Personal data and decrees: The commissioner clarifies with 14 answers

1. In relation to my personal data, how the Decree of the Minister of Health dated. 08.07.2021, is it different from the previous Decrees?

Under the previous Ordinances, the employer had the right to check the certificates of its employees on a sample basis. Now, it has the obligation to check that all employees hold a certificate for Rapid test or PCR 72 hours or for recovery from Covid-19 or for vaccination.

In previous Ordinances, the owners / managers / managers of certain places, such as leisure centers, restaurants, gyms, etc., were not obliged to check their customers' certificates. Now, they have the obligation to check them and ask the customers to show their identity card or passport. External premises of premises, which serve less than 20 people, are excluded from this obligation.

2. The Decree dated 08.07.2021, in relation to the previous ones, violates the legislation for the protection of personal data?

No. What is different is that this Decree creates additional obligations due to the current epidemiological situation.

3. What is the role of the Commissioner in relation to these Decrees?

The role of the Commissioner is to advise the state when drafting legislation on issues of personal data protection and to ensure that their provisions are in accordance with the General Regulation of Personal Data. The Principle of Proportionality requires that the obligations created by a Decree are proportionate to the purpose pursued at the time. In this case, the current epidemiological situation requires and may justify the additional obligations.

4. Are these measures legal and proportionate?

Yes, in relation to the current epidemiological situation. However, because they are more intrusive in relation to the measures of previous Decrees, the Commissioner, in the context of the legal consultation, demanded and ensured that, in this Decree, there is a legal basis for the owner / manager / administrator of the site to check the certificate I also have my ID card or passport.

5. In my workplace, how will the certificate I hold be checked?

In any case, the responsibility for the control lies with the employer (paragraph 2.82 of the Decree dated 08.07.2021). In workplaces where there is a Safety and Health Officer under the relevant Legislation, the control of the certificates should be done by this Officer.

If a company is exempt from the obligation to appoint a Safety and Health Officer and there is no authorized private security guard, the audit should be performed by the employer.

Also, in workplaces, checks can be carried out by the Police and depending on the activity of the company, by the authorized Officers mentioned in paragraph 2.48 (c) of the Decree dated 08.07.2021.

In the event that an employee refuses to show the certificate he holds, the employer should take steps to ensure that both he and the employee comply with this Decree.

6. In cafe, restaurant, hotel, gym, etc .;,how will the control be done?

In any case, according to paragraph 2.48 (a) of the Decree, the responsibility of control lies with the owner / manager / administrator of the space.

7. How can I be sure that the person conducting the audit is an authorized official, Officer or Police Officer?

I can ask him to show me his police or service ID or his warrant.

8. Can my employer record details of the certificate I hold?

As the Decree shows, yes. This is because he must be able to know which of his employees have been vaccinated and / or become ill and have recovered and are therefore exempt from the obligation to present certificates for a 72-hour Rapid test or PCR. He or she must also be able to know when the 72-hour Rapid Test or PCR certificates of employees holding such certificates expire. It is understood that in no case is it justified to provide a copy of the certificate.

9. Can the owner / administrator / manager of a space covered by the Decree record details of the certificate I hold or my identity / passport?

No. The last Decree does not give him the right, nor does it oblige him to keep my information.

10. In what other cases is it allowed to record my certificate details?

The recording of this information is exceptionally allowed only in special cases, such as in hotels where it should be checked that the stay of a customer does not exceed the period of validity of the certificate he holds. In any case, the person in charge of the site must be able to prove that some data must be recorded.

11. If I arrange a party or reception at a hotel or leisure center or restaurant, will I be responsible for checking my guests?

No. According to paragraph 2.48 (a) of the Decree, the responsibility always lies with the owner / manager / manager of the site.

12. The measures provided for in this Decree also apply to the European Digital Certificate (EuropeanUnionDigitalGreenCertificate - EUDC);

No. The EUDCC is used for travel purposes only. It may not be used for the purposes of this Decree.

13. If I do not have the certificate I have with me, could I use my EUDCC?

No, because according to the Decree, the EUDCC is not evidence. The Commissioner is in consultation with the Ministries involved so that, if it is necessary to regulate the use of EUDCCs within the Republic, this is in accordance with the conditions set by the European EUDCC Regulation.

14. If the epidemiological situation improves, can the Commissioner request the suspension of some provisions of a Decree?

Yes. If the epidemiological situation improves and the Commissioner deems that the provisions of a Decree are no longer in accordance with the General Regulation on Personal Data, she may request their temporary suspension, until the Decree is amended or repealed.