Testing and vaccination rules pose questions for German employers

The obligation to work at home has ended and employees are returning to workplaces, where employers must offer them tests, but they are not in a position to compel employees to take the tests.

There are significant regional differences in rules and changes to rules over time as the situation develops. This means that an increasing amount is expected of companies, but their ability to act is constrained by complex and changing rules.

The German government is responding to an increased risk of infection as people return to workplaces. Employers who want to take voluntary measures to protect employees’ health are restricted by labour and data protection laws. Employers can find themselves in an unresolved legal situation, which generates risk for them.

Employee testing

Employers in Germany must offer and pay for two tests per week for employees not working exclusively from home. While employers are obliged to offer the tests, in most federal states employees are not obliged to accept the offer and actually carry out the tests. However, exceptions apply in some federal states.

In Bavaria, employees in hospitals, old people's homes and nursing homes must do the test. In Bremen, there is compulsory testing for all employees that are not able to work from home. In North Rhine-Westphalia, every employee who has had at least five days off must provide the employer with a current Covid-19 test result when they return to the workplace or take a test there. Employees with full vaccination or convalescent proof are exempt from this rule.

Despite these exceptions, until now there is no general legal basis under which employers can oblige employees to undergo tests without any reason. Case law suggests that the requirement of workplace tests by employers may be lawful under certain circumstances even outside Bavaria, North Rhine-Westphalia and Bremen, since employers are obliged to protect employees from health hazards.

But because the legal situation is vague employers should order tests only in exceptional situations. The decision should take into account factors such as whether there are many suspected cases in the company, or whether parts of the workforce show symptoms of illness. High incidences in the region as well as many contacts in the firm and with third parties may also strengthen the case to order a test, especially if there is no other way to protect employees. If testing is refused despite a justified order, the employer can issue a warning, and under certain conditions he can also withhold the test refuser's wages.

Another crucial question about testing in the workplace is whether the employer is entitled to know if an employee has tested positive for Covid-19. After all, test results are health data which is particularly sensitive information under the General Data Protection Regulation.

However, the employer has a duty of care to employees which means they may have a right to be informed about positive test results, especially if the testing was mandated by a state. But this does not exempt employers from observing the principles of data protection law, especially the principle of data economy and purpose limitation. Whenever employers collect health data, special precautions must be taken to protect the data to prevent it from being misused. The data must be deleted as soon as the purpose for which it was collected has been fulfilled.

Employers should also inform their employees about the specific procedure to be followed in the event of a positive test as part of the required information about the test offer. 

Vaccination of employees

Vaccination prioritisation was lifted on 7 June in Germany. Since then company doctors have also been involved in the vaccination campaign. Currently, half of the population is fully vaccinated.

In Germany there is no legal obligation to vaccinate, not even for special occupational groups, as will be the case in France and is already in Greece for health and care workers. Compulsory vaccination is being discussed in Germany but is not thought to be likely to happen. An employer's order for vaccination can therefore only be considered in individual where it is the correct balance of employer’s and employee’s rights. As long as other suitable protective measures are available, an order by the employer is likely to be ineffective.

Some employers want to put financial incentives in place, such as a vaccination bonus. This can be done, but incentives to vaccinate are already being provided in other ways, for example by removing the obligation to be tested for fully immunised travel returnees in North Rhine-

Westphalia. Presumably, further incentives will be created in the coming months.

Nevertheless, employees are in principle not obliged to tell their employer whether they have been vaccinated or not: according to Article 9 of the GDPR, the processing of personal data requiring special protection - which includes health data - is in principle not permitted. 

However, the data may be processed if the employee consents. In principle, consent to the processing of data is given if the vaccination certificate is submitted voluntarily, for example, because employees in North Rhine-Westphalia want to exempt themselves from the compulsory testing for holiday returnees that applies there. It is nevertheless sensible and advisable to have the employee sign an additional declaration of consent to the processing of personal health data. On the one hand, it can be transparently explained to the employee how, by whom and for what purpose the personal health data will be processed. On the other hand, the written declaration of consent serves the employer's documentation and verification purposes.