Vaccination Status – Can You Ask Your Employees?

COVID-19 and GDPR

With the vaccination rollout for Covid-19 well under way, many employers will be eagerly awaiting their employees return to the office. We’ve seen in our previous article the debate on whether or not employers can require their workforce be vaccinated, but what happens when employers want employees to disclose their vaccine status?

Are businesses able to collect data on whether their staff have been vaccinated?

Private health information, such as vaccination status, falls into special category data and so it is important for employers to only collect this data where it is necessary and required for a specific purpose.

It is recognised that there is an imbalance of power between employers and employees and, as a result of this, consent cannot be relied upon by employers as a justifiable reason to process data.  For consent to be valid, it must be freely given which isn’t usually the case in employment relationships. 

The ICO have provided guidance on when employers are able to collect data on employee’s vaccination status which highlights that there must be a clear reason for collecting this data from employees. 

A clear reason may include where employees are working in health care settings or if vaccination passports are required for essential work-related travel. Employers will need to look at their businesses and the work being undertaken to establish if they have a compelling reason to collect vaccination data. It will also be necessary to identify a condition for processing under Article 9 of the GDPR.

Requirements for collecting the data

If your business can justify collecting information from staff on their vaccination status, you will need to ensure that your employees understand the reason you’re collecting this data and what it will be used for.  The data collected needs to accurate, kept confidential and securely stored.  Employers should only share the information where it is necessary and there is a legitimate reason to do so.

Requirements for retaining this information should be kept under review at regular periods to monitor whether it is still necessary to retain the data. 

What if an employee objects to disclosing their vaccination status?

The Covid-19 vaccination is not mandatory and so some employees may choose not to receive it. This could be for a number of reasons including religion, personal belief, pregnancy or an underlying health reason.  Employees may feel uncomfortable disclosing their vaccine status with their employer.  If this is the case, it is important to discuss this with them to be able to understand and address their concerns.  You can emphasise to the employee that the data will be held securely and only disclosed where it is necessary to do so.

It is clear that the pandemic has opened up a whole new array of potential issues for employers to consider. Further information about data protection relating to Covid-19 in general is available on the ICO website.

We are here to advise on any specific queries or issues you may have in relation to your business.

Click here for ways to contact us.