Slovenia: Information Commissioner publishes guidelines on the verification of PCT conditions for employers and managers
The Information Commissioner ('the Commissioner') published, on 17 September 2021, guidelines on the verification of morbidity, vaccination, or testing ('the PCT conditions') for employers and managers. In particular, the guidelines state, among others, that employers may process the personal data of their employees if this is necessary for the purposes of exercising the rights and obligations arising from the employment relationship or in connection with the employment relationship under Article 48 of the Employment Relationships Act ('ZDR-1'). Furthermore, the guidelines stated that the Government decrees governing measures to contain the COVID-19 pandemic set out when a worker must comply with the PCT conditions, which means that they regulate additional 'rights and obligations arising from the employment relationship'. Therefore, the guidelines confirmed that the basis for the permissible processing of employees' personal data by verifying the PCT conditions are already in Article 48 of the ZDR-1 in connection with Article 9(2)(b) of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'). Moreover, the guidelines stated that, with respect to proof of PCT eligibility of visitors and service users, there is an indirect legal basis if, for example, a provision in the relevant legal regulation imposes such a mandatory verification of the fulfillment of the PCT conditions on visitors and users of the services.
Additionally, the guidelines stated that it is the responsibility of each employer to determine internally who actually carries out the verification and when, and to inform the employees. Specifically, the guidelines noted that employers may keep a list of which of the workers meet a certain PCT condition, provided that data minimisation principle is respected and that the appropriate retention period for these data in employment relationships can be up to two years.