The Thuringian data protection authority ('TLfDI') published, on 9 December 2021, frequently asked questions ('FAQs') on the processing of employees' COVID-19 data, in relation to the new Section 28b of the Infection Protection Act of 20 July 2000 as amended ('IfSG'), introduced by the Law Amending the Infection Protection Act and Other Laws on the Occasion of the Repeal of the Determination of the Epidemic Situation of National Scope of 22 November 2021, which entered into force on 24 November 2021.

In particular, the FAQs outline, among other things, that Section 28b(1) of the IfSG establishes that employees may enter certain workplaces only if they have been vaccinated against COVID-19, or if they have recovered or tested negative, and that the same are required make available for inspection or have deposited with the employers proof of their COVID-19 status. Further to this, the FAQ clarifies that employers must monitor compliance with said obligations by means of regular checks and to this end, they are allowed to process employees' personal data, including on COVID-19 vaccine status, sero-status, and test-status.

In addition, the FAQs highlight that employers are not permitted to make copies of the documents presented by employees, and provide guidance on the storing of COVID-19 data, adding that in any case employers must comply with the requirements for transparency under the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR').

Moreover, the TLfDI released a sample form that employees may use to provide employers with information on their COVID-19 status, in lieu of presenting their vaccination certificate or proof of recovery.

You can read the FAQs and download the sample form here, both only available in German.