Gathering employees’ vaccine data – Guidance from Data Protection Commission

Shannon Chamber HR is a dedicated HR and Employment Law Support Service for members of Shannon Chamber provided in partnership with Adare Human Resource Management, experts in Employment Law, Industrial Relations, Human Resources and Health & Safety at preferential rates.

As the vaccination programme continues with over 2.25 million people fully vaccinated as of 20th July, representing 46% of the Irish population, many employers are looking to get employees back to the workplace.


In order to support employers, the Data Protection Commission (DPC) published guidelines in June to address concerns about what information employers can gather and process in relation to employees and their vaccination status. Derek McKay, Managing Director of Adare Human Resource Management provides a summary of the DPC guidance.


For the purposes of GDPR, information on an individual’s vaccination status is considered special category personal data as it makes up part of their health information and is therefore, given additional protections under the data protection law.


The DPC states that “as a general principle”, and in the absence of advice from public health authorities, the collection and processing of an employee’s vaccination status is “likely to represent unnecessary and excessive data collection for which no legal basis exists”. It states that this is particularly the case when there is no clear advice pertaining to what the purpose of the data would be. For example, advice as to what employers would be expected to do with knowledge of vaccination status of workers; should they send non-vaccinated workers home or segregate vaccinated and non-vaccinated workers in the workplace.


According to the DPC, the processing of health data in response to Covid-19 should be guided by the Government’s public health policies.


However, there may be circumstances where vaccination could be considered a necessary measure; for example, those working in the provision of healthcare services or some services as provided by non-profit/ community support organisations. In these circumstances, the DPC says that an employer is likely to be in the position to lawfully process vaccine data on the basis of necessity insofar as they satisfy the requirements under this category.


Vaccination is voluntary

Government has been clear from the outset that vaccination is voluntary and it is the decision of each individual whether they take up the offer of a vaccine or not. This stance is reiterated in the Work Safely Protocol and in the DPC’s view, this further suggests that vaccination data should not be considered a necessary workplace safety measure. Consequently, the processing of vaccine data is unlikely to be necessary or proportionate in an employment context.


Employees returning after travel

The DPC also outlined that situations may arise where employers will need to be notified if an employee will be available for work after travelling to Ireland from abroad and undergoing any required periods of self-isolation. It confirmed that it is unnecessary for an employee’s vaccination status to be recorded in such instances, instead the employee should indicate the date on which they will be in a position to return to work.

Why Shannon Chamber HR?

  • Access to solutions-focused advice and support on HR and Employment Law queries for your Organisation provided by the experienced expert-led team at Adare Human Resource Management, giving you peace of mind that you can effectively manage any employment or HR issues that may arise. For information on the full range of services and supports provided, click here.

For further information on the HR and Employment Law support services provided, to arrange a meeting or to receive a quote, contact the team at Shannon Chamber – / 061 360 611