Greetings from Brussels!
We are starting to see an increasing number of ancillary questions being tabled in relation to the administration of the COVID-19 vaccination. The speed with which the vaccines have been developed and approved is truly a tremendous testament to global cooperation and the promise of modern-day science. The road ahead may well be bumpy as it remains, a herculean task for European and other governments to vaccinate their populations and achieve acceptable levels of collective immunity.
While I have been following developments across Europe and further afield, I have naturally been keeping an eye on the news here in Belgium as it affects me and my family. While the first citizens have started to be vaccinated in Belgium, it appears to have been a moderate start; it is, however, important to understand that taken the federal nature of Belgium the responsibility of administration is decentralized. This aside, there are questions being asked around monitoring the vaccination program and the nature of the registration of vaccine recipients, as well as the possible consequences for those who will or chose not to be vaccinated.
In late December, a federal legal order on the registration and processing of data relating to COVID-19 vaccination was formally published by the Belgian government citing an emergency of "exceptional nature" giving rise to "problems concerning public health." The order specified that a central national database would be established to stock recipient identity datasets, namely national ID number (which is already the case when you take a COVID test), name, gender, birthdate, place of residence and, if applicable, the date of death. Additional tracking data around the actual administration of the vaccination will also be recorded. The goals of the registration are multiple: to organize the logistics, collect information on adverse effects, manage the schedules of citizens, and determine the vaccination rate of the population.
As you might expect, these new measures did not go unnoticed by the Belgian DPA. The regulatory authority had already given a "mixed" opinion concerning certain provisions associated with the collection and processing principles prior to its publication. In a recent interview, Alexandra Jaspar questioned whether the Belgian government was sufficiently safeguarding the personal data of citizens labeling the legal order as "vague" in construct and content, lacking clear precision and justification for data retention and processing. The fact that the data could be communicated to what appears to be other institutional third parties — without any defined limitations — poses a level of concern for the DPA as it considers that this constitutes a considerable interference with the right to privacy and data protection.
One might have expected a more provisioned approach to purpose limitation along the lines of pharmacovigilance or medical research. All COVID-19 vaccine doses administered in Belgium are now, as defined by law, recorded in the VACCINNET + database that has become the national registry. The platform, which was already being used by the Flemish authorities for existing vaccine programs and certifications, is now being used by the Walloon and the Brussels regional authorities. As Jaspar mentioned in her interview, there is some concern over how long the state intends to hold this sensitive data, which appears to last the duration of the citizen’s lifetime, without a clear indication as to how such data might be processed beyond the current crisis.
At this stage, the government insists it is not intending to impose the vaccine or to make it compulsory. In addition, it is confirmed that "vaccination certificates" will not be requested to access public places, events or services. While it is still very early days, a comprehensive understanding of how effective the vaccinations will be in combatting the virus and preventing transmission will be critical. This said, questions around disclosure and implications for the private sector continue to surface. Under Belgian labor law, employers do not have the right to ask their staff if they are vaccinated or not, though there are one or two very specific sectoral exceptions. In this regard, both an employee’s right to privacy and the right to the integrity of the person, remain protected.