THE DATA PROTECTION Commission (DPC) has said there is currently “no clear legal basis” for the processing of vaccine data by employers about employees.

This relates to the issue of whether employers can legally collect and process information about the vaccination status of their workers. 

In a document about the processing of Covid-19 vaccination data in the context of employment, the DPC said that the processing of vaccine data by employers is “likely to represent unnecessary and excessive data collection for which no clear legal basis exists”. 

“This is particularly the case when there is no public health advice pertaining to what the purpose of such data collection would be,” the document said. 

For example, advice as to what employers would be expected do with knowledge of vaccination status of workers i.e. to send nonvaccinated workers home or segregate vaccinated and non-vaccinated workers in workplaces?

This is the DPC’s consideration in the absence of clear advice from Irish public health authorities about any necessity for employers to collect the vaccination status of its workers. 

It said the processing of Covid-related health data should be guided by the government’s public health policies. 

There may be some employment sectors where vaccination status could be considered necessary to collect, such as those providing frontline healthcare services.

The guidance outlined that information about a person’s vaccination status is ‘special category personal data’ for the purposes of GDPR (General Data Protection Regulation). 

The decision to get a Covid-19 vaccine is made voluntarily, which the DPC said “further suggests” that vaccination status shouldn’t be generally considered a necessary workplace safety measure and that the processing of a worker’s vaccine status is unlikely to be necessary.

It added that other considerations, such as younger workers not being fully vaccinated for several months and the uncertainty around long-term efficacy of vaccines, means there doesn’t appear to be a “sufficiently evidence based justification” to consider the processing of this data as necessary for employers.

The guidance said situations may arise in instances where employers need to be made aware of any periods of self-isolation if an employee travels abroad.

“It should not be strictly necessary for employee’s vaccination status to be recorded in such instances, rather the employee can be asked to indicate the date on which they will be in a position to return to work,” the DPC said. 

This guidance will be subject to review if the public health advice and laws relating to the pandemic change, the regulatory body added.