With more than half of the UK population already vaccinated against Covid-19, questions are emerging around what information employers can request from staff and whether they’re under any obligation to provide answers. RiskACUMEN’s Nigel Raywood discusses a tricky issue that's wrapped up in all kinds of employment, health and safety and data protection regulation...
HAVE YOU BEEN vaccinated against Covid-19? It’s a question increasing numbers of us may well face as society opens up, whether for travel, attending major events or just popping to the local pub. But what about the workplace? Given privacy concerns, is it a question employers even have a right to ask? And what kind of judgement calls can employers make should they have access to this information?
It’s tricky. As is often the case, it’s really a matter of balancing one risk against another. So here, rather than providing definitive answers - I’m not a lawyer after all, and which lawyer ever gives a definitive answer anyway - I’d like to give a round up of what legal commentators have been saying recently about all of this.
So the first question - can employers ask employees if they’ve been vaccinated? The answer here is fairly straightforward, in that if there is some rationale behind the question, then it may well be OK to ask. In truth, this is more to do with... do employees have to provide an answer?
Let’s quickly move on to this then as the next question. General legal opinion is that employees are under no obligation to tell their employer whether they have been vaccinated or not. However, they may have to if they are contractually obliged to do so. It seems highly unlikely that many people will have such a contract of employment currently, but this could be built into contracts for new starters. When it comes to changing existing contracts, consent would be required.
Health and safety
The main caveat overall is health and safety. To quote the Health and Safety Executive (HSE): “It is an employer's duty to protect the health, safety and welfare of their employees and other people who might be affected by their business. Employers must do whatever is reasonably practicable to achieve this.”
So, it could be argued, in certain circumstances, that an employer may reasonably require information on vaccination status from employees as part of their health and safety duties following, let’s say, a Covid-19 risk assessment. We’ll return to this later, as all of this leads on to another question.
Can employers require employees to be vaccinated? This is an issue which has garnered much publicity in connection with care homes recently. It has been reported that some care homes are now making the vaccine a requirement for new staff.
According to the National Care Association, some care workers are refusing the vaccine for ‘cultural reasons’ while others are doing it on health grounds or are worried that the vaccination programme has been fast-tracked and has not been tested on enough people. So as well as moral and ethical issues for employers to consider, there is clearly an underlying risk of constructive dismissal and/or discrimination on the grounds of age, disability, religious belief and so on.
As things stand, because there is currently no legal obligation for employees to be vaccinated against Covid-19, workers are within their rights to refuse any request by their employer to do so.
Catch-22
However, what about the employer’s duty to protect the health, safety and welfare of employees and others, as highlighted above. Does this not put employers in a kind of catch-22 situation?
It does, but there are steps that could be taken to satisfy all aspects. For example, employers could ask non-vaccinated employees to perform different duties by way of a “reasonable management instruction” to comply with health and safety obligations. Lawyers say it is better if these changes are agreed rather than imposed and that it would likely not be reasonable to expect staff to perform different duties if health and safety risks could be managed in another way.
Keeping records
The final area to consider in all of this relates to record keeping. Can information on which employees have or have not been vaccinated be stored?
The answer here is yes, but it should be recognised that such data relates to health and must be treated with additional caution under data protection regulations, including carrying out what is known as a Data Protection Impact Assessment (DPIA) before processing.
According to the Information Commissioner a DPIA is needed when “processing that is likely to result in a high risk to individuals.” The DPIA must describe the nature, scope, context and purposes of the processing; assess necessity, proportionality and compliance measures; identify and assess risks to individuals; and identify any additional measures to mitigate those risks.
Under GDPR, employers will most likely rely on their “legitimate interests” for processing such data. But this means clearly identifying what that interest is, why processing is necessary in such a context and also should take into account the interests, rights and freedoms of employees.
Over to you
So there you have it. As with most things risk-related, it’s not as simple as implementing this to achieve that. I believe this issue will evolve and hopefully some consensus achieved to balance the rights and freedoms of individuals against the clear need to protect peoples’ health and safety.
Risks are rarely avoided. Because they come in all guises and from various different angles, risks are always there to be managed.
What's your view? Does health and safety override the rights and freedoms of individuals? Should employees be required to disclose their vaccination status? Can employers be trusted with such data? Please comment here or on our RiskACUMEN Linkedin page.