Newest explanations relating to vaccination and employment matters in Latvia

The Data State Inspectorate (supervising authority in Latvia) has issued two explanations on vaccine related subject, in particular, how an employer can conduct a survey among employees on their attitude towards vaccination against COVID-19 and what data and on what basis are processed if registration for vaccination is organized by the employer.

In response to complaints about employers requiring its personnel to provide their names when a survey is conducted with a purpose to gather information on how many employees are going to take a vaccine, Data State Inspectorate emphasized that the principle of data minimization shall be observed. In order to process data, the employer shall determine the legal basis, purpose of processing and amount of data necessary for such processing. If no purpose for data processing can be identified or the purpose can be achieved without data processing, no processing shall take place. According to the explanations published by Data State Inspectorate, when conducting the survey with the purpose to determine a collective opinion about vaccination, it is not necessary to gather data identifying employees who have participated in the survey. In other words, it is sufficient if the survey is conducted anonymously. Thus, in the opinion of Data State Inspectorate, the requirement to provide a name and surname is not necessary and proportionate with the purpose to collect information on personnel’s attitude towards vaccination.

In other public statement, Data State Inspectorate explained the legal issues surrounding a list compiled and submitted by an employer when registering its employees for vaccination. As of 5 February 2021, registration for vaccination can take place also via a list compiled by the employer. Data State Inspectorate explained that, when compiling a list of employees with the purpose to organize a collective vaccination against COVID-19, the employer is processing data of employees (name, surname). It should be noted that vaccination is completely voluntary in Latvia. Thus, the only legitimate legal basis for such processing is a GDPR compliant consent of an employee. Therefore, the employer should take into account that any employee may revoke his or her consent at any time and no adverse consequences may happen for this employee should he or she refuses to provide consent or change the attitude towards voluntary vaccination process.

On a side note, we would like to remind that data on whether or not a person has been vaccinated against COVID-19 is a “special category of data” whose processing is more difficult to justify. So far, no obligation to get vaccinated against COVID-19 has been laid down in the Latvian law, therefore it is arguable whether companies can rely on legal obligations in connection with employment or public interests relating to public health and safety measures. Thus, the only basis for processing such data is a consent of an employee. At least for now, when vaccination is completely voluntary in Latvia. As it is well-known, a consent is a not a preferred basis in the employer-employee relationship in which the employer wields more power than the employee. Consent is only appropriate if someone can withdraw it at any time. Thus, employers should refrain from processing of such data as long as the legislator has not made vaccination compulsory for at least some of professions.

Since the last year introduced many changes in the usual work organization process and work environment, workplace has been shifted from offices to home, thereby in our daily life remote work and online communication has increased significantly effecting our privacy as well. Living place of the employee has become the new office where we perform our work duties and rest after the end of the working day. 

Given the circumstances employers are seeking innovative solutions to monitor employees so that they perform their duties responsibly, in the appropriate quality and scope. In this regard, Data State Inspectorate has provided explanations about video surveillance for work performance control, using video surveillance cameras built into laptops or by connecting a webcam to the computer. It is common that an employer uses cameras to organize remote employee meetings or other types of online meetings. However, when it comes to promoting employee productivity and monitoring their performance on an ongoing or daily basis, sometimes employers are taking it too far by obliging employees to keep the cameras of their computers or other work devices on all the time.

Following the requests for clarification on surveillance of remote work of an employee, Data State Inspectorate published explanations, whether the employer can oblige the employee to work all day with the video camera switched on in order to monitor and control their productivity, e.g., the quality and quantity of work performed. Arguing that such request from the employer is controversy with data minimization principle, Data State Inspectorate pointed out that the employee has the right to privacy at work and during working hours, especially when it comes to remote work. 

It must be borne in mind that one of the main preconditions for lawful personal data processing using webcam is the proportionality between the employee’s rights and the employer’s interests. Employer must respect employee’s private life during working hours and take into account that the workplace is the employee’s private space (home). Consequently, when the employer continuously monitors its employees at home, the interference with the employee’s privacy is significantly greater than with video surveillance at the office. Furthermore, it is not necessary for the employer to observe and analyze employee’s behavior in the work process, using video cameras, e.g., recording unusual employee behavior during work, including tracking when the employee leaves the room or when another person enters the room, etc.

Taking aforementioned into account, it is advisable to assess, whether there is a possibility to apply a better, less intrusive way to achieve the goal of promoting employee productivity, for instance, by introducing weekly reports or arranging weekly meetings. However, if the employers believe that the surveillance of the personnel through webcams is the only possible way, then it is highly advisable to conduct privacy assessment report beforehand and make sure that such personal data processing will be compliant with the provisions of GDPR.