New Ways of Working

Explore and keep track of key legal and compliance considerations for multinational employers as new ways of working become increasingly embedded as the pandemic begins to recede. Learn more about the response taken in specific countries or build your own report to compare approaches taken around the world.

Choose countries

 

Choose questions

Choose the questions you would like answering, or choose all for the full picture.

02. Outline the key data protection risks associated with remote working in your jurisdiction.

02. Outline the key data protection risks associated with remote working in your jurisdiction.

Flag / Icon

Argentina

  • at MBB Balado Bevilacqua
  • at MBB Balado Bevilacqua
  • at MBB Balado Bevilacqua

There is no specific statutory regulation on this matter related to employees under the home office framework. However, it is advisable to create a clear general policy on data protection or include in employment agreements provisions regarding data protection in order to clarify to employees the extent of their obligation. We recommend executing those documents in Spanish, due to the protective nature of local labour law; if there is a conflict with employees, a labour court is likely to dismiss all documents in a foreign language.

As a result, the Personal Data Protection Law (PDPL), Law No. 25,326, establishes the full protection of personal information recorded in personal files, registers, banks, or other technical means of data storage and processing. Therefore, employers must comply with the PDPL and take steps to ensure that this law applies throughout their organisation.

The main aspects of the PDPL are:

  1. The purpose of collecting employee data must be communicated to employees and written consent needs to be obtained.
  2. However, consent is not required if the data has been obtained from a public source; collected for the performance of the state’s duties; consists of lists limited to name, ID number, tax or social security identification, occupation, date of birth, domicile, and telephone number; or arises from a contractual relationship, either scientific or professional, of the data owner, and are necessary for its development or fulfilment.
  3. In addition, this Law establishes the employee’s right to access and modify any incorrect or false information. Furthermore, the collection of information related to an employee’s private life is permissible as long as the information collected complies with the following requirements: it is not used for discriminatory purposes; it does not violate the individual’s right to privacy; and it is reasonably used.
  4. When an employer requests personal data from an employee, they must be notified in advance and in an express and clear manner about: the purpose for which the data needs to be processed and who can use such data; the existence of the relevant data file or register, whether electronic or otherwise, and the identity and domicile of the responsible person; the compulsory or discretionary character of the information requested; the consequences of providing the data, of refusing to provide such data, or if it is inaccurate; and the data owner’s rights to data access, rectification, and suppression.
  5. Indeed, the processing of personal data requires express consent from the data owner, which must be accompanied by appropriate information, prominently and expressly explaining the nature of consent sought. This can be achieved by the employee signing a general consent form on entering employment. However, consent may be withdrawn by an employee.
  6. Various restrictions apply to the disclosure of personal data to third parties. This is generally only allowed if it is in the legitimate interests of the database owner (eg, the employer) and the data owner (eg, the employee) has consented. This consent can be revoked at any time by the data owner.
  7. The transfer of personal data to another country – which does not guarantee a proper level of data protection – is forbidden. Nevertheless, such prohibition is not applied when the individuals, whose personal information is intended to be transferred, give their express written consent.

All data regarding employees’ health is sensitive information, so the employer must get the express authorisation of the employee for any transfer of such date, and employers should stop or restrict the transfer to other companies or its employees that lack sufficient clearance to deal with health information, including covid-19 information.

Last updated on 13/07/2022

Flag / Icon

Australia

  • at People + Culture Strategies

In the context of an employer-controlled workplace, it is generally much easier to control and mitigate risks to an organisation’s confidential and sensitive information. There are physical protections intrinsic to the workplace (including by generally being off-limits to non-staff) and cyber-networks often have institutional protections in place, such as virtual private networks, firewalls, anti-virus software and secure IP addresses.

Other data protections that normally exist in an employer-controlled workplace include:

  • the use of private meeting rooms to conduct meetings and discussions involving sensitive and confidential information;
  • the secure storage of private, confidential and sensitive information (both hardcopy and in electronic form) on employer-controlled premises;
  • restrictions on the use of personal electronic devices in the workplace; and
  • the content of phone calls or video calls, and even information simply displayed in the workplace (including on computer screens), being kept private under the confines of the physical workplace.

However, the risks to data protection can be much harder to mitigate in the remote-working environment. These risks are heightened for several reasons, including that an employer has much less “visibility” over how employees deal with the employer’s (and any client’s) information in the home environment and much less when it comes to others who may be sharing that space. In this context, one obvious risk is the inadvertent and even deliberate sharing of sensitive information with one’s housemates, family members or guests.

Last updated on 21/09/2021

Flag / Icon

Austria

  • at Littler
  • at Littler
  • at Littler

The potential data protection risks associated with remote working are largely equivalent to those associated with working in a regular workplace, but are arguably even more prevalent.

A significant potential risk factor is the transfer of personal data if it is no longer securely stored on a company's servers. In addition, employers thereby transfer responsibility for the safekeeping and use of sensitive data to the worker. In doing so, employers have a significantly reduced ability to exert any influence. Nevertheless, companies are still generally regarded as being responsible for data protection within the meaning of the General Data Protection Regulation (GDPR), which creates a certain amount of friction.

It is also questionable whether a so-called privacy impact assessment must be carried out when working in a home office.

In principle, such an assessment must be conducted if data processing – especially when using new technologies – is likely to result in a high risk to the rights and freedoms of natural persons due to the nature, scope, circumstances, and purposes of the processing.

At present, it cannot be assumed that the threshold for the use of new technologies has already been exceeded in the context of remote working. In individual cases, however, it could amount to an "organisational solution" within the meaning of the GDPR, which also triggers the obligation of a privacy impact assessment by the data controller.

Insecure data connections that might not be constantly checked and maintained should also be considered. Another potential risk arises from it being easier for third parties to obtain access to sensitive data, whether it be persons in the same household or others at public places of work.

From a legal perspective, compliance with data security can also be adequately ensured for remote work, considering the GDPR and the corresponding national legal basis (Austrian Data Protection Act).

In home-office agreements, however, it is advisable to make further reference to data protection aspects. Here, companies should refer to the secure and data protection-compliant transport of sensitive hardware. Additionally, companies should take technical and organisational measures to ensure data security (eg, use of VPN, two-factor authentication with mobile phones, encryption of USB sticks, provision of a LAN network, requirements for secure storage of access data).

Last updated on 21/09/2021

Flag / Icon

Belgium

  • at Van Olmen & Wynant

Employees who process data at home could create a data leak when they lose the data or improperly dispose of it after it is no longer useful for the company. It is also more difficult to protect digital data in a non-professional setting and a private network might be more vulnerable to breaches.

Article 9.3 of CBA No. 149 states that company data used and processed by teleworkers for professional purposes must be protected. Employers should inform teleworkers of the company's rules on data protection and, in particular, the restrictions and penalties for the misuse of IT equipment and tools. Considering this, it is strongly recommended for companies to draft and implement an IT policy.

Also, employees’ personal data could be at risk since teleworking often means a direct insight into the personal life of the employee, using remote-monitoring devices. Such devices or software could register data that is not purely linked to their work and might possibly breach several GDPR principles, such as data minimisation.

Last updated on 21/09/2021

Flag / Icon

Brazil

  • at Pinheiro Neto
  • at Pinheiro Neto Advogados

In a remote-working environment, employees are more likely to use their personal devices and Wi-Fi and might share their workspace with family members or roommates. In addition, employees are more prone to mix personal and work-related data. These may lead not only to potential issues involving one’s privacy but also cyber threats and data leakage. Therefore, employers are strongly advised to implement strict policies on remote working, use of personal devices and data storage, as well as to provide the appropriate training.  

Last updated on 21/09/2021

Flag / Icon

France

  • at Proskauer Rose
  • at Proskauer Rose
  • at Proskauer Rose

Employers must ensure the protection of their company’s data but also of employees’ data.

According to article L. 1222-10 of the French labour code, the employer must inform the teleworking employee of the company's rules regarding data protection and any restrictions on the use of computer equipment or tools. Once informed, the employee must respect these rules.

The collective national agreement of 26 November 2020, provides more details in article 3.1.4. It is the employer's responsibility to take necessary measures to protect the personal data of a teleworking employee and the data of anyone else the employee processes during their activity, in compliance with the GDPR of 27 April 2016 and the rulings of the National Commission for Technology and Civil Liberties (the CNIL).

The CNIL said in its 12 November 2020 Q&A on teleworking that employers are responsible for the security of their company's personal data, including when they are stored on terminals over which they do not have physical or legal control (eg, employee's personal computer) but whose use they have authorised to access the company's IT resources.

The National Agreement of 26 November 2020 recommends three practices:

  • the establishment of minimum instructions to be respected in teleworking, and the communication of this document to all employees;
  • providing employees with a list of communication and collaborative work tools appropriate for teleworking, which guarantee the confidentiality of discussions and shared data; and
  • the possibility of setting up protocols that guarantee confidentiality and authentication of the recipient server for all communications.
Last updated on 21/09/2021

Flag / Icon

Germany

  • at CMS Hasche Sigle

As in other countries in Europe, the provisions of the EU General Data Protection Regulation (GDPR) and its German implementation in the shape of the German Federal Data Protection Act (BDSG) must be observed. Against this background, special measures must be taken to protect personal data in connection with remote work. This especially concerns third-party access to systems when computers and other portable devices are used in the home or on the go. To this end, employers often issue guidelines of standards with which employees must comply.

Also, remote working poses many data protection risks in terms of IT security and confidentiality. For example, cybercrime exploits the vulnerabilities inherent to remote working to infiltrate IT systems and steal confidential data, for instance through phishing attacks. At the same time, the confidentiality of a phone call, for example, is harder to protect while working in a co-working space, on a train or at home than in a typical workspace. Therefore, remote working may require different security measures and employers should inform their employees accordingly. In this regard, the European Union Agency for Cybersecurity last year published cybersecurity tips for remote working, both for employees (connecting to the internet via secure wi-fi networks, fully updating antivirus software and using a secure connection) and for employers (providing initial and regular feedback to employees on how to react if problems arise and restricting access to sensitive systems, etc.).

Last updated on 21/09/2021

Flag / Icon

Greece

  • at Kyriakides Georgopoulos Law Firm
  • at Kyriakides Georgopoulos Law Firm
  • at Kyriakides Georgopoulos Law Firm

Although necessitated by the circumstances, the transition of employees from corporate networks to largely unmonitored and vulnerable private networks outside the reach of perimeter-based security tools finds most employers unprepared and, thus, exposed to greater cyber threats and personal data breaches compared to on-site work. Employers are urged to take into consideration the increased risks a remote working environment poses to their data, systems, and networks and to invest heavily in IT security, while employees are encouraged to carefully follow all IT security guidelines, stay alert to security incidents, and be vigilant with phishing attacks. Within this framework, the Hellenic Data Protection Authority (HDPA) issued “Guidelines for implementing safety measures in the context of teleworking” on 15 April 2020, including appropriate safety measures concerning network access, the use of email or messaging applications, the use of terminal or storage media and how teleconferencing takes place to mitigate data protection risks associated with remote working.

On the other hand, many of these measures may result in more extensive collection and processing (recording, use, disclosure, etc) of employees’ personal data, including monitoring procedures. The key issue for most employers amid these circumstances is to find the right balance between protecting their IT systems and data, on the one hand, and safeguarding the data protection and privacy rights of their employees while working from home on the other.

Last updated on 14/07/2022

Flag / Icon

Hong Kong

  • at Lewis Silkin
  • at Lewis Silkin
  • at Lewis Silkin

As a result of the covid-19 pandemic, many companies in Hong Kong encouraged their staff to work remotely. This meant taking documents home from the office and using video conferencing, cloud computing and intranet platforms, where those software solutions were available, and also using personal devices to work more. As a result, confidentiality and security of data became more at risk.

Due to space constraints in Hong Kong, it is not practicable to expect employees to work or conduct confidential discussions in an isolated area away from others. Often employees are sharing workspace with family members and may also share a laptop or PC with them. If working from home is not an option for an employee, he or she may be working from cafes or public spaces. As a result, non-employees may overhear confidential discussions or see confidential documents. If these conversations and documents contain personal data (of employees, customers, clients, suppliers or other third parties), then the potential leakage of this data may constitute a breach of the Personal Data (Privacy) Ordinance (PDPO). There may also be contractual confidentiality breaches.

A typical home network is unlikely to have the same stringent security protections in place that an office network does. Attackers have seen an opportunity to steal user credentials from personal devices, which are now being used for work and likely do not have the same security protections as corporate devices. Using unsecured networks and devices may lead to data leakage or theft, which would be in breach of the PDPO.

If personal data is being processed by new third parties as a result of having to implement remote-working arrangements, an employer will need to notify its employees of this. This can be done by issuing employees with a revised or new Personal Information Collection Statement (PICS) setting out the change. The PDPO specifies that a data user, when collecting personal data directly from a data subject, must take all reasonably practicable steps to ensure that the data subject is informed of the intended use of their data and who will be handling such data. A PICS is therefore used to comply with these notification requirements and is a statement regarding a data user’s privacy policies and practices in relation to the personal data it handles. 

Last updated on 11/10/2021

Flag / Icon

India

  • at Nishith Desai
  • at Nishith Desai

An individual’s sensitive personal data or information (SPDI), which includes information on passwords; financial information such as a bank account, credit card or debit card or other payment instrument details; physical, physiological and mental health conditions; sexual orientation; medical records and history; or biometric information or other details related to such information provided to a body corporate for the provision of services or such information received for processing under a lawful contract or otherwise and its storage are protected under Indian data privacy rules. There are certain mandatory obligations for collectors of such SPDI in electronic forms, including obtaining the consent of the data provider, formulating, publishing, and complying with a privacy policy for treatment of such data and adopting certain standards of security practices. However, these obligations are not specific to remote-working arrangements; they govern the terms of the data being collected by the employer.

With employees working remotely, employers are facing a challenge with protecting the security of client data and other confidential information, which may be duplicated or disclosed to third parties by employees working remotely on unsecured personal devices.

Last updated on 08/07/2022

Flag / Icon
Ireland

Ireland

  • at Littler

The Data Protection Commissioner has issued guidance on the protection of personal data when working remotely (see here).

The key risks identified relate to protecting and preventing access to laptops, USBs, phones, tablets and other devices; emails; using unsecured networks to transmit data or to access company networks; and ensuring the security and confidentiality of hard-copy documents.

Employers should update data protection policies to take account of remote working and should also consider any data protection issues that may arise from an employee moving to work outside of Ireland.

Last updated on 21/09/2021

Flag / Icon

Italy

  • at Toffoletto De Luca Tamajo

Data security requirements applicable to all employees working at the company premises continue to apply to employees working remotely. In addition, the National Protocol on Smart Working specifies that the employer should promote the adoption of a policy also concerning data breach management and the implementation of proper security measures.

The main risks are linked to the transmission of company data outside the company premises, in places not necessarily identified.

Last updated on 14/07/2022

Flag / Icon

Mexico

  • at Marván, González Graf y González Larrazolo
  • at Marván, González Graf y González Larrazolo
  • at Marván, González Graf y González Larrazolo

Security controls

The common risks associated with remote working derive from the absence of security controls over equipment, software, and data, and not having any policies for remote-working schemes, leading to:

  • employees storing sensitive information in their local machines, without the control of employers over such tools;
  • compromised security controls; and
  • Wi-Fi networks and routers in homes are more easily compromised, increasing the risk of exposure.

Companies have the right to install security controls for the equipment and tools to be used by teleworkers to avoid any leaks of information and limit their use, because this hardware is the property of the employer. The common practice in Mexico is to implement a security data policy and a work tools policy.

Additionally, even though there are no specific legal provisions concerning the plausible risks associated with data protection in remote-working schemes, the Federal Law for the Protection of Personal Data in Possession of Private Individuals or Entities, the Federal Law for the Protection of Industrial Property, and their regulations and guidelines, establish provisions for the protection of rights concerning personal data, confidential information, and trade secrets, which also apply to remote-working schemes; therefore, all employees working remotely must comply with these laws and regulations. To prevent and avoid the disclosure of this information, the prevailing practice is to enter into agreements with employees establishing specific obligations in connection to confidentiality and data privacy. Such obligations usually refer to the policies and processes established by employers to ensure information security, and the corresponding penalties in the event of any breach.

Last updated on 21/09/2021

Flag / Icon

Netherlands

  • at Rutgers & Posch
  • at Rutgers & Posch

Employees who process data at home could create a data leak if they lose the data or improperly dispose of it after it is no longer useful for the company or their work. It is also more difficult to protect digital data in a non-professional setting and a private network might be more vulnerable to breaches. If a data breach does occur, the employee should, in principle, report this to the Dutch Data Protection Authority within 72 hours.

Employers are advised to update data protection policies to take into account remote working, and should also consider any data protection issues that may arise from an employee moving to work outside of The Netherlands.

Last updated on 08/03/2022

Flag / Icon

Poland

  • at Bird & Bird
  • at Bird & Bird

Telework or remote work should be organised in a way that ensures the protection of confidential information and other legally protected secrets, including trade secrets or personal data, as well as information whose disclosure could harm the employer.

Certain risks are present when employees perform work remotely:

  • they may use their own private equipment;
  • they may use company equipment for private purposes;
  • they may use an unsecured internet connection, including without a VPN (Virtual private network) connection; and
  • they may work from various unregulated locations, including coworking areas. 

Therefore, it is recommended that employers develop instructions regarding data protection and information safety (usually as part of their teleworking policy, which must be introduced with the participation of the employees' representatives) and ensure that these are introduced and applied effectively in the day-to-day work of remote workers.

Last updated on 21/03/2022

Flag / Icon

Portugal

  • at Cuatrecasas
  • at Cuatrecasas

Until the pandemic, teleworking was used rather infrequently, and most Portuguese employers were not prepared – namely in terms of technology and data storage – to suddenly have their workforce almost entirely and permanently working from home or remotely.

For those reasons, teleworking mainly raised – and continues to raise – concerns regarding the employer’s capacity to ensure that information is protected and that it stays confidential despite being remotely accessed and processed. Remote working enhances security vulnerabilities, which can lead to data breaches.

We would also like to highlight the use of technological solutions that, on one hand, allow employers to exercise their powers of management and control over work performance, but that, on the other, do not violate the general rule prohibiting the use of remote surveillance to control employees' professional performances, or that do not cause excessive restrictions on employees’ private lives.

Last updated on 13/07/2022

Flag / Icon

Qatar

  • at Clyde & Co
  • at Clyde & Co

Data loss, cyber security, privacy and maintaining confidentiality are the key data risks associated with working remotely.  Taking precautions against importing viruses, compromising system security, and maintaining confidentiality while working remotely are key considerations for employers. Internal policies and procedures should be put in place to ensure employees are aware of their obligations, and operating through virtual private networks could minimise potential risks. 

Last updated on 08/11/2021

Flag / Icon

Saudi Arabia

  • at Clyde & Co
  • at Clyde & Co

Data loss, cyber security, privacy and maintaining confidentiality are the key data risks associated with working remotely in most jurisdictions. These risks are heightened in Saudi Arabia as there are no specific data protection laws in place. Taking precautions against importing viruses, compromising system security, and maintaining confidentiality while working remotely are key considerations for employers. Internal policies and procedures should be put in place to ensure employees are aware of their obligations, and operating through virtual private networks could minimise potential risks.

Last updated on 29/11/2021

Flag / Icon

Spain

  • at Cuatrecasas
  • at Cuatrecasas

Apart from the general personal data protection issues to be considered, there are two significant risks.

First, under article 17 of Law 10/2021, any digital program or software to monitor remote workers must grant employees privacy and protection of personal data according to the Organic Law on Personal Data Protection and Digital Rights Guarantees. In particular:

  • an employer’s access to the digital technology provided to the remote worker must be limited to checking compliance with labour obligations and to guaranteeing the integrity of the devices;
  • employers must establish the terms of use of the digital devices, and the workers’ representatives must participate in drafting them;
  • employers must inform remote workers about the terms of use of the digital devices; and
  • regardless of the terms of use, an employer’s access to the digital means must be necessary for the employer to achieve a legal purpose, appropriate for such legal purpose and proportional to achieve such legal purpose. Based on this, the employer should implement the least invasive way of monitoring remote workers’ activity to achieve the legal purpose the employer is pursuing.

Any measure to monitor employees’ activity should meet these requirements; otherwise, an employer’s decision arising from such monitoring could be deemed unfair, and there could be a breach of the employee’s privacy, which could lead to a damages claim and an administrative fine.

Second, employers must comply with the principles of personal data processing under article 5 of the GDPR, especially purpose limitation and data minimisation, which means that the personal data the employer can process should be only what is the minimum necessary data for the performance of the labour contract or compliance with their legal obligations. Therefore, employers are not entitled to, for instance, force remote workers to turn on their cameras during working hours.

Third, despite remote working, employers must comply with health and safety obligations, which could lead to the employer or its health and safety services provider visiting an employee’s home to evaluate its risks. In that case, employers should issue a report justifying the visit and provide it to the remote worker and the health and safety workers’ representatives in advance. Additionally, to access any remote worker’s home, the employer must first obtain their consent.

If they do not give their consent, measures on health and safety should be based only on the information provided by the remote workers.

Last updated on 21/09/2021

Flag / Icon

Sweden

  • at DLA Piper
  • at DLA Piper
  • at DLA Piper

Pursuant to the GDPR, personal data should, inter alia, be processed in a manner that ensures appropriate security and confidentiality for the processing of that data, including by preventing unauthorised access to or use of personal data. For natural reasons, there may be additional challenges associated with this obligation when employees are working remotely, including an increased risk of personal data breaches when employees are working from home. The Swedish Authority for Privacy Protection mentions in its Privacy Protection Report of 2020 the increase in employees working from home as a result of the covid-19 pandemic, and the increased use of cloud service providers. The Authority highlights that data in cloud services is often transferred to countries outside the EU/EEA, and especially to the US. As a result of the Schrems II ruling in 2020, the use of, eg, cloud service providers that transfer data to  such jurisdictions (eg, in connection with IT maintenance) is problematic and may need to be addressed in relation to remote working.   

In light of the above, it is important as an employer to consider what measures are necessary in terms of IT security when working from home (eg, instructions to employees).

Last updated on 21/09/2021

Flag / Icon

Switzerland

  • at Lenz & Staehelin

Employers are required to respect the general Swiss data protection principles and rules. In particular, the Swiss Code of Obligations (SCO) states that the Federal Act on Data Protection (FADP) applies to the handling of employer personal data. The term "personal data" is defined as any information relating to an identified or identifiable person (individuals and companies).

Employers must ensure the security of the data they process. They must take appropriate organisational and technical measures to protect personal data against unauthorised processing or access, such as accidental or unauthorised destruction, loss, technical errors, falsification, theft, unlawful use, alteration, copying or any other undue processing. Moreover, employers also must control access and operations undertaken by employees.

One particularity of remote working is that employees' workstation and business data are located off sites. Meaning that third parties potentially could access this data.

To prevent data protection breaches, employers must institute appropriate technical and organisational measures and raise employee's awareness of data protection risks. These measures may include securing information systems, setting up authorisations and limiting access to concerned employees, and using a VPN. In addition, employees also should be made aware of the risks and procedures through in-house training and user manuals for the IT and security systems.

Last updated on 30/09/2021

Flag / Icon

Turkey

  • at Gün + Partners
  • at Gün + Partners
  • at Gün + Partners

The key data protection risks associated with remote working are data security and the processing of additional personal data while working remotely.

Under article 12 of the Personal Data Protection Law numbered 6698 (the DPL), data controllers must take all administrative and technical measures necessary to prevent unlawful processing of personal data, to prevent unlawful access to personal data and to ensure the security of personal data.

The Regulation also stipulates that the employer must inform remote workers about workplace rules and applicable legislation concerning the protection and transfer of data related to the workplace and their assignments (which may include personal data). The Regulation also emphasises that employers must take all necessary measures for the security of data. Per the Regulation, in the remote-working agreement, the employer must determine the definition and scope of data that needs to be protected.

There is no guidance from the Turkish Data Protection Authority (DPA) concerning measures to be taken specifically for remote working. Its general Guideline for Personal Data Security (Data Security Guideline) and the principal decision of the Turkish Data Protection Board concerning measures required to be taken by data controllers for processing sensitive personal data (Board Resolution for Sensitive Personal Data Security) should be considered by employers. The measures listed in the Data Security Guideline and the Board Resolution for Sensitive Personal Data Security are not exhaustive. Employers must consider all necessary measures for cyber security. International guidelines and IT sector developments should also be considered.

Employers who have failed to take appropriate measures to protect the unlawful processing of or access to personal data may be required to pay an administrative fine amounting to between 40,179 Turkish lira and 2,678,859[1] Turkish lira. Furthermore, additional technical measures taken for remote-working opportunities must also be communicated to the Data Controllers’ Registry if the employer is required to register data-processing activities (eg, employers located in Turkey that have more than 50 employees or have a balance sheet of more than 25 million lira fall under this obligation). Otherwise, although it may not be an imminent risk, an administrative sanction amounting to between 53,572 lira and 2,678,859 lira may be applied against the employer.

Lastly, if having remote-working employees requires an employer to process additional employee data, then the employer must inform their employees accordingly by providing an appropriate privacy notice under the DPL. Otherwise, they may be fined between 13,391 lira and 267,886 lira. The employer should determine what legal ground should be applied to the data processing due to remote working. If the applicable legal ground is consent but consent is not obtained lawfully from employees, then the employer may face an administrative fine of between 40,179 lira and 2,678,859 lira for unlawful processing. 


[1] All administrative fine amounts mentioned in this questionnaire will be updated for each year based on a re-evaluation determined annually.

Last updated on 09/02/2022

Flag / Icon

UAE

  • at Clyde & Co
  • at Clyde & Co

Data loss, cyber security, privacy and maintaining confidentiality are the key data risks associated with working remotely in most jurisdictions. Taking precautions against importing viruses, compromising system security and maintaining confidentiality while working remotely are key considerations for employers. Internal policies and procedures should be put in place to ensure employees are aware of their obligations, and operating through virtual private networks could minimise potential risks. 

Last updated on 15/03/2022

Flag / Icon

United Kingdom

  • at Littler

The key data protection risk associated with home working is data security.

In response to this, the UK’s data protection regulator – the Information Commissioner’s Office (ICO) – has issued guidance on the protection of personal data when working from home, using bring-your-own-device (BYOD) and working remotely (see: here).

The specific issues addressed include implementing appropriate workplace policies, IT security (including cloud-based storage security), the risk of theft and confidentiality.

Employers should update data protection policies to take account of remote working, in light of the ICO’s recommendations, and should also consider any data protection issues that may arise from an employee moving to work outside of the UK.

Last updated on 21/09/2021

Flag / Icon

United States

  • at Littler
  • at Littler
  • at Littler

Data privacy rules vary from state to state. Remote work, in particular, raises issues where employers have less control over the working environment and employees are potentially accessing sensitive information in their home that they share with others.  Employers should ensure that employees working remotely can demonstrate that their location provides sufficient privacy, security, and safety to secure the confidentiality of the employee’s work, company information and materials.  Additionally, health-related data must be protected and employers should be required to protect trade secrets and other confidential data. Employers must also maintain reasonable security measures to protect sensitive personally identifying information. 

Up-to-date information on the USA’s response to the pandemic, including State-level news and developments, can be found at Littler’s covid hub here.

Last updated on 21/09/2021

10. Are there some workplaces or specific industries or sectors in which the government has required that employers make access to the workplace conditional on individuals having received a Covid-19 vaccination?

10. Are there some workplaces or specific industries or sectors in which the government has required that employers make access to the workplace conditional on individuals having received a Covid-19 vaccination?

Flag / Icon

Argentina

  • at MBB Balado Bevilacqua
  • at MBB Balado Bevilacqua
  • at MBB Balado Bevilacqua

No, there are not.

Last updated on 13/07/2022

Flag / Icon

Australia

  • at People + Culture Strategies

Yes, operators of health, aged and disability care facilities are subject to public health orders which make vaccination against covid-19 a requirement of entry.

Whether an employer would be justified in terminating employment based on an employee’s refusal to be vaccinated will depend on the particular circumstances, and an employer would be required to follow a proper process before making any such decision (including allowing the employee the opportunity to be heard before a decision is made that might affect their employment.

We note the Fair Work Commission, Australia’s employment relations tribunal, has upheld the termination of an aged-care receptionist who refused an influenza vaccination. The decision to terminate the employment was made in the context of a public health order that no one was allowed to enter the facility operated by the employer without an up-to-date influenza vaccination to ensure the safety of its clients. We consider this decision serves as a precedent for those employers who are subject to public health orders concerning covid-19 and faced with employees refusing to receive the covid-19 vaccination.

Last updated on 21/09/2021

Flag / Icon

Austria

  • at Littler
  • at Littler
  • at Littler

In principle, there is already the legal possibility to impose vaccinations for certain professions in the health sector. However, this option has not been exercised yet. There is no legal basis for compulsory vaccination in most sectors.

Workers may choose from three options (3-G rule) when they want to enter their employer’s premises. As of now, there is no regulation stipulating an entry requirement to the workplace for vaccinated workers. However, employers may only tighten access restrictions in substantiated cases. Individuals who are not employees may be subject to stricter conditions (proof of vaccination) as a result of the employer’s right of domicile.

Last updated on 31/01/2022

Flag / Icon

Belgium

  • at Van Olmen & Wynant

Until now, there have been no such requirements. But as stated above, this will be the case in the healthcare sector, starting from 1 April 2022.

Last updated on 01/12/2021

Flag / Icon

Brazil

  • at Pinheiro Neto
  • at Pinheiro Neto Advogados

On a state level, some specific sectors considered “essential” (meaning that they continued to operate normally – or were hardly affected – especially at the beginning of the pandemic) had their vaccination schedules prioritised, by the state government, over the rest of the population (eg, health professionals, public transportation drivers and teachers). In spite of that, proof of actual vaccination was not a requirement for individuals in these sectors to keep working during the pandemic.

Last updated on 21/09/2021

Flag / Icon

France

  • at Proskauer Rose
  • at Proskauer Rose
  • at Proskauer Rose

Please see above (questions 8 and 9) regarding the workplaces and specific industries concerned by making the access to the workplace conditional on individuals having received a Covid-19 vaccination.

Last updated on 21/09/2021

Flag / Icon

Germany

  • at CMS Hasche Sigle

Yes, in the healthcare and nursing sector.

Last updated on 14/04/2022

Flag / Icon

Greece

  • at Kyriakides Georgopoulos Law Firm
  • at Kyriakides Georgopoulos Law Firm
  • at Kyriakides Georgopoulos Law Firm

Vaccination is mandatory for specific categories of employees (see question 8) as well as all employees working at public and private hospitals. Employees of the health and care sector cannot duly provide their services if they are not vaccinated and their employer is released from their obligation to pay salaries.

Last updated on 14/07/2022

Flag / Icon

Hong Kong

  • at Lewis Silkin
  • at Lewis Silkin
  • at Lewis Silkin

Yes. The government has made covid-19 vaccination compulsory for civil servants, healthcare workers, care home staff and school teachers; in particular, all civil servants must receive two covid-19 vaccine doses by 1 April 2022, or they will be banned from government premises (unless they hold a medical exemption).

Further, with the introduction of the vaccine pass rules (please refer to our response to Question 8 above to further details), employees who are unvaccinated would be banned from entering their workplace if their workplace is subject to vaccine pass rules. (e.g. shopping malls, restaurants, department stores, supermarkets, and hair salons).

Last updated on 06/04/2022

Flag / Icon

India

  • at Nishith Desai
  • at Nishith Desai

The Chief Commissioner of the Bangalore municipal authority (BBMP) issued a circular on 26 August 2021 stating that employers of commercial establishments, industries, hotels and restaurants, and other offices within BBMP jurisdiction must ensure their employees are vaccinated[1] and also provide regular testing. The Karnataka state government (Bangalore) also issued direction for labour authorities to ensure employees in industries or factories including IT employees are vaccinated with two doses of covid-19 vaccine, with a direction for labour authorities to check the vaccination status of employees of such establishments.[2] Currently, the legal validity of such government circulars in view of the latest Supreme Court judgment in the matter Jacob Puliyel v. Union of India is debatable and there is a low likelihood of such circulars being strictly enforced by government authorities.


[1] https://drive.google.com/file/d/19_1A7CtE2Qdy7Fbeihrsh9PHpEAHy8RE/view?usp=sharing

[2] https://ksdma.karnataka.gov.in/storage/pdf-files/CAB%20and%20Vaccination%20Industries%20English%20order%20RD%20158%20TNR%202020%20(3)%20dated%2005-01-2022.pdf

Last updated on 08/07/2022

Flag / Icon
Ireland

Ireland

  • at Littler

Not yet. At present, indoor dining is confined to individuals who can provide proof that they are fully vaccinated or that they have recovered from COVID-19 within the previous six months. However, this restriction only relates to customers rather than staff, and so there is no obligation on restaurant or pub staff to be fully vaccinated to gain access to their workplace.

Last updated on 21/09/2021

Flag / Icon

Italy

  • at Toffoletto De Luca Tamajo

Yes. Under the provisions of article 4 of Legislative Decree No. 44/2021, vaccination is compulsory only for healthcare, social health, and medical workers (until 31 December 2022) Failure to fulfil the above-mentioned vaccination obligation leads to the suspension of the employee from their work and wages, although they remain entitled to keep their job.

Last updated on 14/07/2022

Flag / Icon

Mexico

  • at Marván, González Graf y González Larrazolo
  • at Marván, González Graf y González Larrazolo
  • at Marván, González Graf y González Larrazolo

No, the government has released a covid-19 FAQ where they clarify that vaccination is not mandatory.

Last updated on 21/09/2021

Flag / Icon

Netherlands

  • at Rutgers & Posch
  • at Rutgers & Posch

This is not the case, but this might change soon. There are several legislative proposals in this regard expected to be discussed by the House of Representatives or which are currently on-hold in the light of the current covid-19 situation.

Last updated on 08/03/2022

Flag / Icon

Poland

  • at Bird & Bird
  • at Bird & Bird

From 1 March 2022, all medical workers will have to be vaccinated. There are no requirements for any other industries or sectors at this stage.

Last updated on 21/03/2022

Flag / Icon

Portugal

  • at Cuatrecasas
  • at Cuatrecasas

No, there are not.

Last updated on 13/07/2022

Flag / Icon

Qatar

  • at Clyde & Co
  • at Clyde & Co

Not currently, but this may become a requirement in the future.

Last updated on 08/11/2021

Flag / Icon

Saudi Arabia

  • at Clyde & Co
  • at Clyde & Co

See question 8.

Last updated on 29/11/2021

Flag / Icon

Spain

  • at Cuatrecasas
  • at Cuatrecasas

No, there are not.

Last updated on 21/09/2021

Flag / Icon

Sweden

  • at DLA Piper
  • at DLA Piper
  • at DLA Piper

There are no such requirements for any sector. There are currently no recommendations from relevant Swedish authorities that employers should treat unvaccinated employees differently to vaccinated employees.

Last updated on 21/09/2021

Flag / Icon

Switzerland

  • at Lenz & Staehelin

No. However, with cases of covid-19 on the rise, the question of whether people working in specific fields, such as the health sector, should be required to be vaccinated is hotly debated.

Last updated on 30/09/2021

Flag / Icon

Turkey

  • at Gün + Partners
  • at Gün + Partners
  • at Gün + Partners

No. As mentioned above, the Ministry of Health has stated that the covid-19 vaccination is available voluntarily. Also, according to the Ministry of Labour and Social Security’s general letter, mandatory PCR testing was regulated as a voluntary mechanism at the employer’s discretion, considering different working methods in all workplaces.

On the other hand, the Ministry of Internal Affairs issued a separate circular, which regulated mandatory PCR testing before attending collective activities such as a concert, cinema or theatre; or undergoing intercity travel by plane, bus, train or other means of public transportation, except for private vehicles. Before, it could be possible to say that, in addition to the attendees, employees who facilitate these activities could also be requested to provide a negative PCR test result if they are unvaccinated. Likewise, the Ministry of Education introduced a similar practice at schools. All unvaccinated school staff encountering students face-to-face had to undergo mandatory PCR testing twice a week.

However, as of 14 January, no mandatory PCR testing is deemed required for the following individuals even if they are unvaccinated (or their vaccination processes are not complete) or are not recovered from covid-19 within the past 180 days:

  • those undergoing intercity travel by plane, bus, train or other means of public transportation;
  • those who attend collective activities such as a concert, cinema or theatre;
  • all school staff working at Ministry of Education schools (teachers, service drivers, etc);
  • employees of public and private workplaces; and
  • those attending student camps organised by public or private institutions;

However, mandatory PCR testing is still required for the following individuals:

  • employees of nursing homes, aged-care facilities, prisons or penitentiaries who are unvaccinated or not recovered from covid-19 within the last 180 days, or their vaccination process is not complete;
  • prisoners and convicts at prisons or penitentiaries;
  • those traveling abroad (subject to the rules of the travelled country); and
  • those undergoing intercity travel by plane who are unvaccinated or not recovered from covid-19 within the past 180 days, or their vaccination process is not complete.

With that in mind, all these announcements were qualified as recommendations in terms of their binding power, and therefore several Turkish scholars take the view that employers, especially by gathering Occupational Health and Safety Councils (if they exist), can still decide to mandate PCR testing to ensure occupational health and safety at workplaces by complying with the personal data protection rules.

Last updated on 09/02/2022

Flag / Icon

UAE

  • at Clyde & Co
  • at Clyde & Co

The Abu Dhabi Emergency, Crisis and Disasters Committee has announced that, from 20 August 2021, entry to many public spaces in the emirate will only be permitted to those who have been vaccinated and those exempt from having the vaccine. All Abu Dhabi government employees must also be vaccinated and have received a covid-19 booster shot to enter the workplace from 10 January 2022. Regular PCR testing is also mandatory within government offices.

Last updated on 15/03/2022

Flag / Icon

United Kingdom

  • at Littler

Yes.

The UK Department of Health and Social Care recently amended applicable regulations (the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014) to make it mandatory for all care home workers and other visiting professionals to be fully vaccinated against Covid-19 unless they have an exemption or there is an emergency. The changes took effect from 11 November 2021. Proposals to extend this to all health and social care workers with face-to-face contact with patients and service users are currently being discussed by the UK government. If passed in their current form this expanded vaccine requirement would be effective from 1 April 2022.

Last updated on 13/01/2022

Flag / Icon

United States

  • at Littler
  • at Littler
  • at Littler

Yes, this includes the healthcare industry, as well as some federal and municipal agencies.

Up-to-date information on the USA’s response to the pandemic, including State-level news and developments, can be found at Littler’s covid hub here.

Last updated on 21/09/2021