Goldman Sachs is apparently encouraging its UK staff to reveal their Covid vaccination status, and has gone a step further in the United States (where the legal position appears to be different) by requiring this.
The position in England and Wales is that an employer may be able to require this, providing there is a good reason for collecting the information and certain rigid data protection requirements are met. Therefore, an employer thinking about this should take care when considering the basis for, and purpose of, such a request.
For example, such a request may be justifiable if the employer is assessing risks at the workplace, has a significant health and safety-related concern or is determining a worker’s eligibility under any vaccination incentive scheme. Whereas, it is unlikely to be justifiable to collect this information just for monitoring purposes.
For linked considerations about whether an employer can require staff to be vaccinated, see our previous article: How to handle vaccine hesitancy at work.
As to the data protection requirements, this is private health information and so under the rules is “Special Category Data” which requires extra protection. Broadly, this means that, as well as having a lawful basis and condition for holding and using the data (likely if, as explained above, there is a “good” reason for the request), the employer must:
- keep it safe and secure;
- communicate openly and transparently with its staff about its use;
- not hold it for longer than is necessary; and
- not use it in ways the staff would not reasonably expect.
Further, if the use of this data is likely to result in a high risk to the staff, such as the denial of employment opportunities, then the employer may need to complete a “Data Protection Impact Assessment” to identify and minimise the associated data protection risks.
Ben Lindsay in our specialist employment team comments:
“It is understandable that employers – who are having to navigate many significant challenges presented by Covid – may want to know their staff’s vaccination status. However, as explained above, employers should take care before requiring or even just asking for this information, to make sure that the request has a sound basis and that the associated data protection requirements are met. In this, employers should note that compulsory vaccinations may not be a justifiable policy, as explained in our previous article available via the above link.
Finally, just to note that truly anonymised data is not subject to data protection law. Therefore, an employer may wish to consider this as a possible alternative, to monitor general levels of vaccination across the workforce.”
For more information or advice, contact our specialist employment lawyers on 01753 889995 or email enquiries@bpcollins.co.uk
