Vaccinations and the Workplace

Last updated: Thur, 15th July, 2021

New guidance from Data Protection Commissioner

The Data Protection Commissioner (DPC) issued guidance on the processing of COVID-19 vaccination data in the context of employment.

The Guidance Note prepared by the Commission states;

“As a general position, the DPC considers that, in the absence of clear advice from public health authorities in Ireland that it is necessary for all employers and managers of workplaces to establish vaccination status of employees and workers, the processing of vaccine data is likely to represent unnecessary and excessive data collection for which no clear legal basis exists. This is particularly the case when there is no public health advice pertaining to what the purpose of such data collection would be. For example, advice as to what employers would be expected to do with knowledge of vaccination status of workers i.e. to send non vaccinated workers home or segregate vaccinated and non-vaccinated workers in workplaces?"

For further information, see the full guidance note from the Data Protection Commissioner here

Employee’s health data constitutes special category personal data under the GDPR. An employer must therefore have a legal basis for processing such data under Articles 6 and 9 GDPR and ensure suitable safeguards are in place.

Schools should therefore be mindful that, unless there is clear advice from public health authorities that it is necessary for all employers to establish vaccination status of employees, the general processing of vaccine data is likely to constitute data processing for which is there no legal basis, and therefore incompatible with the GDPR and data protection law.