The North Rhine-Westphalia State Commissioner for Data Protection and Freedom of Information ('LDI NRW') published, on 23 March 2022, a press release on how to delete employees' personal data and destroy any proof of COVID-19 vaccination, recovery, or negative test result ('3G proof'), following the latest amendment, on 20 March 2022, to the Infection Protection Act of 20 July 2000 as amended ('IfSG'), which abolished the obligation to provide 3G proof at the workplace. In particular, the LDI NRW noted that, since the legal basis for the collection of employees' personal data in relation to COVID-19 has ceased to exist, the storage of said personal data is no longer necessary, and employers should delete it immediately.

In addition, the LDI NRW explained that, although it was not permitted under the IfSG, some employers had even copied or scanned 3G proofs. Accordingly, the LDI NRW urged employers to dispose of any 3G proof without delay and in a legally compliant manner. Specifically, the LDI NRW indicated that:

• employee health data and contact tracing data must be completely and permanently destroyed; and
• for data collected in paper form, a suitable shredder should be used, according to security level four or higher under the DIN 66399 standard, as tearing it up by hand is not sufficient.

You can read the press release, only available in German, here.