Can employers ask to see COVID-19 Immunity Certificates in Hungary?
Change language:
An increasingly urgent question for employers in Hungary right now is whether they’re allowed to ask employees if they’ve been vaccinated. While some employers are considering only allowing vaccinated employees back in the office, others would prefer a more lenient approach, offering additional days of paid leave to those who have an Immunity Certificate. The data protection experts of Taylor Wessing Hungary elaborated on the issue.
The Immunity Certificate is only valid with an ID or a passport, and certificate holders are currently the only ones enjoying certain privileges: they can visit restaurants, hotels, gyms, cinemas and these service providers may only ask their customers to show their certificate (or the mobile application also used officially for demonstrating immunity) but are explicitly denied any further data processing (i.e. recording, copying).
So, people with Immunity Certificates are clearly afforded the enjoyment of certain benefits, but service providers are not entitled to process this type of data. A logical question therefore arises: does the same apply to employers?
The Hungarian DPA addressed this issue in a highly contested, quite ambiguous guidance.
The DPA concluded that employers may be allowed to ask their employees whether they are protected against COVID-19, albeit only under very limited circumstances and subject to certain conditions (and, of course, a separate privacy policy and the appropriate legal bases seeing that it is a special category of personal data). Although the guidance provides some much needed clarity on certain issues, much remains to be seen, and the guideline itself emphasises that it mostly applies to employment relationships, but not to other employment-like statuses (e.g. public sector, contractors, etc.). It also hints at the need for a unified, statutory handling of the problem.
The DPA made it clear that processing this type of health data of employees has to be necessary, proportionate, and must be based on a prior, well-documented, and objective risk assessment.
Necessity shall be assessed on a case-by-case basis, and according to the DPA, only applies in case of certain high-risk occupations or groups of employees. Examples of this include maintenance workers in hospitals, social workers and employees meeting with a lot of clients.