Vaccines
As the vaccination rollout continues across the UK many difficult legal issues arise for employers. These FAQs are based on the key vaccine related issues that members need to consider when introducing permanent candidates, supplying temporary workers and managing their own internal employees. We will update this section to include new FAQs as and when developments occur.
Can I require my workforce to be vaccinated?
The issue of mandatory vaccines is complex. Whether or not an employer can require their workforce to be vaccinated will depend on several factors, including the type of work being done, the place of work and the individual circumstances of each employee.
There are currently no laws in force which state that a person must have the vaccine. Imposing such a requirement that forces individuals to be vaccinated would contravene Article 8 of the Human Rights Act 1998, which gives everyone the right to respect for private and family life.
However, under the Health and Safety at Work Act 1974 (HSWA), employers must take reasonable steps to reduce workplace risks, so employers should at least be engaging with their employees by educating them and encouraging them to be vaccinated to protect themselves and others.
Employees also have a similar duty under the HSWA to co-operate with their employer, to reduce workplace risks.
If an individual refuses to be vaccinated, it will be very important for employers to consider the individual's circumstances and their reason/s for the objection. It could be based on concerns around the side effects or strong philosophical opposition to vaccines in general, or because they have a disability, and the vaccine could worsen their condition.
In such circumstances if an employer decides to dismiss an employee for refusing to take the vaccine, if applicable, the employee can point to religion or a disability or another protected characteristic to bring a discrimination claim under the Equality Act 2010, unless the employer can objectively justify its decision.
For instance, in healthcare with frontline workers, an employer could show that having a vaccine is the most reasonably practicable way of mitigating the risk of transmission of Covid-19 by setting the vaccine requirement as a proportionate means of achieving a legitimate aim to protect patients, staff and the public. However, if the employee in question has one of the protected characteristics under the Equality Act, for example, a pregnant worker who decides not to take the vaccine based on medical advice, then employers must act carefully and ensure that the worker is not in any way discriminated against.
Apart from the Equality Act, any employee with more than 2 years’ service who refuses to take the vaccine is protected from unfair dismissal. Employers need to be careful in their decision and consider reasonable alternatives such as a phased return, continuous working from home or even redeployment.
The bottom line is that employers must consider each case on its own merits and consider all relevant factors and the application of equality laws, when determining whether imposing mandatory vaccinations can be justified.
Engaging in an education programme around the vaccine is a good place for employers to start. ACAS encourages employers to discuss the following issues with their workforce:
- the government's latest vaccine health information
- when staff might be offered the vaccine
- if staff will need time off work to get vaccinated
- pay for time off work related to the vaccine
- whether the employer plans to collect data on staff vaccinations, and if so, how this will follow data protection law
- whether anyone needs to be vaccinated to be able to do their job
Will vaccinations be made mandatory for staff in care homes with older adult residents?
Following the Department of Health and Social Care (DHSC) consultation which took place in April and May getting the vaccination is to become a condition for those staff working in care homes with older adult residents. The requirement will apply to anyone working in a registered care home providing nursing or personal care on a full-time, part-time or volunteer basis, whether employed directly by the care home provider or by an agency.
Health Secretary Matt Hancock has said it was a "sensible and reasonable step" and he would consult on extending it to the NHS. Workers will have 16 weeks to get both jabs from the time regulations are approved by Parliament.
If they do not, they face being redeployed away from front-line care or potentially losing their job. Workers who can prove they are medically exempt from getting the vaccine will not be affected.
There are currently no plans to extend mandatory vaccinations beyond health and care workers.
The full consultation outcome can be viewed on the government website here.
Can I ask candidates and employees if they’ve been vaccinated?
Employers can ask about the vaccination status of candidates and employees but must ensure that there is a valid reason for doing so and consider data protection requirements as well.
The Information Commissioner's Office (ICO) has detailed guidance for employers on this question.
Lawful basis
The starting point is that you must have a lawful basis for processing data relating to the vaccine. The lawful bases for processing are set out in Article 6 of the UK GDPR. At least one of these must apply whenever you process personal data:
1. Consent: the individual has given clear consent for you to process their personal data for a specific purpose.
2. Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract.
3. Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations).
4. Vital interests: the processing is necessary to protect someone’s life.
5. Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.
6. Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests.
Organisations will be able to rely on the legitimate interest basis where there is a compelling justification for the processing. This basis recognises that sharing the data is likely to be in the interests of the individual, the organisation and the public health efforts to tackle COVID-19, as long as you protect individuals’ rights, and you follow data protection principles.
You should also consider the other lawful bases and make an assessment to see which basis is the most appropriate for your situation.
What does 'special category data' mean?
The next thing to consider is that the details of the vaccination status of individuals is their private health information and is therefore considered 'special category data'. This means that any use of the data must be fair, necessary, and relevant for a specific purpose.
Because of the sensitive nature of special category data, an extra layer of protection is given to it which means that in addition to identifying a legal basis to process the data, you must also identify a 'condition for processing' from the 10 conditions that are set out in Article 9 of the UK GDPR.
According to the ICO, the most likely conditions to be applicable are:
o the employment condition; or
o the public health condition.
The ICO warns that 'if you intend to rely on the public health condition, you must ensure that a health professional carries out the processing, or that you tell people you are treating their vaccination status as confidential and would only disclose it in defined circumstances. Relying on consent as a condition is rarely appropriate in an employment setting given the imbalance of power between the employer and employee.'
Under both the employment condition and the public health condition, the processing of data must be 'necessary'. The ICO states that this does not mean that it has to be absolutely essential to process the data, but it must be more than just useful or habitual.
Is it necessary?
Keeping the 'necessary' requirement to mind, the most important factor to consider from the outset is why you need to collect the information for your workforce.
To justify collecting the data, the reason must be 'clear and compelling'. So, if you are asking individuals about whether they have been vaccinated and you are storing that data without any legitimate reason and just for record keeping practices, then it is unlikely that will ever be justified.
On the other hand, if you operate in a sector where your employees come into contact with clinically vulnerable people, such as a hospital or care home, then it will be easier to justify asking candidates and employees about their vaccination status and storing the data. This is because you will have a very clear reason to do so, and you can rely on the public health processing condition. However, if you intend to rely on the public health condition, you must ensure that a health professional carries out the processing, or that you tell your workforce that you are treating their vaccination status as confidential and would only disclose it in defined circumstances.
Once you have established that you have a solid reason to collect the data, you must make sure that the collection of it will not result in any unfair or unjustified treatment of employees. If it is likely to, then you should conduct a data protection impact assessment. An example of how the collection of the data might negatively impact an employee would be if the individual were not vaccinated, and for that reason was not offered a particular new role or promotion.
The ICO guidance states that:
"The collection of this information must not result in any unfair or unjustified treatment of employees and should only be used for purposes they would reasonably expect. You should treat staff fairly and if the collection of this information is likely to have a negative consequence for an employee, you must be able to justify it. When considering fairness, you should remember that different people are offered the vaccine at different times and some people may not yet have been offered a vaccination."
Should I consider the Conduct Regulations when it comes to asking about vaccination status?
The Conduct of Employment Agencies and Employment Businesses Regulations 2003 (the Conduct Regulations)
Under Regulation 20, neither an employment agency nor an employment business may introduce or supply a work-seeker unless it has taken reasonably practicable steps to ensure that both the client and the work-seeker are aware of the requirements imposed by law, or by any professional body which must be satisfied to work in the position.
An employment agency or employment business should also make all reasonably practicable enquiries to ensure that it would not be detrimental to the interests of the work-seeker, or client for the work-seeker, to work for the client in the position.
When placing work-seekers into certain sectors, such as the health and social care sector, it is increasingly likely that obtaining data about their vaccination status will form part of the 'reasonably practicable enquiries' that must be made. However, in other sectors it may not be as obvious, and employment agencies and businesses should liaise closely with their clients in order to determine if the information is required from the work-seeker. If it is necessary to ask the question, then the above rules on how to manage the data should be closely adhered to.
How long can I keep vaccine related data for, and can I share it with other departments within my organisation?
If you can justify asking individuals about their vaccination status, then you must be transparent in how you do it. Inform them in a clear manner about why you are asking them about their vaccination status and what you will do with their data. You must also ensure that the data is secured in a safe manner and you should not routinely disclose vaccine status to other people within your organisation unless you have a legitimate and compelling reason to do so.
To ensure that you have an ongoing legal basis for holding the information, you should conduct regular reviews of your processes. Keep up to date with the latest government guidance and monitor and implement changes accordingly.
If you have a valid reason for processing the data, then you should only collect the amount that is necessary and only keep it for as long as necessary. Keep your processes under review and make sure that your workforce/work-seekers are informed throughout the process so that they clearly understand the reasons for collecting their data.
Where can I get more information on my responsibilities when it comes to vaccinating my work force?
ACAS has updated its guidance on getting the vaccine for work. This document deals with how to support staff that are getting the vaccine and ways to resolve workplace issues that are related to getting the vaccine.
The Information Commissioner’s website contains detailed advice on how to manage data relating to vaccines and contains more FAQs on how to collect and manage data compliantly.
For more general advice on working safely during coronavirus, see the Heath and Safety Executive website.
As always, if you are unsure about your obligations, the REC Legal Helpline is on hand to help members.