COVID-19 and vaccinations – employment and data privacy considerations

This note addresses some of employers’ frequently asked questions in connection with those protections. It will be updated as the situation develops.

The discussion of possible employment law consequences assumes that an employer will only consider taking action against an employee if they have been offered but refused a vaccination. Younger employees without underlying health conditions may not be offered a vaccination before the end of July and taking action against employees before that point could result in age discrimination.

Is vaccination compulsory under UK law?

Vaccinations are not compulsory in the UK and the government is encouraging but not requiring all adults to be vaccinated against coronavirus.

When will employees be offered vaccinations?

At the moment the NHS is providing vaccinations based on a priority list reflecting clinical need and age.

This means that employees do not have control over when they are invited to have a vaccination. Employees who are under 50 are not expected to be offered a vaccination until priority groups have received at least a first vaccination, which is currently projected to be by mid- April.

Can we provide a vaccination for employees in the same way that we do for annual flu jabs?

It is not currently possible for employers to buy or administer vaccinations outside the NHS framework, so employers are not able to offer to vaccinate staff at this time.

Can we ask employees if they have been vaccinated on a voluntary basis?

In principle employers can ask employees whether they have been vaccinated if they have put proper procedures in place for processing that personal information.

As processing information about an employee’s vaccination status will amount to the processing of “special category personal data” under the UK GDPR, the employer will need to identify a lawful basis for processing under both Article 6 and Article 9 UK GDPR.

To fulfil these requirements, an employer may seek to argue that processing is necessary for it to comply with legal obligations to which is it subject as an employer (Article 6(1)(c) UK GDPR), such as an obligation to provide a safe work environment to its employees, and so an assessment of whether its workforce is free from Covid-19 may be justified on this basis.

An employer may also seek to rely on its health, safety and welfare obligations to employees (Article 9(2)(b) UK GDPR) for this processing and argue that collecting vaccination status information is in keeping with these obligations, or possibly other conditions, depending on the nature of the employee’s job. The strength of these arguments is likely to depend on whether vaccinations prove effective against Covid-19 in the longer term, and although at the moment it seems a reasonable position for employers to take, it is important to ensure that employers keep procedures and scientific guidance under review. If certain vaccinations are found to be less effective or even ineffective in protecting against contracting or spreading Covid-19 (or the various variants), the collection of personal data relating to immunisation status will become more difficult to justify.

Employers should keep a record of their decision-making process in their records of processing.

The basis on which data is processed and other relevant information should be explained to employees as part of a privacy notice, which can be provided as a free-standing document specific to immunisation data.

It would be also be advisable to conduct a data protection impact assessment documenting the justifications for processing the data before collecting information, and to comply with any other associated requirements, such as the need to have an appropriate policy document in place for the processing of special category personal data.

How long should employers hold vaccination data?

Employers should assess how long information about immunisation status is likely to be required for the purposes for which it is collected, such as complying with health and safety obligations. For example, if the evidence shows that vaccination ceases to be effective after a period of time, it may no longer be necessary to retain data once that period has expired. Employers should therefore make sure they delete this information once the purpose for which it was collected is no longer applicable.

Can employers share information about vaccination with managers or colleagues?

Information about vaccinations should only be shared on a fully anonymised basis where there is a clear business purpose for doing so. Data should not be provided at a level of granularity that makes it possible to identify employees who have not been vaccinated and employers should consider providing data only to those with a business need to know.

Employers should not share data about an employee’s immunisation status with colleagues, although it is possible to update staff about vaccination rates in general terms provided that individual employees cannot be identified.

What action can an employer take if an employee has refused to be vaccinated?

Again, appropriate action in relation to an employee who has refused to be vaccinated will depend on a variety of factors including the nature of the role and the workplace.

If an employee can work remotely it may be possible to instruct them to continue to do so and require them not to return to the workplace for the time being. If the employee continues to be paid their normal pay, there is limited scope for an employment claim. Particularly if the requirement to work from home is temporary it is unlikely to be a fundamental breach of contract entitling the employee to resign and claim constructive unfair dismissal. Although working from home may not be a satisfactory long-term solution, the employer can review the position as the situation develops. Once a sufficient number of employees have been vaccinated it may be possible for un-vaccinated employees to return to the workplace in due course without posing a significant health and safety risk to others, including fellow employees. The risk of a discrimination claim is addressed below.

What is the position if an employee cannot work remotely?

If an employee is not able to work remotely, the employer will have to decide whether to suspend and/ or take disciplinary action against them, or whether to allow them to return to the workplace without being vaccinated.

If the employer dismisses the employee because they have refused to be vaccinated and the employer is not willing to permit them to return to the office there is a risk of an unfair dismissal claim if the employee has two years’ service.

If the employee is suspended on full pay, there is a risk of the employee resigning and claiming constructive dismissal. In any event, this is obviously not a long-term solution from the employer’s perspective.

If the employee is suspended without pay, there is a much greater risk of the employee resigning and bringing a constructive unfair dismissal claim if they have the necessary length of service. Alternatively, they could bring an unauthorised deduction from wages claim on the basis that they are able and willing to work and it is the employer’s actions that prevents them from doing so. Such a claim is likely to be successful. If the employee brought such a claim and was subsequently dismissed, they would be able to argue that the dismissal was for asserting a statutory right and automatically unfair. There is no qualifying period of service for such an automatic unfair dismissal claim.

The risk of a discrimination claim is dealt with below.

In either a constructive or ordinary unfair dismissal case, the employer will have to show that it has a fair reason for dismissal, which is likely to be some other substantial reason or possibly misconduct, being failure to follow a reasonable management instruction to be vaccinated. Whether a dismissal is reasonable will be very fact specific and is likely to include consideration of the nature of the role and workplace, how many employees have been vaccinated, the effectiveness of vaccines in preventing transmission, whether employees have been permitted to attend the workplace before they were eligible for vaccination, and whether other measures are in place or could be put in place within the workplace, such as regular testing, to reduce the health and safety risk posed by Covid-19 to acceptable levels.

The government guidance on working safely makes the point that those additional restrictions continue to apply even where staff have been vaccinated. It may be difficult to persuade a tribunal that a dismissal was within the range of reasonable responses when government health and safety guidance for workplaces does not require staff to be vaccinated and vaccination is not compulsory.

Is there a risk of discrimination claims if an employer bans people who have not been vaccinated from the workplace or decides to dismiss them?

Refusing to allow an employee to attend the workplace if they have not been vaccinated, or dismissing them for refusing to be vaccinated, could potentially amount to indirect discrimination because of a protected characteristic. Employees are most likely to rely on the protected characteristic of disability (it is not recommended that people with certain conditions be vaccinated), sex (women with low risk pregnancies are currently advised against  vaccination) or potentially religion and belief (if an employee’s religious beliefs prevent them from being vaccinated). It is unlikely that someone would be able to bring a discrimination claim purely on the basis that they are an “anti-vaxxer” as they would need to show that anti-vaxxer beliefs are worthy of respect in a democratic society. Given emerging evidence about lower vaccination rates amongst some BAME populations, it is also possible that employees could claim that a requirement to be vaccinated is indirectly discriminatory because of race although at this stage there is insufficient information to know whether tribunals would accept such an argument.

If the employee were able to show that the requirement to be vaccinated placed those with the relevant protected characteristic at a particular disadvantage, the employer could argue that the requirement was justified as a proportionate means of achieving a legitimate aim and as such lawful. The legitimate aim would be protecting the health and safety of employees and others in the workplace. Whether refusing to allow employees to attend the workplace or dismissing them is proportionate will depend on factors such as the nature of the business, the role the employee performs, whether the employee could be offered an alternative role and how many other employees have been vaccinated. In a typical office-based environment it may be difficult to show that excluding an employee or dismissing them is proportionate. As noted, government health and safety guidance does not mandate compulsory vaccination and in many cases employees who have not been able to work from home have been attending workplaces for the last year, regardless of the fact that they have not been vaccinated.

If an employee cannot have a vaccination because of a health condition that amounts to a disability under the Equality Act, there is also the risk of a discrimination arising from a disability claim. It seems unlikely that an employer would be able to justify a dismissal in particular as a proportionate means of achieving a legitimate aim in such circumstances, not least because the employer would also be under a duty to make reasonable adjustments to the policy to avoid disadvantage to those with disabilities.

Can an employer refuse to recruit someone who has not been vaccinated?

If a job applicant is not appointed because they have not been vaccinated, they could bring a discrimination claim if they have a protected characteristic. The considerations outlined above will apply.

Employees without a relevant protected characteristic will not be able to challenge the decision not to recruit them in the employment tribunal.

Are there any other steps an employer can take to encourage vaccination?

There are significant legal risks for an employer that wants to require staff to be vaccinated in order to attend the workplace or remain in employment, although these will vary a bit depending on the nature of the workplace and the employee’s role.

Another option would be for the employer to encourage take up of vaccinations among staff by providing reliable information about the benefits of the vaccine and the importance of maintaining a safe working environment. Employers can also support the vaccination programme, for example by providing paid time off for vaccination appointments. In the long run, such steps may be a better way of balancing health and safety concerns with employee rights than trying to make vaccinations compulsory.

Authored by Stefan Martin, Ed Bowyer, and Nicola Fulford.