It seems we are slowly marching towards “freedom day”, when the Prime Minister announces the removal of the restrictions that have covered almost every aspect of our day-to-day. However, Covid cases are on the rise again. With numbers as high as they were in Autumn 2020, We are all hoping the link between rising case numbers and rising deaths has been broken, but we won’t know for sure until we start to resume a normal life. The proof is in the pudding, or rather, it’s in the vaccine.
The vaccine is also the focus of today’s blog. Unless you’ve an (understandable) aversion to news channels, or you’ve taken up residence under a rock, you’ll definitely have heard of “Vaccine Passports”. This is the idea that those individuals now fully vaccinated, will be able to travel freely and attend large gatherings and events unhampered by coronavirus restrictions. The concept has been floating around since before vaccines were even available. Vaccine certification has already been used to run trial events in England.
There are concerns around all aspects of vaccine passes, from logistics to privacy and discrimination. However, for school and college staff who are too busy to go abroad or attend concerts, it’s not currently the greatest concern. Nonetheless, the controversy of the scheme has raised a question that is relevant to education institutions. “Can I ask if my employee is vaccinated?”
Can I Collect Data About Employee Vaccinations?
The first question here, is “what are you trying to achieve?”. To put it simply, why do you want to collect this data?. When collecting personal data, you need to consider two things. Is using this data necessary, and is it relevant for a specific purpose?
This is something you should consider when collecting any personal data, but it’s particularly important with data such as vaccination status. Medical data is special category data. It is afforded additional protections, and you need to provide strong grounds for using it..
So, why would you need to collect employee vaccination status? There are a few scenarios where collecting this data might be justifiable. For example, if employees work amongst clinically vulnerable individuals. Additionally, if employees are working in a health or social care setting, where they are more likely to become infected with Covid-19, it might be prudent to record their vaccination status.
Unless your organisation runs differently to the average school or college, for instance you provide specialist provision or you work with clinically vulnerable students, it’s unlikely you’ll have compelling reasons to collect vaccination data. If you are collecting this information simply for monitoring purposes, you’ll likely struggle to find adequate justification.
Justifying the Processing of Vaccination Data
You’ve concluded that vaccine data is necessary and relevant to the running of your organisation, now you need to select a legal basis of processing. If this data is integral to running the school or college, you should probably use public task as your legal basis. If you run an independent school, you would use legitimate interest.
As said before, this can only really be justified if you have a good reason to collect data about employee’s vaccinations. Additionally, you’ll need to identify an article 9 condition for processing, as Vaccination status is health data. You could consider using either Employment Law (Art. 9(b)) or Public Health (Art. 9(i)).
If you are using the public health exemption in article 9, you must take additional steps, either by ensuring a health professional carries out processing, or by explaining to employees that vaccination data will be treated as confidential and only shared in defined circumstances.
Can We Collect Vaccine Data if We Ask for Consent?
Your Organisation could possibly request vaccination details on the basis of consent. Employees could consent to share their data. However, employees would need to provide explicit consent due to the nature of the data. Additionally, consent is a poor choice of legal basis for data processing in the workplace.
Freely given consent is possible in theory, but does not allow for the inherent imbalance of power in the workplace. A key aspect of consent is the placement of power in the hands of the data subject. Consent should be free of sanctions or perceived sanctions. It’s unlikely an employee will feel they can refuse consent without sanctions at a later date. Employers have power over wages, promotions and job security. That power means that any consent given by an employee is unlikely to be entirely freely given.
As such, consent is an inappropriate lawful basis of processing for most personal data in the workplace.
Should we be processing vaccine information?
The answer may well be no. The pandemic has meant the sharing of information has been vital. Test and trace only works if test results are shared. This doesn’t mean there’s a free-for-all on all things “Corona”. As a general rule, we should only be collecting information we need to collect.
What’s the key take-away?
The collection and use of vaccinations data is a great way to look at any consideration of processing personal data. It comes down to some simple questions:
- Do we know exactly what data we want to process?
- Is it necessary, or a legal obligation?
- Do we have a legal basis to justify processing the data
- Can we provide appropriate protection for the data?
- Can we provide suitable control for the individuals over their data?
If you can’t answer all these questions with a solid ‘Yes’ then the chances are you should not be processing this data.
