The Data Protection Commission have updated their guidance related to the processing of COVID-19 Vaccination Data in the context of Employment and the Work Safely Protocol (WSP).
It has been noted that while Employers may process personal data as set out by the WSP, such as a log of contacts to facilitate contact tracing and information contained in the Pre-Return-to-Work forms, the Protocol does not currently require Employers to collect any information regarding Employees’ vaccination status.
Information related to vaccination status is considered “special category data” for purposes of GDPR compliance which requires additional measure of protection under the data protection legislation. Therefore, it can only be processed where there is a legal basis for the processing of such data. The Data Protection Commission (DPC) are of the view that “the processing of vaccine data is unlikely to be necessary or proportionate in the most employment contexts” as the WSP highlights that the decision to get a vaccine is voluntary.
The DPC acknowledges that there may be situations where an Organisation may have a legitimate reason to know whether their Employees have been vaccinated or not, and “the processing of data revealing vaccination status may be deemed necessary, for example - in the Healthcare industry, where vaccination can be considered a necessary safety measure. However, processing of data should be subject to a risk assessment and with reference to sector-specific public health guidance.
The DPC have stated that, except for the specific employment contexts outlined above, “Employees should not be asked to consent to the processing of vaccine data, as this consent is not likely to be freely given because of the inequality in bargaining power between an employer and an employee.”