the scope of occupational health and safety. Because the protection of personal data is a fundamental right and freedom; It is not possible for an interference with this right to be carried out with such an interpretation method.

8. What will happen to an employee who refuses to provide vaccination information?

Frankly, although I think that this information should be given on the condition that it will be processed in accordance with the Law in terms of public health and workplace order; I think that an employee who gives this information should not be subjected to any negative sanction.

What the result will be should be determined according to why the employer requests this information. For example, the employer may want to switch to working from the office and needs immunization information to be able to make this planning. When the case of the employee who refuses to provide the vaccination information to the employer, who will process the vaccination information for these purposes, is evaluated, it seems possible to make a decision that this employee will continue to work from home. Otherwise, it would be unfair to impose a negative sanction.

Because, the employee should inform the employer only if he has a disease that will affect other workers.³ Apart from that, it is not legally required to give information about whether there is a vaccine or not.

The ICO makes clear that requesting this data and the internal security steps that must be taken to protect it must be reasonable, fair and proportionate. Starting from here, it is necessary to focus on the question of whether collecting this data will make the workplace safer. Can the workplace be made safe with different applications without collecting this data? According to the answers given to these questions, the answers regarding whether or not to receive vaccination information and therefore what the status of an employee who refuses to provide this information will be will vary.

9. Can I be asked about vaccination information during recruitment?

Finally, whether it is possible to ask employee candidates whether they have been vaccinated during recruitment is another question that needs to be discussed.

I think that under normal conditions, no health data is requested from the employee candidates, but some questions that are important to be asked in terms of the nature and nature of the job can be asked. However, whether the Covid-19 vaccine falls within the nature and nature of a particular job is open to debate. For example, asking this question when recruiting a staff member to work in a hospital is acceptable due to the nature of the job; It may be unclear how this will happen in other sectors.

In my opinion, not wanting to employ unvaccinated personnel in order to protect the health of other workers, and therefore asking candidates for Covid-19 vaccination information in job interviews can be considered as a reasonable reason for the employer. However, this issue is not through a comment; needs to be clarified through a legal regulation. Unless this regulation is made, the danger of violating the law will always exist. Because the interference with fundamental rights and freedoms is not foreseen by law, it means a disproportionate intervention in terms of law. On the other hand, there is a situation that cannot be applied practically. Therefore, I think that the most relaxing solution in terms of implementation should be brought with legal regulations as soon as possible.

At this point, it can be said with certainty that the employer's asking detailed questions regarding the health status of the job and/or job description is invalid and that the candidate's obligation to give correct answers cannot be mentioned.⁴

On the other hand, I would like to point out at this point that it would not be appropriate to ask a detailed question of an employee candidate who did not choose to be vaccinated, such as why he/she did not choose to be vaccinated.⁵

10. Are there any international examples on the subject?

With the systematic implementation of vaccination in almost every country, problems similar to those in our country arise in business processes. In this part of the article, I would like to briefly touch on the problems brought about by the vaccine in workplaces in the USA and Germany.

The United States allows employers to force their employees to get vaccinated and to fire those who do not, under applicable law. Although the laws allow this, when we look at the practices in the workplaces in the USA, we can see that instead of forcing the vaccine information to be obtained, we can see that more fair efforts are made to ensure that employees provide their own information. An example of this can be given from an article published in the New York Times on May 20, 2021. In this news, it is mentioned that if a company's employees send their vaccination cards to the company, they will be given a gift card.⁶ From this point of view, it can be said that companies will actually obtain their employees' health information in return for the fee they will give under the title of "gift card".

However, some jurisdictions have more strict viewpoints. For example, employers in France and Germany do not receive information on whether they have been vaccinated.⁷ However, financial bonuses are created for employees in Germany to be vaccinated against Covid-19. For example, Lidl, a chain store, defines a 167 Euro shopping card for its employees if they are vaccinated.⁸ In addition, vacation days or extra payments are defined for vaccinated employees in Germany. The debates that emerged as a result of all these vaccine incentive practices are on the agenda, similar to the discussions in our country. Therefore, it is thought that this situation may lead to unfairness among employees in Germany as well. While discussing this issue, it is stated that employers must legally treat employees equally within the scope of German Law, but it is also mentioned that within the scope of the law, it is also possible to treat employees who are vaccinated and not vaccinated differently in the workplace. Employers should also consider the health of employees and not expose them to unnecessary physical hazards. In the context of the pandemic, different practices may be accepted between those who are vaccinated and those who are not vaccinated in the workplace, as the health of the employees is prioritized. So, if employees are working from home during the pandemic, it would be possible to allow vaccinated employees to return to work in the office sooner or to be given privileged access to common company areas.

Result

As in the world, Covid-19 vaccination rates have increased day by day in Turkey as well, and with this increase, many questions have arisen in mind. Undoubtedly, as explained in detail above, all these questions are actually gathered under a single main title: How will the new social order created with the epidemic return to its former state? Because over the past 1 year, a series of legal regulations have been introduced, and many rules, prohibitions and sanctions have been determined within the framework of these regulations. It should be discussed whether all these regulations will disappear with the end of the epidemic and which practices will be valid in this transition period. However, the way in which the aforementioned regulations were introduced (introducing a legal norm with a circular, holding meetings by organs not regulated in the Constitution., the announcement of these decisions at midnight, the introduction of some sales bans without even the need for rules and regulations, etc.) I must state that I am not hopeful for the end of these meetings, considering the legality of decisions concerning the whole country.

Since the Covid-19 vaccination is the first step in restoring the new social order, the knowledge of whether to be vaccinated has started to gain importance. As explained above, I believe that all kinds of processing activities, such as sharing, requesting and storing this information, should be placed in a process, taking into account the provisions of the Law No.6698. Meanwhile, while the primary objective is to ensure the protection of personal data; The most realistic method that can be applied in both business and social life should be adopted. Therefore, care should be taken to ensure that the intervention to be carried out in various aspects of this right is in accordance with the philosophy and principles of the protection of personal data. However, at the same time, I would like to underline once again that the issue should be clarified as soon as possible with legal regulations and the violation of law should be tolerated more.