Employee Vaccine Mandates and Vaccination Status Data Privacy in Cambodia

In response to the COVID-19 pandemic, the Cambodian government has issued a range of policies and measures, including movement restrictions, necessary quarantines, prohibitions on large gatherings, and selective lockdowns. Simultaneously, business operators have been developing and implementing business continuity plans to manage their way through the pandemic and beyond.

With the wide availability of vaccines in Cambodia, some employers are considering whether to mandate workers to get vaccinated against the coronavirus, prompting the question: What are the legal risks and implications of such a mandate in Cambodia?

While the Labor Law does require employers to cover the cost of vaccinations against epidemics, during which the Ministry of Health (MOH) can also order extraordinary preventative measures at work sites, Cambodian law does not expressly prohibit employers from requiring employees to be vaccinated. There are also no laws or regulations specifying accommodation requirements for employees who refuse to be vaccinated due to health, religious, or other reasons. (It may be worth noting here as well that health checks are a regular part of the hiring process, and new employees have to submit to a health check before starting work.)

The government did issue a sub-decree on April 11, 2021, that requires vaccinations for public officials, and for certain groups of people, based upon their working and business conditions, to undergo vaccinations as determined by the MOH. The ministry has not yet issued any regulations mandating that employees of businesses in Cambodia receive a COVID-19 vaccine, or addressing the issue of employees who may want to opt out of vaccination.

Absent regulations from the MOH, the focus turns to the country’s Constitution, which in Article 31 guarantees all citizens equal treatment under the law without regard to race, color, gender, language, religious belief, political tendency, birth origin, social status, wealth, or other status. Additionally, Cambodian Labor Law prohibits discrimination in employment based on race, color, gender, religion, political opinion, ancestry, social origin, or union membership or activities. The authorities would likely decide on a case-by-case basis whether the conditions set out by employers are reasonable for a specific job, and whether they would constitute “discrimination in employment.”

From the above, it seems that discriminating against employees based on their willingness to be vaccinated would not contravene the Constitution or the Labor Law, but it is unclear whether rejecting or terminating an employee who refuses to be vaccinated due to religion or other protected status would be deemed discrimination in employment under Cambodian law. The Labor Law recognizes only two grounds for termination without the payment of severance: serious misconduct by the employee and force majeure. Therefore, if an employer terminated employment because the employee refused vaccination, it could be deemed termination without a valid reason, which would entitle the employee to compensation for the termination.

Nonetheless, the risk of this to companies mandating vaccination of employees against the coronavirus is low, as the Labor Law mandates that employers pay for vaccinations during epidemics and allows the MOH to order extraordinary preventative measures at work sites.

Vaccination Status and Data Privacy

Data privacy questions are also being raised during these uncertain times, as employers are interested in keeping track of the vaccination status of their employees, and many have wondered if this information would constitute “personal data” under the various data protection laws around the world.

Cambodia does not yet have comprehensive data protection legislation. The most recent update to the country’s data protection landscape was in the E-commerce Law, which contains provisions for the protection of consumer data gathered over the course of electronic communication—a scope that is limited to virtual or digital data protection. Other data protection matters typically fall under the right to privacy, which is protected in broad terms under the Constitution, the Civil Code, and the Criminal Code.

Cambodian laws also fail to define “personal data.” The E-commerce Law defines “data” as “a group of numbers, characters, symbols, messages, images, sounds, videos, information, or electronic programs that are prepared in a form suitable for use in a database or an electronic system.” Due to the absence of a definition of “personal data,” it remains plausible that in an employment context any employee data, including information concerning an employee’s vaccination, might be viewed by the regulatory and enforcement authorities as personal data of the employees.

Under Cambodia’s E-commerce Law, anyone who stores private information (in an e-commerce context) must use all means to ensure that such information is safely protected to avoid loss, access, use, modification, leakage, and disclosure of the information. Employers are obligated to pay for vaccinations during an epidemic and it would be necessary to keep records in order to prove that the employer has satisfied its obligations under Cambodian law. Nevertheless, under Cambodia’s Labor Law, in general, workers’ health records collected by medical personnel are confidential, and the information contained in them cannot be given to an employer or a third party (with some exceptions for the health and labor inspectors) that could identify the employee. Data extracted from the files that do not identify the individuals can, however, be used for public health.

Cambodian citizens have broad data privacy rights under Cambodian law of general application, and the country’s existing legal framework applicable to data protection implies a general disclosure or notification obligation. Personal data can only be collected, used, or disclosed for purposes that the individual understands and has consented to. Employers should thus obtain consent from employees regarding how their data will be used, and if the use differs from the purpose that was initially told to the employees, new consent must be obtained. In other words, storing or using information on employees’ vaccination status—which would be new information with a new purpose—would require new consent from the employees.

In the meantime, employers should obtain employees’ written consent to keep records of vaccination status on the grounds that the employer is obliged to pay for such vaccinations under the Labor Law and needs to keep records of its compliance with the law.

Conclusion

Like most countries, Cambodia does not have specific legal provisions addressing employee vaccination mandates in a pandemic, though the Constitution, the Labor Law, and other measures and regulations hint at how such an action might be viewed. As noted above, these do give reason to believe that such mandates face a low risk of being penalized. Another new and uncertain topic is whether keeping information on employees’ vaccination status would trigger data protection obligations. Under the circumstances, it is prudent for employers to treat this as they would other employee personal data.

The ongoing COVID-19 pandemic is forcing governments, businesses, and individuals around the world to figure out how responses to these unexpected situations can be made to fit under existing legal frameworks. However, it is always safest to seek expert advice that is tailored to a company’s unique needs and challenges. With clear advice and measured actions, businesses will be able to pass the current volatility and strategize to their benefit in the months and years that follow.

By Sochanmalisphoung Vannavuth, Tilleke & Gibbins, Cambodia, a Transatlantic Law International Affiliated Firm.

For more information on this topic, please contact cambodia@transatlanticlaw.com  

Disclaimer: Transatlantic Law International Limited is a UK registered limited liability company providing international business and legal solutions through its own resources and the expertise of over 105 affiliated independent law firms in over 95 countries worldwide. This article is for background information only and provided in the context of the applicable law when published and does not constitute legal advice and cannot be relied on as such for any matter. Legal advice may be provided subject to the retention of Transatlantic Law International Limited’s services and its governing terms and conditions of service. Transatlantic Law International Limited, based at 42 Brook Street, London W1K 5DB, United Kingdom, is registered with Companies House, Reg Nr. 361484, with its registered address at 83 Cambridge Street, London SW1V 4PS, United Kingdom.