As jurisdictions across the world grapple with the effects of the more infectious delta variant, many governments either have taken or are considering more restrictive measures to reduce infection rates and community spread of COVID-19. As we have previously discussed, France is a country that has taken a tougher stance on encouraging COVID-19 vaccinations and has even required employees in certain sectors and industries, in accordance with Article 12, I, of the Law n°2021-1040, to receive a vaccination. The French government also recently introduced the Pass Sanitaire (i.e., health pass). Now, the French Data Protection Authority (“CNIL”) has provided guidance on employers’ obligations regarding collecting health pass information and COVID-19 vaccination data.
On September 29, 2021, the CNIL released a Q&A-style guidance that analyzes how employers should (i) protect employees’ personal data on the Pass Sanitaire and (ii) verify employees’ compliance with COVID-19 vaccination obligations. Below we summarize several of the CNIL’s legal recommendations and best practices, but all employers should review the guidance in its entirety.
Obligations of “Establishments Concerned”
Generally, employees or agents of “establishments concerned” must, during operating hours to the public, present their health pass to attend their place of work. The health pass does not require individuals to receive a COVID-19 vaccination, but unvaccinated individuals must have recently tested negative for COVID-19 or have recovered from COVID-19. The health pass may be presented in paper or digital format, in particular on the TousAntiCovid application. Only establishment managers may request employees’ or agents’ health pass. Establishment managers, on their own initiative, may not ask employees or agents (i) about their vaccination status or vaccination schedule (e.g., number of doses, dates of injection or type of vaccination received), (ii) about their intention to receive a vaccination or (iii) to provide a vaccination certificate or the result of a screening test. That said, employees and agents of establishments concerned may, on their own initiative, provide proof of vaccination status to their employers. Importantly, the CNIL guidance confirms that this approach must remain voluntary. Employers may not require employees or agents to provide proof of their vaccination status as a condition of entry into the workplace.
Note that only certain authorized persons (e.g., the human resources department) should have access to information relating to employees’ and agents’ vaccination status. Therefore, neither employees’ nor agents’ hierarchical superior should have access to vaccination status data. The CNIL advises that, for example, employers should not ask all employees and agents to record vaccination information in a shared access document.
Sending Health Pass or Vaccination Certificate via Email/SMS
The CNIL’s guidance provides that employers may not ask employees or agents to send their health pass or vaccination certificate via email (not even via a business email address) or SMS. This is the case due to the ban on employers’ maintaining the health pass or proof of vaccination status. If employers receive employees’ or agents’ health pass or vaccination certificate via email or SMS, employers must process the information and delete it.
Requesting Applicants’ Health Pass
Employees and agents are not required to present their health pass until they begin their duties at their place of work. As such, a health pass may not be requested at the recruitment stage. Employers, however, are required to inform candidates of the obligation to present their health pass when they begin working.
Establishments Not Concerned
Employees and agents of employers that are not included in the definition of those “establishments concerned” and are not required to present the health pass may not be requested for information related to their vaccination status. When employees and agents are not affected by either an obligation to present a health pass or an obligation to vaccinate, employers may not receive any information regarding their vaccination status. Where employers have no basis to collect vaccination information, they also may not collect vaccination information in order to calculate the vaccination rate of its workforce, even in statistical form. As such, employers that are not “establishments concerned” may not restrict access to the workplace only to individuals who either are vaccinated or present a health pass. Nonetheless, such employers must adhere to all health and safety and social distancing requirements.
We continue to monitor how jurisdictions outside the US continue to respond to the evolving COVID-19 pandemic.
The material contained in this communication is informational, general in nature and does not constitute legal advice. The material contained in this communication should not be relied upon or used without consulting a lawyer to consider your specific circumstances. This communication was published on the date specified and may not include any changes in the topics, laws, rules or regulations covered. Receipt of this communication does not establish an attorney-client relationship. In some jurisdictions, this communication may be considered attorney advertising.