An employer that intends to ask employees if they have been vaccinated against coronavirus (COVID-19) must be clear about its reasons for doing so. To comply with its data protection obligations, it must ensure that it has a legal basis for processing such information and that it complies with the conditions for processing special category data (relating to employees’ health) under the UK GDPR.
The Information Commissioner’s Office has published guidance for organisations on when collecting vaccination data can be justified. Depending on its reasons for asking about vaccination status, an employer may be able to rely on its legitimate interests and compliance with employment rights and obligations as the basis for processing such data.
However, in a nutshell, your reason for checking or recording people’s COVID status must be clear, necessary and transparent. If you cannot specify a use for this information and are recording it on a ‘just in case’ basis, or if you can achieve your goal without collecting this data, you are unlikely to be able to justify collecting it.
It is likely to be easier to justify collecting such information in certain workplaces, for example in a health or care setting where coronavirus presents a specific risk.
If you do collect this personal data, you must ensure that it is kept securely and that it is shared only with the specific people who need to access it. It must be kept for no longer than necessary. An employer could consider keeping anonymised records, if its aim is to monitor levels of vaccination across the workforce, rather than recording whether specified individuals have been vaccinated.
The employer must provide employees with information about how and why their vaccination data is being processed. This could be an update to an existing privacy notice or could be provided as a separate document.
Employers should be aware that an attempt to impose a mandatory vaccination policy would risk a number of legal claims and employee relations issues.
firstname.lastname@example.org or +44(0)7917 878384