DPC Guidance on Processing Covid-19 Vaccination Data - Your Questions Answered

As the roll-out of the National Vaccination Programme steadily progresses and with some businesses starting to plan a staggered return to the workplace, employers are faced with the question of what (if any) information they can request from employees regarding their Covid-19 vaccination status.

A person’s vaccination status represents part of their personal health record and is therefore considered to be special category personal data under the General Data Protection Regulation (GDPR). Such special category personal data is afforded additional protections and may only be processed in limited circumstances and on narrow processing grounds.

Recently, the Irish Data Protection Commission (DPC) has issued long anticipated guidance clarifying whether it is lawful for employers to collect and process such special category personal data relating to employees' Covid-19 vaccination status (the DPC Guidance).

In short, what does the DPC Guidance say?

The  DPC Guidance states that "in the absence of clear advice from public health authorities in Ireland that it is necessary for all employers and managers of workplaces to establish vaccination status of employees and workers, the processing of vaccine data is likely to represent unnecessary and excessive data collection for which no clear legal basis exists”.

Based on current public health guidance, the DPC considers that at present there is no general legal basis for collecting and processing information as to employees' vaccination status.

Therefore, save in exceptional sector specific circumstances (such as frontline healthcare services), it will not be generally permissible for employers to ask employees to confirm whether or not they have been vaccinated, unless general public health guidance as outlined in the Government's recently revised Work Safely Protocol (covered previously here) changes to make vaccination a relevant workplace measure for the prevention of Covid-19.

How did the DPC reach this conclusion?

The DPC Guidance specifically refers to a number of factors grounding its conclusion that on the basis of current public health guidance the collection and processing of such vaccination data would at present be 'unnecessary and excessive':

• Purpose for Processing: There is currently no public health guidance as to what actions employers would be expected to take on foot of being informed of employees' vaccination status (i.e. send non-vaccinated employees home or segregate vaccinated and non-vaccinated employees in workplaces), and therefore it remains unclear what the purpose justifying the collection of vaccination data would be.
• Data Minimisation: The Work Safely Protocol emphasises the continued need for infection prevention and control measures (such as physical distancing, hand hygiene, face coverings, adequate ventilation), irrespective of the vaccine roll-out. It is therefore the DPC's view that, in accordance with the principle of data minimisation, employers should implement the full suite of such infection prevention and control measures before considering collecting vaccination data in the first place.
• Necessity & Proportionality: The Work Safely Protocol also emphasises that the decision to get a vaccine is entirely voluntary. This voluntary nature of the Covid-19 vaccine together with the uncertainty about the long term efficacy of the vaccine particularly in relation to new Covid-19 variants and the age based roll-out of the National Vaccination Programme (as a result of which many younger workers will not be fully vaccinated for several months) mean that in the DPC's view "there does not appear to be a sufficiently evidence based justification to consider that knowledge and processing of vaccination status" can be considered "necessary or proportionate measure in most employment situations".

Are there exceptions?

The DPC Guidance acknowledges that there may be certain specific employment contexts where the collection and processing of information as to employees' vaccination status could be considered a necessary safety measure, provided this is based on sector specific guidance.

1. In this regard the Guidance gives the example of frontline healthcare services and refers to the Medical Council’s Guide to Professional Conduct and Ethics for Registered Medical Practitioners which states that practitioners “should be vaccinated against common communicable diseases”.
2. The Guidance also refers to the vaccination section of the Work Safety Protocol which suggests that there are a limited set of circumstances in which vaccination should actually be offered to employees as a workplace health and safety measure (as provided for under the Safety, Health and Welfare at Work (Biological Agents) Regulations 2013 and 2020).

The DPC’s view is that in these situations, it is likely that the employer will be in a position to lawfully process information relating to employees' vaccination status on ‘the basis of necessity’.

What if the employee consents to disclosing their vaccination status?

As the processing of personal data in the employment context takes place in a situation where there is an imbalance between the data subject (employee) and data controller (employer), the DPC Guidance outlines that even if the employee consents to disclosing their vaccination status, such consent would not likely be deemed to have been freely given.

What about when employees travel abroad?

The DPC Guidance acknowledges that employers may need to be aware of employee travel arrangements in order to ensure necessary Covid-19 safety measures are put in place.

However, while it may be necessary for employers to collect and record information regarding any self-isolation period employees are required to observe, the DPC Guidance explicitly provides, that “it should not be strictly necessary for employees’ vaccination status to be recorded in such instances".

Will the DPC's position change in future?

The DPC Guidance emphasises that the processing of health data in response to the Covid-19 pandemic should be guided by the Government’s public health policies and that its guidance will be subject to review if public health advice and laws relating to the nature of the virus, the pandemic and the interplay with vaccination change.

Therefore, while the DPC Guidance has clarified the position for the time being, the potential for future change is expressly acknowledged. As such, employers should continue to closely monitor the evolving public health and government guidance.