In the context of the COVID-19 pandemic, numerous governments throughout the world have launched mass vaccination campaigns and resorted to harsh restrictive measures. In some instances, these measures are resulting in severe restrictions on the rights of unvaccinated persons (including the denial of access to workplaces), which proves to be a highly controversial issue.
Compared to other countries, the measures that the Ukrainian government has taken so far regarding vaccination and its mandating are relatively limited and lenient, whereas vaccination rates in the country remain rather low.
1. Is vaccination against COVID-19 mandatory for employees in Ukraine?
Currently, under Ukrainian statutes (in particular, according to the Law of Ukraine “On Protection of People against Infections Diseases” No. 1645-III dated April 6, 2000, as amended), preventive vaccination against COVID-19 is not directly mandated by law. The Ministry of Healthcare of Ukraine is, however, authorized to mandate preventive vaccinations for employees of certain occupations, industries and organizations whose work can expose them to infections or lead to the spread of infectious diseases.
As of today, the existing list of such occupations, industries and organizations (approved by order of the Ministry of Healthcare of Ukraine No. 2153 dated October 4, 2021) covers only employees of central and local executive authorities as well as the education sphere. It does not include employees of private businesses, for whom preventive vaccination against COVID-19 remains voluntary.
Since the epidemiologic situation in Ukraine is rapidly deteriorating, the Ministry of Healthcare of Ukraine has announced its intention to expand the above list. It is expected that the extension of vaccination mandates can affect employees in occupations and industries serving customers or otherwise frequently contacting other people (such as medical personnel, workers of hospitality, transportation, restaurant, retail trade, and similar industries).
In addition, national or local authorized epidemiologists (“chief sanitary doctors”) can mandate preventive vaccination in individual cases on a particular territory or in an object based on epidemiologic criteria. The statutory reasons for this are:
a threat of an outbreak of a highly dangerous infectious disease; or
a massive outbreak of a dangerous infectious disease.
Although the Ministry of Healthcare qualifies COVID-19 as a “highly dangerous infectious disease”, and Ukraine has meanwhile entered its next pandemic wave with infection rates being on the rise throughout the country, to date no individual decisions mandating ad hoc vaccinations have been made.
2. Can private businesses require their employees to vaccinate?
As mentioned above, preventive vaccination against COVID-19 remains voluntary for employees of private businesses in Ukraine. Therefore, employers may not require that their employees vaccinate and request vaccination as a condition for their admission to workplaces / entering the office or engaging in certain tasks.
Moreover, employers may not discriminate against unvaccinated employees, e.g., deprive them of certain rights or benefits only because they are unvaccinated, or apply to them disciplinary measures or other liability. Employers can only encourage their employees to get their shots (e.g., by arranging informational campaigns).
3. Can an employer request employee vaccination data?
Employers should be aware of whether they are allowed to request their employees to prove their vaccination status and whether they can impose any sanctions on those who refuse to do so.
It appears permissible for an employer to ask its employees to demonstrate proof of vaccination (a respective vaccination certificate) only if vaccination against COVID-19 has been explicitly mandated for a respective employee category (as explained above). Please note that the law obliges the employer to suspend from work employees who refuse to vaccinate, if vaccination is to mandated for them by the Ministry of Healthcare of Ukraine. Thus, the employer would require formal proof of vaccination in order to comply with its statutory obligation not to admit unvaccinated staff to work.
As long as vaccination is voluntary for employees of private businesses, respective employers may not request their employees to provide any vaccination data and/or formal proof of vaccination. Such employees can provide those data/proof only voluntarily, with their express consent. Refusal by an employee to provide vaccination data may not result in any negative consequences / sanctions (such as the denial of access to the workplace) for or discrimination against them.
4. Employees’ consent to processing and employer’s duty to notify the regulator
Furthermore, employers should be aware of and properly address the related data protection issues when collecting and processing their employees’ vaccination data. In any case, the employer must comply with the data protection laws, in particular, the Law of Ukraine “On Protection of Personal Data” No. 2297-VI dated June 1, 2010, as amended (hereinafter – the “Data Protection Law”).
Vaccination data will most likely be considered as health data and thus constitute a “sensitive category” of personal data (as defined by Order of the Parliament Commissioner for Human Rights No. 1/02-14 dated January 8, 2014). Accordingly, the employer will have to, in particular:
obtain express and informed consent from employees for the collection and processing of their vaccination data and
submit a formal notification on the processing of sensitive data to the Ukrainian data protection regulator – the Parliament Commissioner for Human Rights (hereinafter – the “Commissioner”).
It should be noted, however, that the Commissioner's Office has expressed a non-binding opinion that the collection and processing of employees' health data by the employer to the extent necessary to create and maintain safe working conditions in the workplace in accordance with applicable laws, as well as to ensure compliance with the legislation on employees' rights in the field of labor safety may take place without notifying the Commissioner. Nevertheless, employers should treat such opinions with caution as they do not constitute legal provisions or binding individual decisions, and the regulator might change their mind at any time. Moreover, there have not been any guidelines or recommendations issued by the Commissioner specifically in relation to the processing of vaccination data. Any employer/person can address a written request for clarification to the regulator for particular measures, and the regulator is obliged to respond within a month.
Failure to comply with the above notification duty is likely to inflict administrative fines on the employer’s management of UAH 3,400 to 6,800; and UAH 5,100 to 8,500 for a repeated violation during a year.
5. Other requirements to the processing of vaccination data
In the absence of a specific guidance from the Commissioner, general requirements for sensitive personal data processing, storage and retention would apply. Pursuant to the Data Protection Law, a personal data controller (employer) shall, at the time of vaccination data collection, notify the personal data subjects (employees) of the composition and content of collected personal data, their rights defined by the law, the purpose of personal data collection and third parties to whom their personal data is transferred.
Generally, collected personal (vaccination) data must be relevant, adequate and not excessive in relation to the specified purpose for which they are processed. Data can be stored/retained only so long as it is necessary for a lawful purpose for which they were collected and further processed (i.e., in the present context, so long as it is justified by the mandatory vaccination requirements and/or quarantine restrictions in force).
The particular scope of vaccination data that an employer (data controller) is allowed to collect and process is determined by the consent that must be obtained from the employees prior to such data collection and processing. However, where possible/appropriate, data minimization is advisable (in particular, limiting the answers to the fact of vaccination – “yes” / “no” answers). Data protection considerations are more acute when requiring specific information (e.g., providing details of the type of vaccination and date of vaccination; providing evidence of vaccination).
It may be advisable to carry out a voluntary data protection impact assessment prior to collecting and processing vaccination data, collecting only the minimum amount of data needed, ensuring that the process by which the data is collected is secure, and explaining the reasons to the affected persons.
Download PDF here.
This publication is for informational purposes only. If you would like to learn more or seek legal advice, please contact one of the following or your usual Nobles contact:
Volodymyr Yakubovskyy (Partner), Denys Vergeles (Counsel).