None Of Your Business

at

This afternoon.

Via the Data Protection Commissioner:

As the economy and society continue to open up with the lessening of COVID-19 restrictions, many employers are seeking to understand what information they can process in relation to their employees return to the workplace. In particular, as the rollout of the National Vaccination Programme progresses, the question has been raised as to whether employers can lawfully collect and process information about the COVID-19 vaccination status of their employees.

As a general position, the DPC considers that, in the absence of clear advice from public health authorities in Ireland that it is necessary for all employers and managers of workplaces to establish vaccination status of employees and workers, the processing of vaccine data is likely to represent unnecessary and excessive data collection for which no clear legal basis exists. This is particularly the case when there is no public health advice pertaining to what the purpose of such data collection would be. For example, advice as to what employers would be expected to do with knowledge of vaccination status of workers i.e. to send non-vaccinated workers home or segregate vaccinated and non-vaccinated workers in workplaces?

Specific Employment Contexts

The processing of health data in response to the COVID-19 pandemic, in all contexts, should be guided by the Government’s public health policies. The current version of the Work Safely Protocol: COVID-19 National Protocol for Employers and Workers suggests that there are a limited set of circumstances in which vaccination should be offered as a workplace health and safety measure (as provided for under the Safety, Health and Welfare at Work (Biological Agents) Regulations 2013 and 2020).

There may be further situations, such as in the provision of frontline healthcare services, where vaccination can be considered a necessary safety measure, based on relevant sector specific guidance. For example, the Medical Council’s Guide to Professional Conduct and Ethics for Registered Medical Practitioners states that practitioners “should be vaccinated against common communicable diseases”. In these situations, it is likely that an employer will be in a position to lawfully process vaccine data on the basis of necessity.

Data Minimisation

The Work Safely Protocol: COVID-19 National Protocol for Employers and Workers also states that, “Irrespective of the vaccination roll-out, Public Health infection prevention and control measures (such as physical distancing, hand hygiene, face coverings, adequate ventilation), and working from home unless an employee’s physical presence in the workplace is necessary, will all need to remain in place”.

This makes it clear that there remains a full suite of measures that employers should employ to maintain workplace safety before considering whether knowledge of vaccination status is a necessary measure. In accordance with the principle of data minimisation, employers should implement all such measures that avoid processing the personal data of employees in the first place.

Voluntary Nature of Vaccination

Information about a person’s vaccination status is special category personal data for the purposes of the GDPR. It represents part of their personal health record, and is afforded additional protections under data protection law. The Work Safely Protocol: COVID-19 National Protocol for Employers and Workers states that the decision to get a vaccine is voluntary and that individuals will make their own decisions in this regard. This further suggests that COVID-19 vaccination should not in general be considered a necessary workplace safety measure and consequently, the processing of vaccine data is unlikely to be necessary or proportionate in the employment context.

Due to the nature of the National Vaccine Programme, individual workers are not in control of when they will receive a vaccine, and due to its age-based nature many younger workers will not be fully vaccinated for several months. For these reasons, it is not clear that processing vaccination status can be considered a necessary or proportionate measure in most employment situations. In addition, the long-term efficacy of vaccination in terms of immunity is not yet clear i.e. where new COVID variants may arise, or vaccine top-ups may be required. For these reasons, there does not appear to be a sufficiently evidence based justification to consider that knowledge and processing of vaccination status can be considered necessary in employment at this time.

The processing of personal data in the context of employment takes place in a situation where there is an imbalance between the data subject (employee) and data controller (employer). Therefore, employees should not be asked to consent to the processing of vaccine data as this consent is not likely to be freely given.

Medical Officer of Health

In the course of carrying out their public health duties under the Infectious Diseases Regulations 1981, as amended, a Medical Officer of Health may require access to the vaccination status of employees. This limited type of processing is specifically permissible under data protection law where carried out on a case- by-case basis, subject to the determination of necessity and at the request of the Medical Officer of Heath.

Employees and Travel

Situations may arise where employers need to be made aware of when an employee will be available for work after travelling to Ireland from abroad and undergoing any required periods of self-isolation. It should not be strictly necessary for employee’s vaccination status to be recorded in such instances, rather the employee can be asked to indicate the date on which they will be in a position to return to work.

Processing COVID-19 Vaccination Data in the context of Employment (DPC)

Earlier: Can He Get Lower?

Meanwhile…

Sponsored Link

9 thoughts on “None Of Your Business

  1. Free Lunch

    There is no orthogonal relevance that NSW or any other of the incessant reports of Anti-Vax protests in Australia has to this story or Ireland.

    1. Cui Bono?

      They are anti vaccine PASSPORT protests all over the world – they are not anti vaccine protests, they never were.

      Don’t be fooled into thinking they are one and the same thing. The agenda has always been to implement the digital pass system and the vaccine is simply the tool to try coerce everyone into using it.

      1. george

        “anti vaccine PASSPORT protests all over the world – they are not anti vaccine protests, they never were.”

        There have been many anti-vaccine protests though.

  2. Darren

    Or George. . Governments like that of NSW are aware that their interests are best served by any and all demonstrations of punishment for the sake of reassuring a majority that both they and their elected representation are on the same side of the argument. Let alone the continuing role of media to provide questions that routinely become the basis for statements.. covid passes or not, this basic channel of popular control versus the reflected value of individual liberty seems to be a challenge that wont be going away now that the understanding of the use of politics is principly to send out messages as opposed to present proportional capabilities that inform before they attempt to divide

    1. george

      If you have a law and anyone can break it without consequences then you don’t have a law. They are simply enforcing a law.

      I’ve no issue with anyone disagreeing with the law.

Comments are closed.

Sponsored Link
Broadsheet.ie