Where to put data on immunization status?

The corona pandemic made it necessary for many employers to record the vaccination status of employees. Especially in the area of facility-based mandatory vaccination, this also had to be documented and proven if necessary.

With the end of the facility-based mandatory vaccination, there is now the question of how to deal with this data from now on. Delete or store - that is the question. In order to be able to continue storing the vaccination status data, there would have to be a legal basis for doing so. This could result from various regulations.

Vaccination status in the Corona regulations of the countries.

For persons working in hospitals, rehabilitation facilities, nursing homes and comparable facilities, testing remains mandatory in accordance with Section 28b I No. 3 IfSG. This test must be performed three times a week. Some federal states have deviated from this and stipulated that such persons only have to be tested twice a week if they present proof of vaccination or convalescence (e.g. § 4 I 1 Lower Saxony Corona Ordinance).

If an employee takes advantage of this exemption, there is a legal basis for continuing to store vaccination status.

Vaccination status in the Protection against Infection Act

§ Section 35 VI IfSG stipulates that fully and partially inpatient "facilities for the care and accommodation of elderly, disabled or persons in need of care or comparable facilities" are obliged to provide the Robert Koch Institute (RKI) with information on vaccination status. This information includes the percentage of persons who are vaccinated. This refers to all persons employed and treated or cared for in the facility. The data is transmitted to the RKI in anonymized form.

In these cases, there is a legal basis for the continued storage of vaccination status data.

Objections to the practicability of deletion

Some argue that employers should continue to store vaccination status data because it is not foreseeable whether they will need to be collected again in the near future. If the incidence of infection were to escalate again in the future to such an extent that vaccination status data were to become relevant again, they would have to be collected again, which would involve a great deal of effort.

These objections do not provide a basis for continued storage of vaccination status data. No one can accurately determine whether and how the Corona virus will continue to spread. In such cases, the decision to continue storage must be left to the decision-making prerogative of the legislature.

If the vaccination status data were still stored, this would be tantamount to unlawful data retention. This would mean intervention by the supervisory authorities.

Conclusion

In most cases, the end of the facility-based immunization requirement and the flattening of the legal requirements to retain immunization status data means that this data must be deleted. The purpose of the storage has ceased to exist.

In the few exceptional cases mentioned, the data may continue to be stored. If these exceptions also expire in the future, the affected vaccination status data must also be deleted. Affected employers should already start thinking about a suitable deletion procedure.

Do you need support in the area of data protection? Our team of experts will be happy to assist you. Contact us here!