Yes, but you must be clear about your reasons for doing so.
To comply with data protection obligation, employers must have a legal basis for processing such information and ensure they comply with the conditions for processing special category data relating to employees’ health, under the UK GDPR: http://bit.ly/ICOspecialcategorydata
The Information Commissioner’s Office (ICO) publishes guidance for organisations on in what circumstances collecting vaccination data can be justified. Depending on its reasons for asking about vaccination status, an employer may be able to rely on its legitimate interests and compliance with employment rights and obligations, as the basis for processing such data.
Certain workplaces are more likely to be able to justify the collection of such special category data, for example, within a health or care organisation, where coronavirus presents a specific risk. However, employers should consider carrying out a data protection impact assessment before collection of vaccination data.
If personal data of this nature is collected, the employer must ensure it is kept securely and that it is shared only with specific people who need to access it and it must be kept for no longer than necessary. Anonymised records could be considered, if the employers’ aim is to monitor levels of vaccination across the workforce, rather than recording whether specified individuals have been vaccinated.
It’s worth remembering that employers would need to provide employees with information about how and why their vaccination data is being processed. This could be an update to an existing privacy notice or could be provided as a separate document.
Lastly, employers should be aware that an attempt to impose a mandatory vaccination policy would create risk of legal claims and employee relations issues.
For more information on how we can provide you with HR support on any of the HR topics listed here, contact us on 07762 629448, or click here.
