Guidance to Employers about Employee Vaccination Data

As the Covid-19 vaccine roll out continues, and more people in Ireland are eligible to receive a vaccine, the question of how employers should address the vaccine status of their employees has become more common.

The Data Protection Commission (“DPC”) has issued guidance in relation to whether employers can lawfully collect and process information about the Covid-19 vaccination status of their employees. The vaccination status of an individual is health data and therefore special category data under Article 9 of the General Data Protection Regulation (“GDPR”) and it may only be processed on limited grounds.

What the guidance says

The DPC states in the guidance that, as a general position, “in the absence of clear advice from public health authorities in Ireland that it is necessary for all employers and managers of workplaces to establish vaccination status of employees and workers, the processing of vaccine data is likely to represent unnecessary and excessive data collection for which no clear legal basis exists.”

The DPC notes that this is particularly the case where there has been no public health advice or guidance as to what employers should actually do if they know the vaccination status of employees or whether vaccinated and unvaccinated employees should be treated differently.

The guidance notes that there may be situations, such as for frontline healthcare workers, where vaccination can be considered a necessary safety measure. In these situations, it is likely that an employer will be in a position to lawfully process vaccine-related personal data on the basis of necessity.

The guidance refers to the current version of the Work Safely Protocol (the “Protocol”). The Protocol states that “Irrespective of the vaccination roll-out, Public Health infection prevention and control measures (such as physical distancing, hand hygiene, face coverings, adequate ventilation) and working from home unless an employee’s physical presence in the workplace is necessary, will all need to remain in place.”

The DPC considers that it is clear from this that there are other measures that employers should employ in the workplace to ensure a safe place of work, before considering whether knowledge of vaccination status is a necessary measure. Citing the principle of data minimisation laid down in the GDPR, it notes that employers should implement all such measures that avoid processing the personal data of employees in the first place.

The voluntary nature of the Covid-19 vaccine is also referred to in the Protocol. The significance of this voluntary system (from the DPC’s point of view) is that it further suggests that a vaccine should not in general be considered a workplace safety measure. This, again, means that the processing of vaccine data is unlikely to be necessary or proportionate in most employment contexts.

The age based roll out of the vaccine, uncertainty about the long term efficacy of the vaccine in relation to new Covid-19 variants, and the use of vaccine top-ups in the future all suggest to the DPC that there does not appear to be “sufficiently evidence-based justification to consider that knowledge and processing of vaccination status can be considered necessary in employment at this time.”

The DPC also warns that given the nature of the employer / employee relationship, an employee cannot freely consent to the processing of their vaccine status by the employer. Therefore employees should not be asked to give this consent. If employers cannot justify the processing of vaccine data on other grounds, the consent ground will not be appropriate.

The DPC notes there is a specific provision under the Infectious Disease Regulations 1981 under which a Medical Officer of Health can require access to the vaccination status of employees. Such processing should only be carried out on a case-by-case basis and at the request of the Medical Officer of Heath.

The fact that employees may be travelling abroad and having to undergo periods of self-isolation on their return should not be used as a method of requiring them to provide data relating to their vaccine status. Instead, the employee should only be asked to indicate a date on which they will be able to return to work.

The DPC notes that the guidance is subject to review if the public health advice and laws relating to the nature of the virus, the pandemic and the interplay with vaccination change. It notes employers should check the most up to date public health guidance in the first place.

Commentary

Given that there has been little clear official advice and recommendations in relation to the vaccine status of employees to date, this guidance from the DPC is welcome. Employers may have hoped or expected that there would be scope for them to gather and use vaccination data to support the return to the workplace, however this guidance does not support such an approach, other than in very limited circumstances.

The DPC guidance makes is clear that for the time being, it considers that there is no general legal basis for employers to request the vaccination status of employees. However it acknowledges that may be necessary for employers in certain specific sectors, notably healthcare, to process such data.

If any employers believe that specific circumstances apply to them that might make it necessary for them to process their employees’ vaccine data, employers should take specific advice in respect of those circumstances.

The most common ground for employers processing Covid-19 related personal data of employees during the pandemic has been that it is necessary to do so in order to meet the employer’s obligation to provide a safe place of work. 

The DPC relies heavily in its guidance on the current public health advice and also the contents of the current version of the Work Safely Protocol. In the absence of clear public health advice as to how the vaccine status of an employee will impact on the ability of employers to provide a safe place of work, the DPC (for the moment) cautions against employers processing this data.

The DPC states that the guidance is subject to review based on whether the public health advice changes. With the Government indicating that the “work from home” advice due to be lifted by September, public health advice in relation to employee vaccination status is eagerly awaited.

Link to DPC guidance: https://www.dataprotection.ie/en/dpc-guidance/processing-covid-19-vaccination-data-context-employment

For further information please contact Loughlin Deegan or Brian Murphy from the ByrneWallace LLP Employment Law team or your usual ByrneWallace contact.