Can employers ask their staff if they’ve been vaccinated?

It’s a question many company directors want to be clarified – can employers (in Ireland) ask their staff if they’ve been vaccinated? Claire Morrissey, head of data, commercial & technology, and Karen Killalea, head of employment with the Maples Group, explain the key considerations employers must make before asking their staff if they are vaccinated or not. Processing COVID-19 vaccination data in the workplace As Ireland’s National COVID-19 Vaccination Strategy gathers pace, employers frequently ask whether they can decide who returns to work and when based on an employee’s vaccination status. Employers, in particular, continue to ask whether they can lawfully collect and process information about the vaccination status of their employees. In this client update, we explain the key considerations. The GDPR legal basisProcessing personal data relating to vaccination status is the processing of health data for the General Data Protection Regulation (“GDPR”). This is considered ‘special category personal data’. To process this type of data, employers must identify an appropriate legal basis for Articles 6 and 9 of the GDPR. Many employers may seek to rely on their obligation to provide a safe working environment under the Safety, Health and Welfare at Work Act 2005. However, to rely on this legal basis, employers must establish that processing employees’ vaccination status is necessary to provide a safe working environment. Public health guidance is key to this assessment. There is currently no public health guidance that validates the use of vaccination status as a factor in decision making related to the re-opening of a safe working environment. This may change if and when the Irish Government’s Work Safely Protocol (the “Protocol”) is updated in the coming months. Some employers deploy regular rapid antigen tests and ask about vaccination status to determine return to work policies and maximise safety. Still, the practice is isolated. In general, employers in Ireland are not embracing these tools with employees or customers due to the legal complexities of such an approach. Legislation is expected very soon to specifically facilitate a system of checking vaccination status among customers within the restaurant and hospitality sector, but this legislation is not expected, at this point, to have wider application.The DPC guidance – can employers ask their staff if they’ve been vaccinated? The Data Protection Commission (DPC) has recently clarified that in its view, in the absence of clear public health advice, processing employees’ vaccination data is likely to represent unnecessary and excessive data collection for which there is no clear legal basis. Unnecessary and disproportionate processing The DPC outlined a number of reasons why, in the absence of public health guidance mandating such processing, the processing of employee vaccination data would amount to unnecessary and disproportionate processing of personal data: The Protocol suggests that there are only a limited set of circumstances in which vaccination should be offered as a workplace health and safety measure; The voluntary nature of the vaccination programme suggests that COVID-19 vaccination is not a necessary workplace safety measure. The Protocol acknowledges that employees are also not in control of when they will receive a vaccine, given the nature of the Irish National Vaccine Programme; The principle of data minimisation requires employers to implement all other measures that avoid the processing of personal data. The Protocol states that irrespective of vaccinations, there are other measures that employers should implement to maintain workplace safety (e.g. physical distancing); and The long-term efficacy of vaccination in terms of immunity remains unclear. The public health guidance appears to reflect that. It is difficult for employers to point to an evidence base for using vaccination as a decision-making tool. Employee consent – a fragile basis for processing The DPC has recommended that employers should not ask employees to consent to the processing of vaccine data as the imbalance inherent in the relationship of employer/employee means that consent is not likely to be freely given. Employee travel The DPC has also noted that situations may arise where employers need to know when employees will be available for work after travelling abroad. The DPC has indicated that in such circumstances, an employee should be asked to confirm the date on which they will be available to return to work, and it should therefore not be strictly necessary to record the employee’s vaccination status. Employers should also be aware that the EU Digital COVID Certificate, which is to be used by anyone travelling within the EU and EEA, may disclose the vaccination status of an employee, and employers should therefore not process such information unless it is necessary. Duty to offer vaccination Subject to the principle of data minimisation, there may be limited circumstances where the processing of employee vaccination data is necessary. While the DPC guidance is silent in this respect, the Biological Agents Regulations (SI No. 572 of 2013) and associated Code of Practice adds the COVID-19 virus as a risk group III biological agent and lays down the minimum requirements for the protection of workers from risks related to exposure to this biological agent at work. Where there is a risk of occupational exposure as a result of working with the COVID-19 virus, the employer should complete an occupational health and safety biological agent risk assessment (“BARA”). Where BARA shows there is a risk to the health and safety of employees due to working with the COVID-19 virus, employers should offer vaccination and inform employees of the benefits and drawbacks of both vaccination and non-vaccination. Based on how the COVID-19 vaccination is currently being rolled out in Ireland, employers are not in a position to offer vaccinations. Therefore, employers can provide access to reliable public health information regarding the benefits and drawbacks of the COVID-19 vaccination. How will this impact employers in Ireland?It is clear from the DPC guidance that establishing a clear GDPR legal basis for employee vaccine data processing is challenging. The refinement and updating of public health guidance as the evidence base regarding vaccination efficacy will drive developments. Employers can still provide employees with advice and information on the vaccination programme and must do so if their risk assessment requires it.What about the Employment Law consequences of using vaccination status data? The National Vaccination Strategy does not provide for mandatory vaccination. As matters stand at the date of writing, an employee can: refuse to be vaccinated; refuse to disclose their vaccination status to their employer; and refuse to comply with a policy that excludes non-vaccinated employees. The avenues of redress under Irish employment law for employees who claim that they are at a disadvantage by reason of such questions/policies include: A claim related to unlawful discrimination on the grounds of age (if they are ineligible for the vaccine based on the National Vaccination Strategy which prioritises individuals based on age) and disability; and An employee who claims they have been penalised through dismissal, demotion or a reduction in pay directly or indirectly as a result of a refusal to comply with an employer’s vaccination policies could successfully claim breach of contract (for example, relating to pay or job status) or statutory unfair/constructive dismissal. It is recommended that employers take advice before using the vaccination status of employees and workers as a factor influencing return to work plans. How the Maples Group can help We can assist by providing up-to-date guidance regarding GDPR compliance, updating workplace risk assessments, remote working and return to work preparations.

Rapidly acquire the skills and knowledge you need to lead.

Diploma in Corporate Governance

Certified Company Secretary Professional

Certified ESG Professional

Technology & Governance for Boards

Company Secretary

Overview of Corporate Governance

AI Governance

CSRD Reporting

The director's challenge

Attend online and in-person events to get the practical skills and insights you need to make an impact as a leader.

Webinars

Masterclasses

Information sessions

Webinars

Insightful and thought-provoking content to help you become a great board director.

eBooks

Case studies

Guides

Interviews

Lexicon

News analysis

Member spotlight

Thought leadership

Podcasts

Featured eBook

Can employers ask their staff if they’ve been vaccinated?

Insights on leadership

Related Posts

Rapidly acquire the skills and knowledge you need to lead.

Diploma in Corporate Governance

Certified Company Secretary Professional

Certified ESG Professional

Technology & Governance for Boards

Company Secretary

Overview of Corporate Governance

AI Governance

CSRD Reporting

The director's challenge

Attend online and in-person events to get the practical skills and insights you need to make an impact as a leader.

Webinars

Masterclasses

Information sessions

Webinars

Insightful and thought-provoking content to help you become a great board director.

eBooks

Case studies

Guides

Interviews

Lexicon

News analysis

Member spotlight

Thought leadership

Podcasts

Featured eBook

Can employers ask their staff if they’ve been vaccinated?

Insights on leadership

Currently trending

Related Posts

What is DExit? It might signal a new norm

The new rules of business performance

Redefining resilience in leadership