Monitoring, fines and data protection

Following increasing infection rates after the summer and in reaction to a stalling vaccination coverage that has the potential to fill intensive care beds, the Health Ministry has decided to step up covid-19 measures in workplaces and has passed a new ordinance aiming to curtail the spread of the virus.


The new 3rd Ordinance on Covid-19 Measures entered into force on 1 November 2021 and applies to all types of workplaces, both private enterprises and public bodies.

It also covers all employees, owners and operators alike who want to enter "workplaces where physical contacts between persons cannot be excluded" (section 9(1) of the ordinance). The ordinance specifies that a maximum of two outdoor contacts per day with a duration of less than fifteen minutes each does not qualify as "physical contact" at the workplace. This clarification aims at excluding certain job functions that are usually performed without contact with coworkers, such as truck drivers or foresters.

The ordinance requires that staff must at all times either be fully vaccinated, recovered from illness or validly tested, with a negative test result, and that employees must have the relevant evidence at hand if the employer asks for it.

The so-called "3G rule"(1) also applies to all external work sites (eg, construction sites and external production sites), but not to an employee's private residence – employees need not provide proof of their 3G-status when they work remotely (ie, from a home office).

The ordinance provides for a transition period of 14 days (ie, until 14 November 2021) during which employees (but also business owners and operators) without proof of their valid 3G status could enter the workplace but had to wear an FFP2-mask throughout the day (except when consuming food or beverages).

Now that the transition period has expired, employees must not enter the workplace without 3G proof and will be considered to be on unpaid leave. Accordingly, the employer need not pay the employee's salary during this time of unjustified absence.

Also, in the case of persistent or repeated refusal to present the required 3G evidence and return to work (in particular, if the employer has expressly requested that the employee provide such proof and show up for work), the employer may terminate the employment relationship for cause with immediate effect (unless there are less severe measures that appear sufficient with respect to both parties' interests in the individual case, such as home office arrangements, where appropriate).

Justification of termination with immediate effect will thus depend on the individual circumstances.

Monitoring, fines and data protection

Under the current version of the ordinance, the employer is not obliged to establish control mechanisms in order to strictly check and monitor the 3G status of each employee entering the premises on a daily basis. It is sufficient to ensure random checks or checks at regular intervals.

Both the employer and the employee are responsible for complying with the 3G rule at the workplace and are subject to fines in case of non-compliance (employees are subject to pay up to €500; employers are subject to pay a maximum of €3,600).

The ordinance prohibits the 3G status of individual employees from being stored or recorded. All the employer has to do is to randomly check the status and, as evidence of this random check, record the date of the check and the name of the employee.


It would have been much more efficient if the ordinance had expressly permitted that the 3G status of each employee be recorded – in particular, whether an employee has been vaccinated and when their immunisation by vaccination will expire. In this case, time-consuming random checks could have been replaced by a transparent overview on vaccination, test and recovery status, but diffuse data protection concerns dictated otherwise.

The new set of workplace rules has also been criticised for its regime on fines and random checks. Cases where employers can be fined are rare, since they need not establish a strict and permanent access control to comply, but mere random checks. Consequently, employers cannot be responsible for 100% compliance and will hardly be fined even if the authorities identify employees without proof of their 3G status, provided that they can show that they have actually performed random checks. Such fines are therefore hardly incentivising the intended effect on workplace safety and the spread of the virus.

For further information on this topic please contact Jakob Widner or Axel Guttmann at GRAF ISOLA by telephone (+43 (1) 401 17-0)‚Äčor email ([email protected] or [email protected]). The GRAF ISOLA website can be accessed at


(1) From the German words "Geimpft", "Genesen" and "Getestet", meaning "vaccinated", "recovered" and "tested", respectively.