The Italian Data Protection Authority (“Garante”) has updated its FAQs on the processing of personal data in the context of the health emergency caused by COVID-19, to provide guidance on the processing of data related to COVID-19 vaccination by the employer.

Specifically, the Garante explained that the employer cannot acquire the names of the employees who are or are not vaccinated, even if provided with the formal consent of the employees themselves (who are deemed unable, in fact, to express a “freely given consent” due to their subordination). Similarly, the employer cannot ask them to provide copies of vaccination certificates, nor can the employer retrieve such information from the appointed doctor. Indeed, the only piece of information that the employer is entitled to ask the appointed doctor for is the "assessment of the employee’s suitability" with respect to the specific tasks to which the employee has been assigned.

The Garante also clarified that only national law can impose a COVID-19 vaccination as a mandatory precondition for accessing the workplace and/or carrying out certain tasks. At the moment, in case of “direct exposure to biological agents at work” (for example in healthcare facilities, which involve a high level of risk for workers and patients), “special protective measures” – as provided for under Article 279 of the Italian Legislative Decree no. 81 of 2008, Title X – may apply; in such circumstances, the measures may also include the administration of vaccines.

In a later statement dated March 1, 2021, the Garante further commented on the issue of the so-called "vaccination passes" – i.e. on vaccination as a precondition for access to certain premises (not only workplace-related). The Garante reaffirmed the necessity that the treatment of data related to citizens’ vaccination status for the purposes of granting/denying them access to certain premises be imposed only by national law, in accordance with the principles of protection of personal data (in particular proportionality, data minimization and limitation of purposes), thus ensuring  a balance between public interest and the right to privacy. In the absence of such a legal basis, any system leading to distinguishing between vaccinated and non-vaccinated citizens shall be deemed unlawful.