Can companies ask to see their employees’ corona passport?

The Norwegian corona passport will currently only be a requirement for entrance at amusement parks, museums, cinemas, theatres, concert venues and similar cultural activities and entertainment venues. But can companies require employees to show their corona passport without notice at the workplace, and can the company process the health information that the corona passport contains?

Whether or not the new corona passport should be used at the workplace was subject to discussions between the relevant organizations during the hearing of the draft bill. However, because employee and employer organizations were reluctant to accept such a requirement, the Norwegian government decided that the corona passport should not be used at the workplace. Consequently, a requirement from the company’s side to see employees' corona passport must therefore be done in connection with the Norwegian Working Environment Act's rules on control measures.

Disproportionate control measure

Companies will only be able to require seeing employees' corona passport if there is a justified cause, and if the requirement is proportional. Requiring seeing the employee’s corona passport must therefore not result in a disproportionate burden for the employees.

Preventing the spread of infection in the workplace is in principle a justified cause, just as a requirement to see employees’ corona passport can help with preventing the risk of infection. However, if less intrusive measures can be used to achieve the same goal, the requirement to see employees’ corona passport will be considered disproportionate, and therefore unjustified.

Measures such as remote working, flex time, social distancing and/or good hygiene routines are less intrusive and are still considered effective measures to prevent the spread of infection. It is therefore unlikely that the requirement to see employees’ corona passport would be considered proportional.

Remembering GDPR when using the corona passport

A company needs a lawful basis to process information on whether the employee is vaccinated, immune or has a negative test. The new corona passport gives a ”consent based” overview of the employees ”corona status” via a QR-code, but while it might appear that the corona passport ensures a lawful basis for processing the data, consent is hardly the correct basis or sufficient for companies to comply with the rules under the applicable data protection rules.

As information in the new corona passport is health information, there will be strict requirements on how and why the information is processed. Companies should therefore be aware of the special rules that apply when processing sensitive information. We have previously briefly described the rules here.

IUNO’s opinion

As a starting point, it is unlikely that companies can demand to see an employee's corona passport. This is especially because the corona passports have not been introduced with the intention to be used at the workplace and because measures such as remote working, flex time, social distancing and good hygiene routines are effective measures against infection at the workplace.

If companies are considering introducing a requirement to see employees corona passports at the workplace, IUNO recommends that the reason for introducing the requirement is thoroughly considered along with considerations on how to ensure compliance with applicable data protection rules. Companies should also, in any case, seek legal advice before implementing control measures relating to the corona passport.

[The Norwegian Infection Control Act of 11 June 2021]