COVID-19 passports and employment: no jab, no job?

Author: Ann Bugeja

It’s like the American Express black card for the end of this Covid age. You could even call it the latest status symbol. Show it off and you can get exclusive access to festivals, stadiums, and other mass events. It may even help you cross the border without needing to quarantine.  Lo and behold, the (colloquially dubbed) COVID-19 Passport.

What are ‘COVID-19 passports?

A COVID passport is an electronic or physical record of a person’s COVID-19 vaccination history, as well as one’s examination results, medical exemptions, and antibody or immunity status.

If you have taken your first dose of the vaccine, or know others who have, you might have noticed that the COVID-19 Vaccination card does not necessarily convey its significance, given that it is simply a flimsy piece of paper. To legitimise this, along with other regions worldwide, the European Commission (‘the Commission’) has proposed to create a Digital Green Certificate to facilitate safe free movement within the European Union and the Schengen Area. The Digital Green Certificate will serve as proof that a person has been vaccinated against COVID-19, received a negative test result, or recovered from COVID-19. The European Parliament has now given its approval for the European COVID-19 passport, with an overwhelming 540 MEPs voting in favour, 119 voting against, and 31 abstaining. Eventually, a similar passport system will also be made available for third-country nationals who wish to travel to Europe.

The goal of this European pass is to boost travel across borders. In fact, the Commission proposed to create not only an interoperable vaccination certificate, but also COVID-19 test certificates and certificates for persons who have recovered from COVID-19, and therefore, the Digital Green Certificate will not be limited to those who have been vaccinated.

However, putting it in place in such a limited amount of time will surely not be an easy feat. EU officials have called for legislative and technical work to be completed “as a matter of urgency”, while imposing restrictions on non-essential travel for the time being. The plan is for the Digital Green Certificate to be in place for the Summer. It will be available, free of charge, in digital or paper format. It will include a QR code to ensure security and authenticity of the certificate. MEPs have clarified that COVID-19 passports should be in place for a maximum of 12 months and should not become a precondition to exercise one’s right to free movement within the Union.

What impacts will COVID-19 passports have in terms of global employee mobility?

In practice, this will mean that holders of these EU COVID-19 passports will not be subject to any additional travel restrictions, including quarantine, or testing requirements. At a local level, it has been announced that Malta should be among the first countries in Europe to set up the system and issue COVID-19 passports.

Once the Commission’s Digital Green Certificate is implemented, EU citizens will be able to travel freely within the EU, which will hopefully reboot and revive economies and businesses across the continent once again. For European employers, these Digital Green Certificates will bring about numerous benefits, however, certain legal challenges may also arise, as explained further below.

Challenges which employers may face in relation to COVID-19 passports

When it comes to COVID-19 passports, various challenges are likely to arise in this regard, particularly in the case of employers.

In the absence of any guidance from the Maltese authorities regarding the domestic use of COVID-19 Passports, the following questions may arise:

1. Do employers have the right to know if their employees have been vaccinated? Can employees be forced to disclose such information to their employers?
2. Additionally, can an employer force an employee to be vaccinated?
3. Can you get treated differently for your vaccination choices?

To answer the first question: yes, but with limitations. Ideally, only the medical service provider of the employer can ask such a question. Alternatively, the employer would need to obtain the employee’s consent. Whether consent may be relied on in an employer-employee scenario is a different matter, as the relationship is deemed to be unequal.

To answer the second question: it is currently not a legal obligation to get vaccinated, therefore the scenario where the employer successfully demands an employee to be vaccinated is unlikely at the time of writing. Employers in Europe generally cannot make vaccination a condition of continued employment. Further, data protection laws, such as the General Data Protection Regulation (the ‘GDPR’) limit employers in processing employee information relating to vaccinations. However, in some Member States, there is momentum for employers to be given more leeway to request proof of vaccination or obtain COVID-19 test results — especially in high-risk industries. In its recommendations, the Malta Chamber of Commerce calls for direction on the right of employers to know whether their employees have taken the COVID vaccine – a proposal first raised by the Malta Employers Association earlier this month. Certain employers might view this as being a desirable solution in the case of the employment of new staff, ensuring that current employees, especially vulnerable ones, are protected against the virus. The implications of this are still very unclear.

In terms of the third question, employers may ask those who are not vaccinated to undertake different roles or become home-based workers. This would be permitted only if there is a policy enforced without discrimination and with evidence of a risk assessment deeming this necessary to protect staff.

Can employers force their staff to get vaccinated?

Firstly, it is important to recognise that employers have a moral, and legal duty to provide their employees with a safe workplace. Of foremost concern is that any passport should clearly state whether the holder is immune to COVID-19, and whether he or she is able to spread the virus. Undoubtedly, requiring an entire workforce to be vaccinated would be difficult to achieve, both from a legal perspective, as well as from an employee-relations perspective. Until now, the Maltese Government is not actually considering any measures to make vaccines mandatory, meaning that it is up to the individual to choose whether he or she would want to be vaccinated or not. Thus, this means that those employers who may wish to render vaccines obligatory for their workers, will have to find other ways to enforce them, such as by including a particular clause in the work contracts which are drawn up with their employees.

Whilst this may be a somewhat ‘reasonable’ requirement in certain jobs, such as in the case of elderly homes, it may raise enormous challenges in others. Additionally, if this is made compulsory by the employer, but the employee refuses to get vaccinated, the employer would be required to remedy such situation, or to terminate the employment of such worker, both of which come with their respective risks. In terms of health and safety obligations, it is unlikely that employers will be required to make vaccinations compulsory in order to meet such obligations.

Additional Data Protection concerns

In terms of the GDPR, any health-related personal data should only be used for the intended purpose. Only personal data which is absolutely necessary to be collected and used may be processed. Accuracy, data security and accountability must be ensured.

Also, here we must keep in mind that the COVD-19 passport will not include reams of personal health data – it simply provides an answer to a simple question: Has this person been vaccinated/tested or not? The mere fact of vaccination or testing does run the risk of pulling in a whole host of other health data in order to validate it, in the same way that a clinical diagnosis might.

Nevertheless, internal guidance and privacy notices should be put in place and made available to employees, in respect of the collection of personal data regarding one’s vaccine status. Employees must be notified regarding what information is collected, whether this is being collected on a voluntary or mandatory basis, the purpose of its use, the legal basis on which it is being collected, and how long such data is being kept for.

MEPs have confirmed that in order to allow citizens to exercise their rights under the GDPR, personal data obtained from such passports cannot be stored in destination Member States, and further, no central European database will be established.

Local updates: Malta publishes law for introduction of COVID-19 passports

On the 30^th of April 2021, Legal Notice 203 of 2021 was published under the Public Health Act (Chapter 465 of the Laws of Malta), entitled ‘Vaccination against COVID-19 Certificate Order’ (the ‘Order’). This Order regulates vaccine certificates for travel to countries outside the European Economic Area (‘EEA’) and sets the legal groundwork for the processing of personal data, in preparation for the introduction of COVID-19 passports. The certificates are expected to be made available in Malta by the end of May and will indicate whether a person has been vaccinated against COVID-19. Such certificate will be issued after 14 days from the second dose of the vaccine and will be valid for a period of 6 months.

It has been established that the Superintendent of Public Health will be allowed to retain records of the unique vaccination certificate identifier (as long as the holder cannot be identified), however no personal data can be further processed beyond the scope of the Order.

Concluding remarks

The post-pandemic workplace will be different in many ways. The potential for new forms of discrimination and harassment is one more minefield which employers will need to navigate. At this stage, all employers should be analysing such considerations, and should begin thinking about establishing a ‘COVID-19 Vaccination Policy’ or reviewing current employment policies to ensure the addition thereof. When amending any employment manuals, employers must take into account the wellbeing of all their workforce, and such policy must be drawn up in a careful and sensitive manner. At this stage, we must also recognise that there is a limit to how feasible COVID-19 passports are, in light of the fact we are still not certain as to how long immunity lasts. Conclusively, any vaccination requirements must meet ethical and legal standards, including data protection, human rights, equality, and anti-discrimination laws.