Since coronavirus restrictions lifted in the UK, workers have gradually been returning to the office.
With TfL figures revealing a 22% rise in London Underground commutes, employers are beginning to ask whether they are legally permitted to ask their employees if they have been vaccinated against COVID-19 and, if so, whether they are able to collect and process this data.
How is data regarding COVID vaccination status classified?
Since a person’s COVID vaccination status reveals private information about their health, this is classified as special category data under the UK General Data Protection Regulation (UK GDPR).
When collecting special category data, the Information Commissioner’s Office (ICO) explains that use of this data must be fair, relevant and necessary for a specific purpose. Therefore it is important that employers ask themselves whether collecting the COVID vaccination status of their employees is necessary to achieve their goal, before they begin putting plans in place to collect this information.
The industry sector – and considerations such as the health and safety issues associated with that sector – will also influence whether or not an employer has a compelling reason to collect the COVID vaccination status of its employees. Employers must stay on top of the changing circumstances which may affect the ongoing necessity for such processing.
Lawfully processing employees’ COVID vaccination status
To collect and process employees’ COVID vaccination status, employers will need to identify a lawful basis for doing so under Article 6 of the UK GDPR, which includes six available bases for processing data.
In addition to establishing this lawful basis, because COVID vaccination status is classified as special category data, employers must also identify a separate condition for processing this data under Article 9 of the UK GDPR. Depending on which condition employers choose to reply upon, they may also need to meet the requirement of associated conditions outlined in the Data Protection Act 2018 (“DPA 2018”).
Furthermore, depending on the bases and conditions that they wish to rely upon, employers may be required to draft an “appropriate policy document” outlining its measures for processing this special category data.
Other legal factors
In addition to data protection issues, employers should also consider other legal factors when deciding whether to ask employees for their COVID vaccination status, including:
- Workplace discrimination issues (under s60 of the Equality Act 2010)
- Human rights issues (specifically relating to Article 8 rights to privacy and Article 9 rights to freedom of thought, belief and religion under the Human Rights Act 1998)
- Health and safety at work requirements
- Any conflict that may arise in relation to existing employee contracts
Employers should also take in to account any guidance put in place by regulatory bodies governing their industry, as well as consider NHS public health advice and the latest UK government guidance.