As offices nationwide begin to reopen, employers are asking whether they are entitled to know which staff have been vaccinated in order to plan a safe return to the workplace.

In June 2021, the Data Protection Commission (the “DPC”) published updated guidance for employers who have or intend to process COVID-19 vaccination data in the workplace.

In summary, the DPC advised that the processing of health data in response to the COVID-19 pandemic, should be guided by the Government’s public health policies, including in particular the Work Safely Protocol: COVID-19 National Protocol for Employers and Workers (the “Protocol”). In light of this, the DPC confirmed that, in the absence of public health advice to the contrary, the processing of vaccine data by employers is likely to represent unnecessary and excessive data collection for which there is no clear legal basis.

While this is the default position, we have set out some of the key considerations highlighted in the DPC’s guidance, which employers should consider before processing vaccination data.

The specific employment industry

The DPC’s guidance highlights specific instances when vaccination should be offered as a workplace health and safety measure:

  • The Protocol provides that under the Safety, Health and Welfare at Work (Biological Agents) Regulations 2013 and 2020, if a risk assessment shows there is risk to the health and safety of employees due to working with a biological agent for which there is an effective vaccine available, vaccination should be offered. 
  • The DPC’s guidance also refers to further situations where vaccines can be considered a necessary safety measure based on sector specific guidance. For example, in the case of the healthcare sector or frontline workers, the Medical Council advises that practitioners should be vaccinated. In this case, an employer can rely on necessity as a legal basis for processing vaccination data.

Data minimisation

In order to comply with the principle of data minimisation, the DPC’s guidance advises organisations to firstly consider other measures to mitigate the risk of COVID-19 in the workplace, rather than relying on an employee’s vaccination status in the first instance. This includes measures such as physical distancing, hand hygiene and working from home. Only after such measures have been utilised should the employer consider vaccination data, if appropriate. This encourages employers to minimise the collection of personal data.

Voluntary Nature of Vaccination

Due to the voluntary nature of the vaccine, the DPC advises that the processing of vaccine data is unlikely to be necessary or proportionate in the employment context. This is based on the following factors:

  • As health data is special category data, it is afforded additional special protections under the GDPR.
  • Under the National Vaccine Programme, individual workers are not in control of when they will receive a vaccine.
  • There does not appear to be sufficient evidence regarding the long-term effects of the vaccine, particularly in light of additional variants.
  • Due to the power imbalance in the employment relationship, employees are not able to consent to the processing vaccine data as this consent is not likely to be freely given.

In light of these factors, the DPC has advised that it would not be proportionate to require staff to confirm their vaccination status. Even where an employee has been travelling, the DPC has advised it should not be strictly necessary for an employee’s vaccination status to be recorded.

Advice for Employers

While the DPC’s guidance will be subject to review pending any public health developments, as it stands, organisations should carefully consider relying on vaccination data when planning a return to the workplace. Employers should consider alternative measures which do not rely on the processing of personal data before considering whether an employee has been vaccinated. This should be considered when conducting a risk assessment of the office workspace and how to mitigate against the spread of COVID-19.

Given the level of uncertainty surrounding the virus, the ability of employers to remain flexible is integral to maintaining a safe workplace. Employers are advised to keep up to date with public health advice and Government guidance in this regard.