At the end of August 2021, the Draft Act to amend the act on special arrangements related to the prevention, counteracting and combatting of COVID-19, other infectious diseases and crisis situations caused by them and certain other acts was added to the list of legislative and policy works of the Council of Ministers. The new provisions will allow entrepreneurs to access information on whether their employees or clients have been vaccinated or have recovered from COVID-19.

Below, we present the most important elements of the amending Bill and discuss the new entitlements which will soon be granted to Polish entrepreneurs. The Draft Act has not yet been published, as the Council of Ministers is expected to adopt its text during Q3 of this year.

The Ministry of Health is responsible for preparing the Draft Act. Further information on its provisions can be found at the site linked here. Gazeta Wyborcza has also written about the Draft Act (an article, with our experts’ comments is available online at the site linked here).


Over the last several months, Polish entrepreneurs have faced the COVID-19 epidemic, which required that they take extraordinary measures to protect their employees and clients. Until now, entrepreneurs have been severely limited in their ability to take actions aimed at verifying their employees’ and clients’ health status. This situation is likely to change shortly.

The Polish government is currently working on draft provisions allowing entrepreneurs to collect information on their employees’ vaccination status regarding COVID-19. Employers will also be entitled to verify whether their employees have previously recovered from COVID-19 or that they are not infected with COVID-19.

Significantly, the new provisions allow employers to apply extraordinary measures with respect to their employees, who shall provide information on:

  • not having been vaccinated against COVID-19,
  • not recovering from a COVID-19 infection, or
  • having a valid positive result from a COVID-19 diagnostic test.

In such cases, employers will be entitled to take a decision on whether to:

  • delegate the employee to work from a location other than their workplace,
  • delegate the employee to undertake a different type of work for remuneration commensurate with the different type of work, or
  • direct the employee to take unpaid leave.

Additionally, entrepreneurs will be encouraged to verify whether their clients have been vaccinated, recovered from the illness, and/or hold a current negative COVID-19 test result. According to the published proposal, the restrictions imposed on entrepreneurs in connection with the pandemic (e.g., the prohibition on dining-in or staying at a hotel, limits on the number of persons in cinemas, etc.) will no longer apply if the services are provided exclusively to clients who have been vaccinated, recovered or holding a valid test result showing that they are not infected with COVID-19.



According to the proposal, the new provisions are intended to make it easier for employers to combat the COVID-19 epidemic and limit the risk of an infection spreading at a work establishment. However, the proposals in the Draft Act have raised many doubts. Changes in the workplace’s location or the type of work performed, or a direction to take unpaid leave constitute a significant interference in the employer’s terms of employment. Importantly, the proposals made in the Draft Act do not specify the rules under which employers may exercise their new entitlements. In particular, it is not clear for how long an employer can change the employee’s workplace location and type of work performed. The entitlement to direct an employee to take unpaid leave also raises many doubts. In this case, the proposals made in the Draft Act fail to specify any time-limits on such  an order, as well as failing to state whether the unpaid leave will count towards the employee’s term of employment.

Regadless of the final form of these new provisions, employers who decide to exercise their new entitlements will remain subject to the duty to treat their employees equally. The selection of measures interfering in an employee’s terms of employment should always be made on the basis of objective criteria and may not serve as a means to discriminate or harass employees. A change in the location of an employee’s workplace or the type of work they perform, or an order for them to take unpaid leave, should always be aimed at protecting the employer’s other employees and client from COVID-19.


We view the newly proposed provisions positively in respect of personal data protection rules. Information on whether a person has recovered from COVID-19 and been vaccinated is, so-called, sensitive data. According to the General Data Protection Regulation (GDPR), it is permissible to process such information, however, the person who such data concerns must grant their consent to such processing. It is generally believed that obtaining such consent from employees is particularly difficult due to the ever present concern that an employee is not fully free to grant it, as they are the weaker party in the relationship with their employer. In light of the above, the adoption of provisions expressly authorizing employers to verify such information will serve as the basis to process an employee’s sensitive data in accordance with Article 9(2) GDPR.

With regard to data concerning the health of an entrepreneur’s client, it is possible to consider that the GDPR does not apply to them in this case. According to Article 2 GDPR, the provisions of the GDPR only apply to the processing of personal data by automated means or in a, so-called, filing system. Thus, it is possible to state that if an entrepreneur does not create a database of vaccinated individuals nor receives such information in electronic form then their duties under the GDPR are not triggered. We believe that this already allows for the limitation of access to services or entry to a business’s premises only to those persons who present a vaccination certificate – insofar as this information is not recorded by any means. However, in the absence of any specific provisions which allow one to limit access to the premises, entrepreneurs – both as employers and service providers – open themselves up to the risk of being accused of discriminating against unvaccinated individuals.


The proposal does not provide details on the means by which employee or client health information is to be verified. According to the published proposal, entrepreneurs may make use of the mobile application available from the e-Health Center (Centrum e-Zdrowia). Information on the health of employees and clients may also be verified on the basis of certificates including an image of the holder’s face, which will be issued by medical professionals.

The proposals in the Draft Act do not specify whether vaccinated individuals will be able to use, so-called, COVID passports previously issued to them. It seems that the most practical solution is to allow entrepreneurs to verify whether a person has been vaccinated by means of already existing certificates. Even now, all vaccinated individuals can present a certificate downloaded from the e-Pacjent portal or information on their vaccination status through the mObywatel application. Therefore, additional solutions, i.e., a dedicated mobile application, or certificates including a persons face issued by a doctor or nurse, may be useful, but should be treated solely as an additional means of verifying the health status of employees or client’s.


Verifying data on whether employees or clients are vaccinated should not be seen as the only action which must be taken by Polish entrepreneurs in relation to the COVID-19 pandemic. Employers should continue to follow all orders and guidance issued by national authorities in order to ensure that employees have safe and hygienic working conditions. It must remembered that vaccination or recovery does not protect all employees from the risk of infection with COVID-19. Thus, entrepreneurs should treat the fact that they will receive access to employee and client health data as an additional means of combatting COVID-19, and not the lifting of other restrictions.