My Employees & The Vaccine: Can I ask for this data?
As vaccinations continue to roll out and employees begin returning to the workplace, employers are now wondering if they can lawfully collect and process information about the Covid-19 vaccination status of their employees. As mentioned in our previous Blog Post Let's Get Topical - The Vaccine Policy, information relating to an individual’s vaccination status is categorised under GDPR as special category personal data and therefore represents part of their personal health record which is why it is afforded additional protections under data protection law.
The Data Protection Commission (DPC) has published guidelines addressing the issue of what information employers can process, within these guidelines the DPC have made it clear that they do not consider there is any general legal basis for employers to request the vaccination status of their employees at this time, their reason being “in the absence of clear advice from public health authorities in Ireland that it is necessary for all employers and managers of workplaces to establish vaccination status of employees and workers, the processing of vaccine data is likely to represent unnecessary and excessive data collection for which no clear legal basis exists”.
With that being said, the DPC acknowledges that there may be certain extenuating circumstances, for example those working in frontline healthcare services, where vaccination can be considered a necessary safety measure, therefore in these situations the DPC states that an employer will likely be in a position to lawfully process vaccine data on the basis of necessity.
The current version of the Work Safely Protocol: Covid-19 National Protocol for Employers and Workers highlights that the decision to get a vaccine is entirely voluntary, and that individuals will make their own decisions as to whether they wish to receive it or not. Based on this, in the DPC’s view, this further indicates that covid-19 vaccination data should not be considered a necessary workplace safety measure, and as a result, the processing of vaccine data is unlikely to be necessary or proportionate in an employment context.
These guidelines will be subject to review if the public health advice and laws relating to the nature of the virus, the pandemic and the interplay with vaccination change which is why employers should ensure they closely monitor evolving public health guidance and laws.
To keep up to date on these changes we have recommended the following resources:
- GOV.ie
- HSE.ie
Bright Contracts has recently been updated to include a Data Protection Policy and Vaccine Policy which covers these consideration points for our customers to include in their employee handbooks, which can be found under the terms and conditions tab.
Related Articles:
- Your GDPR Questions Have Been Answered!
- As Easy As 1,2,3: Key Elements of Safe Return to The Workplace
- The Home Stretch: The Final Key Steps in a Safe Employee Return
- Hello Update! - Additions to the Return to Work Safely Protocol
