It has been reported that some employers are using software applications to track which of their employees have received the COVID-19 vaccine, and that some intend to use this data to decide whether to dismiss staff who refuse to be vaccinated.
As we have written before, "no job" no jab policies entail significant risks of employment tribunal claims for unfair dismissal or discrimination. However, the collation of this data also risks breaching the GDPR and Data Protection Act 2018 unless employers take great care.
Details of whether an employee has been vaccinated constitutes 'special category' data (as it concerns the employee's health) and so is subject to additional restrictions on processing.
Although an employer can rely on a number of potential legal bases for processing such data, employers will need to consider carefully whether these apply. For example, processing is permitted where necessary to assess the employee's fitness for work - but this would likely only apply to jobs where vaccination would be critical to performing the job safely and effectively.
Processing is permitted where necessary to carry out rights and obligations under employment law - but, again, if an employer cannot reasonably require vaccination as a condition of employment (or of carrying out certain tasks/working in certain locations) it is doubtful whether it could rely on this ground.
That would leave some employers having to rely on explicit consent from the employee to process the data - which is problematic in an employment context, not least because consent could be withdrawn.
With fines for breaching the GDPR of up to 4% of annual turnover, employers need to consider the pros and cons very carefully. For those employers which do consider it necessary (because of the nature of the work) to collate this data, it would be worth carrying out a data privacy impact assessment and considering carefully what safeguards should be put in place (for example, how long this data would be retained and who would have access to it).
Employers are in an unenviable position. With COVID restrictions likely to continue in some form for a considerable period of time, employers are understandably keen to do everything they can to get their businesses reopened and staff back to work. But employers should be wary of apparent quick fixes like a vaccine database: they are likely to have hidden traps.
Want to hear more from us? 
