Legal aspects of the vaccination against Covid-19

The abovementioned documents are based on the conviction that “better acceptability results can be achieved if the vaccine is voluntary”. In this sense, patients who are willing to get Covid-19 vaccine should give their informed consent which, as a general rule, should be verbal, except in cases of consent by proxy. This requirement is the result of the legal demand set out in Art. 8 of the Law 41/2002, of 14 November, which is the basic law regulating patient autonomy and rights and obligations, in terms information and clinical documentation, whereby any action taken in relation to the patient's health requires the free and voluntary consent of the person concerned; that is to say, the patient has the right to refuse or accept a treatment.

In addition, the Ministry of Health guidelines foresee the creation of a single registry -housing COVID-19 vaccination data for the whole country- for which the Ministry of Health will be the data controller. This registry will be interoperable (with other registries implemented during the pandemic) being fed with information from the Autonomous Communities vaccine registers and will have the following aims: (i) to keep track of the doses and types of COVID-19 vaccines administered to different population groups; (ii) to calculate the vaccination coverage; (iii) to assist in surveillance and follow-up activities; (iv) to carry out different observational studies with the aim of controlling the pandemic and measuring the vaccine effectiveness and; (v)to allow the issuance of certificates upon request.

This raises two legal questions, regarding vaccination, which we consider to be particularly relevant. Firstly, what impact will the creation of such a registry have on the protection of personal data? And secondly, if there was a high percentage of the population who decided not to have the vaccine administered, could the Government impose a compulsory vaccination?

With regard to the first question, bearing in mind that the creation of the registry and information system for vaccines will involve the processing of personal data, its implementation must comply with the requirements set out in the General Data Protection Regulation (EU) 2016/679 (GDPR). In particular, it must be guaranteed: the lawfulness of the processing, the transparency of the information, the quality of the data, as well as the application of appropriate security measures to prevent and minimise the risks. In relation to the applicable legal basis, this could be found within the aforementioned rule in Art. 6. (1) d) “processing is necessary in order to protect the vital interests of the data subject or of another natural person”, or in Art. 6.(1)e) “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”, with the reinforced lawfulness of Art. 9.(2) i) “processing is necessary for reasons of public interest in the area of public health, protecting against serious cross-border threats to health (…)” and Art.9.(2) j) “processing is necessary for archiving purposes in the public interest, for scientific or historical research or for statistical purposes (…)”.

With regard to the duty of transparency, everything points to the fact that the Regional Ministries of Health of the Autonomous Communities will be responsible for providing information to patients, in a concise, intelligible manner and in clear and plain language, about the processing of their data, as well as providing information about the necessary communication of such data to the Ministry of Health. In relation to the data quality principle, special attention shall be paid to the principles of purpose limitation and data minimisation, taking into account that special categories of data shall be processed, in particular, epidemiological risk factors: health data, sex life and/or personal characteristics which are relevant to the indication of vaccination. With regard to the security measures, as the data controller is considered a public Administration, the security measures applied must be aligned with those established in the National Security Framework.

In view of the above, it is relevant to point out that one of the documents issued by the Ministry of Health states that "it is considered important to register cases of rejection of the vaccination in the vaccination registry, in order to understand the possible reasons for this in different population groups”. This statement raises the following questions, which are not clarified in the document itself: will the information referred to be processed anonymously for statistical purposes or will specific data subjects be identified; in the latter case for what purpose?

As regards the second question, it should be noted that vaccination in Spain is based on a general principle of voluntariness, but can this general rule be displaced? There are certain situations in which the public authorities could impose forced individual vaccination and in which the fundamental right to physical integrity – Art. 15 of the Spanish Constitution - could give way to the right to health protection – Art.43 of the Spanish Constitution.

In this regard, case law has been demanding that, in order to impose compulsory vaccination in specific cases, the following conditions must be met: (i) a constitutionally legitimate good is being pursued, in this case, the right to health protection; (ii) the decision is covered by a regulation with the status of law-principle of legality-, in this sense Art. 1 of Organic Law 3/1986 allows adopting "in order to protect public health and prevent its loss or deterioration, the health authorities of the different Public Administrations may, within the scope of their competences, adopt the measures provided for in this Law when so required for urgent or necessary health reasons". For its part, Art. 12 of the Organic Law 4/1981, of June, on states of alarm, exception and siege, establishes that: "the competent authority may adopt by itself, depending on the case, in addition to the measures foreseen in the previous articles, those established in the regulations for the fight against infectious diseases"; (iii) the overcoming of the triple judgment of proportionality: suitability, necessity and proportionality in the strict sense; (iv) the decision of a judicial authority.

Finally, different health sectors and the Government itself have pointed out that it is not the most appropriate to make vaccination compulsory, due to the counterproductive effects that could be produced in the population. So, it seems that, in principle, the vaccination campaign will be reinforced with sufficient information to generate adequate levels of confidence in the population.