GDPR下新冠疫情防控中疫苗接种场景个人数据处理 -- 以比利时数据保护监管机构的意见为例- 大数跨境

首页

GDPR下新冠疫情防控中疫苗接种场景个人数据处理 -- 以比利时数据保护监管机构的意见为例

合规小叨客

2021-05-26

文章系本公众号独家首发，未经授权不得转载、摘编

图片来源：LoopTT

本文采编翻译自公开信息，在此推送仅做为知识分享、学习使用

随着全球新冠疫情防控进入了疫苗接种的新阶段，对于个人疫苗接种数据的保护成为了业内反复提及的新课题。目前，各国疫苗接种政策普遍要求为自愿接种，人们可以自由选择接种与否。针对疫苗接种相关情形，比利时数据保护机构（以下简称“APD”）进行了列明和回答，强调了在这一疫情防控新阶段下保护个人数据的重要性。

Following the current events concerning the vaccination strategy against Covid-19, there are some some recurring questions on the consequences of this strategy with regard to the processing of personal data. The current strategy provides that vaccination against Covid-19 is done on a voluntary basis, with people being free to choose whether or not to be vaccinated. The Belgium Data Protection Authority("APD") lists the most frequently asked questions concerning vaccination status and underlines the importance of the protection of personal data in this new phase of the pandemic.

2021年，比利时数据保护机构（APD）进行一系列个人疫苗接种问题问答，可为相关场景的个人数据保护提供重要参考。同时，结合2020年中兴通讯数据保护合规部（ZTE-DPC）采编了《全球疫情防控隐私合规政策指南（企业雇员数据处理）》，可为新冠疫情防控中企业合法合规处理雇员数据提供规则支撑。

In this article, we will display the FAQ of APD to serve as a reference for data protection issues related to vaccination in China. Meanwhile, the discussion about processing of vaccination status will be a part of “Global Privacy Compliance Policy Guide on Epidemic Prevention（Enterprise Employee Data Processing）”, to provide reference and support for the compliance of employee data processing in enterprises.

数保前线 | 首发：《全球疫情防控隐私合规政策指南（跨国企业雇员数据处理）》

基本原则 Basic Rules

个人的疫苗接种情况在GDPR的规定下属于一种个人数据，更具体而言，属于受到GDPR更加严格地保护的健康数据。

Information concerning the vaccination status of a person is personal data within the meaning of the General Data Protection Regulation ("GDPR") and more specifically health data which benefits from a stricter protection regime under GDPR.

发布和记录疫苗接种情况构成对健康数据的处理，此种情况受到GDPR的管制。原则上发布疫苗接种情况将会被禁止，除非数据控制者援引GDPR第9条第2款。

Claiming and recording this vaccination status therefore constitutes processing of health data to which the GDPR applies. Claiming the vaccination status will in principle be prohibited, unless the controller can invoke an exception in Article 9.2 of the GDPR.

FAQ

1、明确的同意是否可以作为恰当的合法性基础处理疫苗接种数据？

Can a controller use explicit consent as an appropriate legal basis of vaccination data processing？

GDPR第9条第2款a项规定数据控制者可以经过数据主体明确且自由的同意，处理其健康数据。这意味着数据主体可以真正地、自由地选择是否同意，并且拒绝或撤回同意也不会带来不利的后果。限制进入特定区域以证明接种了新冠疫苗违反了同意的“自由性”。因此，如果限制没有自愿接受疫苗接种的人员、还未接种新冠疫苗的人员或无法提供疫苗接种证明的人员进入特定区域，则有关人员对于是否接种疫苗的同意并非是自由的。

Article 9.2.a) of the GDPR states that you can process health data with the explicit and free consent of the data subject. This means that the data subject has a genuine free choice to give consent and that no detrimental consequences can be associated with the refusal or withdrawal of consent. Subjecting access to a specific location to proof of vaccination against Covid-19 is contrary to the "free" nature of consent. Therefore, the consent to the treatment of the vaccination status of a person concerned is not free if access to the place is refused to people who have not deliberately been vaccinated, have not yet had the opportunity to be vaccinated against Covid-19 or cannot produce proof of vaccination.

因此，在多数情况下，同意并不是一种处理个人免疫情况的适当的合法性基础。

In most circumstances, therefore, consent will not be an appropriate legal basis for dealing with a person's immunization status.

2、是否可以基于成员国的某项立法来处理此类数据？

Can a controller based on member state's law as an appropriate legal basis of vaccination data processing？

公布个人疫苗接种情况的禁令可以根据成员国的法律而取消。需要注意的是，采取立法措施应当与其追求的目的相适当，并且尊重保护个人数据的本质。此外，也需要采取适当且明确的措施以保护数据主体的基本权利和利益。

The ban on claiming the status of vaccination of persons can also be lifted on the basis of the law of a Member State. It is important to mention here that such a measure must be proportionate to the objective pursued and respect the essence of the right to the protection of personal data. In addition, appropriate and specific measures must be taken to safeguard the fundamental rights and interests of the data subject.

在劳动关系方面，成员国处理此项数据的权利可以来源于为相关人员的基本权利和利益提供了适当保障的集体劳动协议。必须指出的是，在劳动关系的背景下，这种例外条款需要被规定的足够明确，能够成为GDPR第9条第1款规定的禁止处理的特殊类型个人数据的适当的法律例外。

In the case of an employment relationship, this right of the Member State may also be established in a collective labor agreement if this offers appropriate guarantees for the fundamental rights and interests of the persons concerned. It is important to note that in the context of an employment relationship, this exception requires that the provision be sufficiently specific in the context in question to be able to act as an appropriate legal exception to the prohibition of processing of the article. 9.1 of the GDPR.

成员国也可能通过立法，授权基于保护重要公共利益或公共健康的目的进行的健康数据处理。这种立法应当与其追求的目的相适当，尊重保护个人数据的本质，并且在其中规定保障数据主体基本权利的明确措施。如果上述法律条款模糊或过于笼统，则其是不充分的。

It is also possible to authorize the processing of health data on the basis of the law of a Member State to protect an important public interest or public health. Such legislation must be proportionate to the objective pursued, respect the data protection rights of the persons concerned and be accompanied by specific measures to safeguard the fundamental rights of the data subject. A vague or overly general legislative provision is therefore not sufficient.

目前，APD并未发现任何法律当中规定了可以出于防控新冠肺炎的目的而发布、处理个人疫苗接种信息。

Currently, the APD has not yet been made aware of any legislation that makes it possible to claim the vaccination status of a person and therefore to process this health data with a view to protection against the spread of Covid- 19.

3、雇主是否可以要求雇员提供接种疫苗的证明？

Can an employer ask employees for proof of vaccination?

不可以，个人的疫苗接种情况是健康数据。健康数据是一类特殊个人数据。GDPR第9条第1款禁止对健康数据进行处理，除非可以适用第9条第2款中的例外。该例外可以是法律规定或者数据主体自由且明确的同意。这意味着，雇员必须能够真正地去选择他们是否想要自己的健康数据被处理。在雇员与雇主的关系中，雇员的同意很少能够是自由的，因为雇员可能在巨大的压力下被迫给出同意。工作场景中更多与新冠肺炎相关的信息可通过本链接进行访问。

No, a person's vaccination status is a health data. Health data is a special category of personal data. Article 9.1 GDPR prohibits the processing of health data, unless an explicit exception provided for in Article 9.2 GDPR applies. Such an exception may be a legal provision or the free and explicit consent of the data subject. This means that the worker must be able to really choose whether or not they want their health data to be processed. In the relationship between worker and employer, the consent of the worker is seldom free because a worker may be under great pressure to give his consent. More information on Covid-19 in the workplace is available via this link.

APD目前也并未发现任何法律允许以这种形式处理健康数据。

The APD is also not yet aware of any legal provision that allows this type of processing of health data to be authorized.

4、雇主是否可以询问雇员接种疫苗与否，以便能够履行法定的职业安全和健康义务？

Can an employer ask all employees if they have been vaccinated in order to be able to meet legal occupational safety and health obligations?

不可以。在劳动合同法当中，雇主有义务确保员工的工作在安全和健康的环境中开展。然而，雇主不得基于这一义务询问他的雇员是否接种疫苗。

No. In the Law on employment contracts , the employer has a legal obligation to ensure that the work is carried out under suitable conditions from the point of view of the safety and health of its workers. However, an employer cannot, on the basis of this legal obligation, ask his workers who has been vaccinated and who has not.

对这类信息的简单的询问已经构成了对个人数据的处理，这种情况在GDPR下甚至构成对健康数据的处理。对健康数据的处理适用GDPR第9条第2款确定的原则性禁止。但是这种禁止也有一些例外，例外可能使处理健康数据具有合法性。因此，如果数据处理是为数据控制者（此种情形下为雇主）履行其劳动法、社会保障义务所必要的，那么健康数据可以被处理。

The simple fact of asking for this information already constitutes processing of personal data, in this case, it is even health data, under the GDPR. A principle prohibition, formulated in article 9.1 of the GDPR, applies to the processing of health data. There are some exceptions to this prohibition, making the processing of this health data lawful. Thus, health data can be processed if the processing is necessary for the purposes of fulfilling the obligations of the controller (in this case the employer) in terms of labor law, social security and social protection.

5、雇主可以问职业医生哪些雇员已经接种了Covid-19疫苗吗？

Can an employer ask the occupational doctor which employees have been vaccinated against Covid-19?

不可以。这不仅会侵犯对员工的个人数据保护，如果职业医师将医疗档案当中的数据传达给雇主，这还可能违背了职业医生的职业保密义务。

No, it is not allowed. This would violate not only the protection of workers' personal data but also the professional secrecy of the occupational physician if the latter communicated data from medical files to the employer.

至今为止，没有相关的法律规定可以构成禁止处理个人健康数据的例外，或者构成职业医师就疫苗接种遵守其保密义务的例外。一方面，雇主不可以基于雇员的同意处理其健康数据，因为雇主与雇员之间的关系是不稳定的，雇员的同意不是一种“自由的同意”。另一方面，同意并不构成职业医生职业保密义务的例外。

So far, there is no legal basis which constitutes an exception to the prohibition of processing health data or to the professional secrecy of the occupational physician in the context of vaccination. The employer also cannot do this on the basis of a consent by the worker because due to the precarious relationship between the employer and the worker, this consent will not be considered as being a "free consent" by the worker. On the one hand and because consent does not constitute an exception to the professional secrecy of the occupational physician on the other hand.

参考资料 Reference