After over a year of restrictions, it appears that, finally, we are emerging out the other side of the Covid-19 pandemic and back to some sort of normality; an emergence that is being heavily facilitated by two things: vaccinations and Covid testing.
Since Monday 17 May, when the vaccination passport scheme was launched, people wanting to travel abroad need to prove that they have been vaccinated or have tested negative for COVID-19. From a business perspective, lots of organisations, such as schools, care homes, and hospitals, have for many months required staff to regularly evidence negative Covid test results; and as lateral flow tests become more widely available, increasing numbers of other types of organisations are considering using regular Covid testing to keep their employees and visitors safe as they head back on-site.
Now, with the introduction of vaccination passports for international travel, it is not unimaginable that employers may request the disclosure of employees’ vaccination status as an additional condition of entry into the workplace.
The privacy implications of requiring individuals to disclose their Covid status or vaccination status to be permitted entry into a country, a workplace, or even a pub, have been widely discussed. On this topic, the UK’s Information Commissioner, Elizabeth Denham, has previously warned that schemes of this type would face significant questions relating to their necessity, proportionality and transparency. But, whilst undoubtedly there are data privacy implications of processing this personal data – it is, after all, special category health data – the primary issue is whether it is first and foremost a Health and Safety issue, and therefore vaccination passports are a reasonable measure to fulfil the aim of keeping an organisation’s workforce safe. Rob Masson, CEO, at the DPO Centre says “Although privacy implications should be a consideration when assessing the reasonableness of such a measure, this is not the only consideration. It is therefore a question that cannot be answered soley by your Data Protection Officer (DPO) or any data protection professional.”
The DPO Centre, a leading data protection company, says that organisations must themselves make the initial decision about whether disclosure of this information is appropriate based upon a robust risk assessment, taking into account Health and Safety regulations in line with current government guidance. DPOs are unable to advise on what safety measures organisations should take and whether they are sufficient or not. However, once the decision to require the disclosure of vaccination status has been made, the secondary issue, of how to manage this in line with data protection legislation, will kick in and it is at this point that DPOs will be pivotal in ensuring the processing is lawful.
Whilst there may be the perception that data protection laws prevent organisations from making decisions to carry out processing activities such as these, in reality, they are not there to prevent the legitimate processing of personal data, merely to ensure that when it is processed, it is done so fairly and with respect to individuals’ rights. In the case of using vaccination status as a condition for entry into the workplace, this means identifying an appropriate Article 6 lawful basis and Article 9 condition for processing; ensuring that only the minimum amount of personal data as is necessary is collected; that the data is kept for no longer than is required; and it is stored securely and shared in only appropriate ways.
