The Rhineland-Palatinate data protection authority ('LfDI') announced, on 25 November 2021, an expansion to the permissibility of vaccination queries by employers, following the entry into force of the Law Amending the Infection Protection Act ('IfSG') on 24 November 2021. In particular, the announcement highlights that employers are now allowed to request information on vaccination, recovery from COVID-19, or test status of employees, and are able to process this data including the period of validity of the certificate pursuant to Section 28(b)(3) of the IfSG.

However, the announcement notes that once employers have checked and documented vaccination certificates or recovery, employees with a valid test certificate can be exempted from daily access controls. In addition, the announcement details that, despite the IfSG, employees are not required to submit information to employers about their own vaccination or recovery status, though as a result employees must submit test certificates every day.

Furthermore, the announcement provides that the principle of data minimisation of Article 5 of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR') continues to apply, and that employers should choose the most data-saving verification methods when processing employees' data.

You can read the press release, only available in German, here.