How should you ask for the vaccine status of your employees? Malta’s Data Commissioner gives concrete advice

The Office of the Information and Data Protection Commissioner (IDPC) has recommended that those employers now required to discover their staff’s vaccination status, should collect the least information possible to receive this aim.

Contacted by BusinessNow.mt, a representative of the organisation said that employers should not keep copies of their employees vaccine certificates.

“Ideally, employers do not keep photocopies of their employees’ vaccine certificates, in accordance with the minimisation principle – keep the least possible data,” the representative said.

Instead, the recommendation is that employers simply see the vaccine certificate and take a simple note to determine when it expires.

Even so, the IDPC emphasised that a data protection impact assessment is still carried out to make sure that this sensitive information is kept as securely as possible.

Such an assessment would ensure that the organisation has the appropriate technical and organisational protections in place. For example, if the data is kept digitally, it should be password protected.

“Ultimately, the more data you hold, the more you expose yourself to risk,” the IDPC said.

The new rules, detailed in depth in a separate article, require all visitors and client-facing staff at hospitality establishments, including bars, restaurants, social clubs and snack bars, amongst others, to be fully vaccinated against COVID.

They are required to prove this by presenting a valid vaccine certificate, meaning many hospitality staff will need to present health documents to workers.

Venues found in contravention of these rules will face a €500 fine for each individual breach.

Some organisations, including the Association of Catering Establishments (ACE), told BusinessNow.mt on Friday that it would breach GDPR rules to ask staff what their status is.

The Malta Employers Association (MEA) has long been an advocate for employers ability to check employee vaccine status.

In March of 2021, the organisation stated that workers who refuse to take a vaccine should not be entitled to quarantine leave, and that employers should find out their staff’s vaccine status to ensure a safe workspace.

More recently, The Malta Chamber called for employers to be given the right to ask workers for their vaccine certificates.

Both organisations have called for legal clarity on this, as it unclear whether such a move would infringe on worker’s privacy.

While the data commissioner’s remit is not to clarify whether legally employers do have this right, it is the first Government agency to come forward with concrete recommendations on how to go about enforcing the new rules.