The Saxon data protection authority ('SächsDSB') issued, on 29 September 2021, a statement on whether employer can demand the disclosure of the vaccination and convalescence status or a negative COVID-19 test from his/her employees. In particular, the statement outlines that the introduction of the 2G option model for their business does not entitle employers to process the vaccination or recovery status of individual employees, but that this in fact requires a clear legal basis. In addition, the statement outlines that in principle, vaccination or convalescence status is health data pursuant to Article 4(15) of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR') and thus constitutes special categories of personal data within the meaning of Article 9(1) of the GDPR.

Furthermore, the statement notes that the processing of special categories of personal data is in principle prohibited under Article 9(1) of the GDPR, unless the exceptions listed in Article 9(2) and (3) of the GDPR apply. Moreover, the statement outlines that a special statutory authorisation within the meaning of Article 9(2)(b), (h) and (i) of the GDPR for the processing of data on vaccination and serostatus is provided for in Section 23a(1) of the Infection Protection Act (IfSG), according to which the employer may, insofar as it is necessary for the fulfilment of obligations under Section 23(3) of the IfSG with regard to communicable diseases, process personal data of an employee concerning his or her vaccination and serostatus in order to decide on the establishment of an employment relationship or to decide on the type and manner of employment. However, the statement notes that this authorisation is limited to processing the vaccination status of employees in the healthcare sector listed in Section 23(3) of the IfSG, including hospitals, rehabilitation facilities, day clinics, medical and dental practices, outpatient care services, and emergency medical services.

In addition, the statement outlines that as a result of the amendment to the IfSG on 10 September 2021, for the duration the epidemic situation of national scope and to the extent that this is required for preventing the spread of COVID-19, it is now regulated that the employers of facilities listed in Section 36(1) and (2) of the IfSG, including day care centres, schools, homeless shelters, may process the vaccination and serostatus for the purpose of making decisions regarding the establishment of an employment relationship or to decide on the type and manner of employment. However, the statement states that since the IfSG does not contain any legal basis for the processing of this health data beyond Section 23a(1) and Section 36(3) of the IfSG, the general principles of data protection law apply. Lastly, the statement outlines that the legal basis for the processing of the vaccination status of employees by employers may, among others, be consent or collective agreements.

You can read the press release here and the statement here, both only available in German.