This afternoon.
Via the Data Protection Commissioner:
As the economy and society continue to open up with the lessening of COVID-19 restrictions, many employers are seeking to understand what information they can process in relation to their employees return to the workplace. In particular, as the rollout of the National Vaccination Programme progresses, the question has been raised as to whether employers can lawfully collect and process information about the COVID-19 vaccination status of their employees.
As a general position, the DPC considers that, in the absence of clear advice from public health authorities in Ireland that it is necessary for all employers and managers of workplaces to establish vaccination status of employees and workers, the processing of vaccine data is likely to represent unnecessary and excessive data collection for which no clear legal basis exists. This is particularly the case when there is no public health advice pertaining to what the purpose of such data collection would be. For example, advice as to what employers would be expected to do with knowledge of vaccination status of workers i.e. to send non-vaccinated workers home or segregate vaccinated and non-vaccinated workers in workplaces?
Specific Employment Contexts
The processing of health data in response to the COVID-19 pandemic, in all contexts, should be guided by the Government’s public health policies. The current version of the Work Safely Protocol: COVID-19 National Protocol for Employers and Workers suggests that there are a limited set of circumstances in which vaccination should be offered as a workplace health and safety measure (as provided for under the Safety, Health and Welfare at Work (Biological Agents) Regulations 2013 and 2020).
There may be further situations, such as in the provision of frontline healthcare services, where vaccination can be considered a necessary safety measure, based on relevant sector specific guidance. For example, the Medical Council’s Guide to Professional Conduct and Ethics for Registered Medical Practitioners states that practitioners “should be vaccinated against common communicable diseases”. In these situations, it is likely that an employer will be in a position to lawfully process vaccine data on the basis of necessity.
Data Minimisation
The Work Safely Protocol: COVID-19 National Protocol for Employers and Workers also states that, “Irrespective of the vaccination roll-out, Public Health infection prevention and control measures (such as physical distancing, hand hygiene, face coverings, adequate ventilation), and working from home unless an employee’s physical presence in the workplace is necessary, will all need to remain in place”.
This makes it clear that there remains a full suite of measures that employers should employ to maintain workplace safety before considering whether knowledge of vaccination status is a necessary measure. In accordance with the principle of data minimisation, employers should implement all such measures that avoid processing the personal data of employees in the first place.
Voluntary Nature of Vaccination
Information about a person’s vaccination status is special category personal data for the purposes of the GDPR. It represents part of their personal health record, and is afforded additional protections under data protection law. The Work Safely Protocol: COVID-19 National Protocol for Employers and Workers states that the decision to get a vaccine is voluntary and that individuals will make their own decisions in this regard. This further suggests that COVID-19 vaccination should not in general be considered a necessary workplace safety measure and consequently, the processing of vaccine data is unlikely to be necessary or proportionate in the employment context.
Due to the nature of the National Vaccine Programme, individual workers are not in control of when they will receive a vaccine, and due to its age-based nature many younger workers will not be fully vaccinated for several months. For these reasons, it is not clear that processing vaccination status can be considered a necessary or proportionate measure in most employment situations. In addition, the long-term efficacy of vaccination in terms of immunity is not yet clear i.e. where new COVID variants may arise, or vaccine top-ups may be required. For these reasons, there does not appear to be a sufficiently evidence based justification to consider that knowledge and processing of vaccination status can be considered necessary in employment at this time.
The processing of personal data in the context of employment takes place in a situation where there is an imbalance between the data subject (employee) and data controller (employer). Therefore, employees should not be asked to consent to the processing of vaccine data as this consent is not likely to be freely given.
Medical Officer of Health
In the course of carrying out their public health duties under the Infectious Diseases Regulations 1981, as amended, a Medical Officer of Health may require access to the vaccination status of employees. This limited type of processing is specifically permissible under data protection law where carried out on a case- by-case basis, subject to the determination of necessity and at the request of the Medical Officer of Heath.
Employees and Travel
Situations may arise where employers need to be made aware of when an employee will be available for work after travelling to Ireland from abroad and undergoing any required periods of self-isolation. It should not be strictly necessary for employee’s vaccination status to be recorded in such instances, rather the employee can be asked to indicate the date on which they will be in a position to return to work.
Processing COVID-19 Vaccination Data in the context of Employment (DPC)
Earlier: Can He Get Lower?
Meanwhile…
