CURRENT LEGAL SITUATION
On April 03, 2022, the legal basis for most Corona measures (and thus also the 3G rule) ceased to apply in Germany. Since then, there have only been certain basic protective measures such as a mask requirement in public transport or hospitals and nursing homes.
New occupational health and safety regulations
However, there is already one for the workplace as of March 20, 2022 New version of the SARS-CoV-2 Occupational Safety and Health Ordinance came into force. This stipulates, among other things, that companies based on the risk assessment in accordance with Sections 5 and 6 of the Occupational Safety and Health Act, determine and implement the protective measures that are still necessary for company infection protection in a company hygiene concept (e.g. compulsory testing).
Implementation difficulties for companies
From now on (and until the end of May 25, 2022 - this is how long the current version of the Occupational Safety and Health Ordinance applies), companies are faced with the difficulty of deciding for themselves which measures are necessary and must be implemented as part of a company hygiene concept. In addition to the basic protective measures such as a minimum distance of 1,50 m, reduction of personal contact in the company, ventilation to protect against infection, mask requirements in certain areas and regular company testing offers, this can also include the continuation of the 3G rule as part of the risk assessment (comprehensive weighing of interests required in individual cases). It should be noted that the employer no longer has the right to ask questions regarding vaccination and recovery status.
However, the employer is legally threatened from two sides: If he acts too laxly, he can be accused of violating the requirements of the Occupational Safety and Health Act. If he takes measures that are too strict, the associated collection of personal data may be unlawful.
DATA PROTECTION REQUIREMENTS REGARDING PREVIOUS 3G DATA
The legislature still had this in autumn 2021 § 28b IfSG changed to the effect that employers were only allowed to employ vaccinated, recovered or tested employees. At the same time, employers were obliged to monitor compliance with this regulation on a daily basis through verification checks and to document it regularly. Employers were also allowed to process personal data for this purpose. Many employers have created directories in which the status of their employees (vaccinated or recovered) or the submission of negative test results were stored.
WHAT SHOULD THE EMPLOYER NOW DO REGARDING THIS 3G DATA?
Section 28b Paragraph 3 Sentence 10 IfSG previously stipulated that the data must be deleted at the latest at the end of the sixth month after it was collected, but the provisions of general data protection law remain unaffected. According to these general data protection regulations, this data must now be deleted immediately. Art. 5 Paragraph 1 Letter e) GDPR contains the general principle that data may only be stored for as long as is necessary for the purposes for which they are processed. Like everyone in Art. 5 DSGVO The principles laid down also include those of storage limitation in the following articles, here Art. 17 DSGVO, specified. The regulation contains, among other things, the objective duty of the person responsible (Art. 4 No. 7 GDPR) for deletion if the existing status is known to be illegal. The person responsible cannot rely on the fact that the person concerned would first have to request deletion. An obligation to delete exists regardless of this request. There may be exceptions to this in the employment relationship. For example, if the deletion of the data makes it impossible or more difficult for the person responsible (employer) to pursue legal action.
CONCLUSION
The corona virus continues to require companies to be extremely agile in terms of labor and data protection law. When introducing health protection measures that go beyond the basic protective measures mentioned above, employers are well advised to first carry out a careful and comprehensive weighing of interests as part of a risk assessment. In addition, employee representatives should always be involved, if available.
