As the vaccine campaign continues with few cornerstones and many unknows, several interesting questions regarding protection and processing of vaccine-related data are starting to arise.

One of these came to the attention of the Italian Data Protection Authority (“Authority”) and concerns the legitimacy of instruments of vaccine tracking such as electronic passes or Apps. These instruments – yet to be discussed officially by the Italian Parliament – would allow only vaccinated individuals to access certain areas (airports, cinemas, restaurants) and services (public transport, circulation in general). The Authority has underlined, through a memo dated March 1, 2021, how such tools should not be considerate legitimate from a data protection standpoint unless a national law regulates the whole subject matter. In fact, an inappropriate treatment of vaccine-related data – according to the Authority – may cause extremely dangerous consequences in terms of risks for discrimination and unjustified compression of constitutional freedoms. Given the non-mandatory nature of vaccine themselves – as reminded by the Resolution of the Parliamentary Assembly of the Council of Europe on January 27 – it would be unreasonable to punish, in fact, those who freely decide not to get vaccinated, by preventing them the access to the almost all public spaces and services. Considering that such balance between public needs and individual freedoms can (and must) only be stroke by the national legislator, also to avoid fragmented rules, the Authority submitted a notice to the Italian Parliament to promptly address the matter.

The issue is relevant also on a European level: the official proposal of the “Green Pass” is expected to be unveiled on March 17, 2021. This Pass – according to the remarks by the President of the European Commission Ursula von der Leyen – should substantially be a European passport including information on vaccination and, for those who are not vaccinated, the results of the Covid-19 tests. Such instrument would hopefully facilitate international mobility. It is still to be seen whether European countries will reach consensus on the matter, as some of them (France and Belgium, among others) already pointed out the unfairness of a mechanism that would facilitate the mobility of only those who are vaccinated, in prejudice of others.

Another related issue which the Authority has addressed, with FAQs on its website, concerns the processing of vaccination-related data in the workplace. In particular, the employer is not entitled to have access to the information on whether his/her employees are vaccinated or not, being the competent doctor the only subject able to process and assess data concerning vaccination. Even if the employee, due to the fact that he/she is not vaccinated, must be considered as non-suitable for specific duties (for example in the healthcare sector, where vaccinated workers would be preferable), the employer will only be able to have access to the information on the total or partial non-suitability, while only the competent doctor would be able to process information regarding vaccination of single employees.

It seems quite evident the need for a step in of the national legislator to address these matters.