On September 15, 2021, the Ordinance on the method of meeting the condition of morbidity, vaccination and testing to curb the spread of SARS-CoV-2 virus infections (Official Gazette of the Republic of Slovenia, No. 147/21) entered into force, which, among other things, also stipulates compliance with the RVT condition for the duration of work for all employees and persons who perform work for the employer on any other legal basis, or work in a self-employed capacity.
Pursuant to the Ordinance the employer is obliged to verify compliance with the RVT conditions. However, the practice shows uncertainty when it comes to ensuring compliance with the ordinance on the one hand and sensitive personal data protection on the other.
The Information Commissioner stated that the employer, when verifying RVT evidence, must comply with the principle of data minimisation (according to which personal data are adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (Article 5, point c of Regulations (EU) 2016/679)). The employer may verify the compliance by inspecting one of the proofs listed in Articles 2 and 6 of the Ordinance, the authorized person of the employer may make an official note, while storing the unique code from the digital COVID certificate is inappropriate as it is not necessary to complete the purpose of the processing (i.e. to verify compliance with the RVT condition).
Furthermore, the employer must protect personal data in a way that unauthorised disclosure does not occur, which means that data regarding compliance with the RVT condition can only be accessed by an authorised person of the employer and no other employees (Article 5, point f of the Regulations (EU) 2016/679). Lastly, the employer must (as the controller of personal data) inform its employees of the purpose for which their personal data will be processed after fulfilling the compliance with the RVT condition (Article 13 of Regulations (EU) 2016/679).
It is, on the other hand, an obligation of the employee, to enable the employer the fulfilment of the compliance with the RVT condition by enabling him to inspect on of the proofs listed in the Articles 2 and 6 of the Ordinance.
Full text (in Slovene) of the Ordinance on the method of meeting the condition of morbidity, vaccination and testing to curb the spread of SARS-CoV-2 virus infections (Official Gazette of the Republic of Slovenia, No. 147/21) can be found here, and full text (in English) of the Regulations (EU 2016/679 ) here.
