Digital Law Up(to)date: No processing of vaccination status in recruitment process

Article
BE Law
EU Law
Expertise
Privacy and Data Protection Technology, Media and Telecommunications Healthcare and Life Sciences

The Litigation Chamber of the Belgian Data Protection Authority (DPA) confirms that, in the absence of an existing legal basis, it is not possible for an employer, in this case a hospital, to make the recruitment of a person conditional on the fact that he or she has been vaccinated. 

Hospital corridor with an info desk, medical equipment and patient rooms

The decision (decision 143/2021 available only in Dutch, here) is interesting for at least three reasons:

  1. The DPA states that there is a processing of personal data (article 4, 2), GDPR). In order to achieve its objective of hiring only vaccinated persons, the hospital inevitably has to process the vaccination status of identified persons (applicants) in order to, among other things, separate them into vaccinated and non-vaccinated groups.
  2. Vaccination status is health data, according to the definition proposed in article 4, 15), GDPR and the clarifications made by its recital 35. The concept of “data concerning health” must be broadly interpreted and include both the current health status of a person and its possible health evolution in the future.
  3. The lawfulness grounds for processing health data are laid down in article 9(2) GDPR. The hospital invoked the law of 8 August 1996 on the welfare of workers (see the French version here), while admitting that it actually anticipated on the fact that a legal basis would be forthcoming. Indeed, a decision was taken on 20 August 2021 by the Belgian Authorities to make vaccination mandatory for caregivers as from 1 January 2022. However, at present, the legal framework does not yet mention such an obligation. The legislative process is taking longer than expected, as the Council of State is expected to give its opinion on the future mandatory vaccination during this month of January. The DPA adds that it is not within the powers of the hospital to anticipate on a future law. A strict and correct application of the law does not allow, at present, to conclude to the existence of  a legal basis for the processing of the vaccination status in view of hiring a person.

Finally, the DPA is careful in pointing out that its decision only applies in light of the law as it exists at a specific point in time. It is not intended to rule on the merits of the case, let alone on the appropriateness of mandatory vaccination.

This article was co-authored by Edouard Cruysmans in his capacity of Professional Support Lawyer at Stibbe.

Author(s)